File name: | NoticeXofXCourtXFilingXXX29910-25664-00.rtf |
Full analysis: | https://app.any.run/tasks/ad2ef6c6-2349-4e18-8040-2e6b0cc22703 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 15:15:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal, Last Saved By: Suzanne Mifsud, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Thu Mar 21 00:45:00 2019, Last Saved Time/Date: Thu Mar 21 00:46:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0 |
MD5: | 0FDD82EEC9C2215CE7868E7B7B83DD55 |
SHA1: | 97BBE25D9C9D6293B203CF332ADDC2C67C525EF0 |
SHA256: | 5A381D00EF24AE2BD13C5851311AD821BEF058D18631F87BB51A91936DA29A21 |
SSDEEP: | 384:R+F8iSsqdg1vA9c4bqJaiIwKyAmp6UMGrpA0j3kG59T4tZw:R+S+1o91UxNd6UMQeIkG7D |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | - |
Paragraphs: | - |
Lines: | - |
Bytes: | 11000 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | - |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:03:21 00:46:00 |
CreateDate: | 2019:03:21 00:45:00 |
TotalEditTime: | 1.0 minutes |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | Suzanne Mifsud |
Template: | Normal |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
344 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\NoticeXofXCourtXFilingXXX29910-25664-00.rtf.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | {i2 |
Value: 7B69320058010000010000000000000000000000 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1316290590 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1316290704 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1316290705 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: 58010000E86EEDE8F8DFD40100000000 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | cm2 |
Value: 636D32005801000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | cm2 |
Value: 636D32005801000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (344) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR895B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
344 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:1F387C154890827081A11048FBBAF641 | SHA256:1BDD0EE9A91F3D3C1B977453EA3FFF0895AADC52EB15F4E238A4004713E7A598 | |||
344 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\NoticeXofXCourtXFilingXXX29910-25664-00.rtf.doc.LNK | lnk | |
MD5:F1F325C286FF1CF686C99C800014DBD2 | SHA256:5EFD07C388E8829B746C966BDEB08CFE86A89A97326393286FEB398E20325DF8 | |||
344 | WINWORD.EXE | C:\Users\admin\Desktop\~$ticeXofXCourtXFilingXXX29910-25664-00.rtf.doc | pgc | |
MD5:31B8200D06C8B9DE31D528E19F2734B1 | SHA256:6AAF624F0F109B68259081368F59B174C83DD50521AB0CD498747A2229290396 | |||
344 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:3325AE302B6C226D2F117FD4EE697EA0 | SHA256:B2ADE7A8C5453B4D88DB2B5FDCEBBADE4B11E8114CFF71D9F0A5FC9FB1B0A568 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
344 | WINWORD.EXE | GET | — | 50.63.202.91:80 | http://awdmiami.com/srt/ooo.exe | US | — | — | malicious |
344 | WINWORD.EXE | GET | — | 50.63.202.91:80 | http://awdmiami.com/TmQgZ/srt/ooo.exe | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
344 | WINWORD.EXE | 50.63.202.91:80 | awdmiami.com | GoDaddy.com, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
awdmiami.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
344 | WINWORD.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
344 | WINWORD.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |