File name: | 05-2022-0438.doc |
Full analysis: | https://app.any.run/tasks/0be0bbe7-6b83-4d20-8b0a-cc87d649c3c2 |
Verdict: | Malicious activity |
Analysis date: | August 01, 2022, 14:40:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/octet-stream |
File info: | Microsoft OOXML |
MD5: | 52945AF1DEF85B171870B31FA4782E52 |
SHA1: | 06727FFDA60359236A8029E0B3E8A0FD11C23313 |
SHA256: | 4A24048F81AFBE9FB62E7A6A49ADBD1FAF41F266B5F9FEECDCEB567AEC096784 |
SSDEEP: | 192:AEhM7fIUU09264wptGheab8h7Z/c+8poF1d3jvvtl59rGxjPQDasYBcG7h+:AqWfIz092hwLGAabkcfa7pr1lzyxjPQ9 |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2022:05:26 23:08:07 |
ZipCRC: | 0x6cd2a4df |
ZipCompressedSize: | 340 |
ZipUncompressedSize: | 1312 |
ZipFileName: | [Content_Types].xml |
Template: | Normal |
---|---|
TotalEditTime: | - |
Pages: | 1 |
Words: | - |
Characters: | - |
Application: | Microsoft Office Word |
DocSecurity: | None |
Lines: | - |
Paragraphs: | - |
ScaleCrop: | No |
Company: | - |
LinksUpToDate: | No |
CharactersWithSpaces: | - |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16 |
Keywords: | - |
LastModifiedBy: | KIS2 |
RevisionNumber: | 3 |
CreateDate: | 2022:05:25 13:14:00Z |
ModifyDate: | 2022:05:25 13:14:00Z |
Title: | - |
---|---|
Subject: | - |
Creator: | KIS2 |
Description: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2532 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\05-2022-0438.doc.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4D57.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{BB526A40-DE0D-460B-B50C-6BF25431AB66} | binary | |
MD5:3A3392D1AE87C69BC16A6A89CD5FB954 | SHA256:73A8C97F068865787369C86C18E5418DA99ED74B7D40194DD45DC0AF722485BE | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{A75897FC-2D48-4F43-BC38-733632C7A021}.tmp | binary | |
MD5:68852F446AA150E4A44FC77BC53D0FF7 | SHA256:DFEEE6552FF6DE638EB4A7D91FB10C29DBE7A6EA75DC2DACA333B9B18509AE6A | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{BB422CDF-5CC0-41F9-8D75-E7FF43EC483A}.FSD | binary | |
MD5:A4809BC3DC599288491A43920534A90D | SHA256:B7A40344DEB198B36A4039CC48B86EEA7B1A0232CB00B22C9293245D23BD9375 | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{41906BFB-3F3A-4C98-A825-BE343EFE2A9D} | binary | |
MD5:A29CCEBF4F9AA6BA7BF4338398DC1420 | SHA256:EB20B68381B8D6CEFC48E61B2DBE873F9588AA120BE86A6598470B15BEB83BBD | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$-2022-0438.doc.docx | pgc | |
MD5:9C0CC50FA6CBEC021F793A29EF9D70FF | SHA256:02AB7BB939290089A4B02B72B0FA59D5AE300C9F0778945E26BB56CB7941D6B8 | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD | binary | |
MD5:A29CCEBF4F9AA6BA7BF4338398DC1420 | SHA256:EB20B68381B8D6CEFC48E61B2DBE873F9588AA120BE86A6598470B15BEB83BBD | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:DBE0D5DB2C9C555556FADACF28F68C70 | SHA256:A714FC80827F93E7A598F8C94C274E6F428107CD68C3A6E0106D4956C78CFDA4 | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD | binary | |
MD5:3A3392D1AE87C69BC16A6A89CD5FB954 | SHA256:73A8C97F068865787369C86C18E5418DA99ED74B7D40194DD45DC0AF722485BE | |||
2532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{1480DF5A-CFE3-46C0-95A2-A715F02FEE3D}.FSD | binary | |
MD5:568EA84270353C90F8EA5723781541EC | SHA256:0FE4F191E01E2CBFC365683676E9DD64C80CA67657B690D45AF5BC4E0775B2C6 |
Domain | IP | Reputation |
---|---|---|
www.xmlformats.com |
| malicious |