| File name: | Patricia_Daniel_resume.doc |
| Full analysis: | https://app.any.run/tasks/3b6d6ca3-edd1-4a11-823a-c2b67bce646e |
| Verdict: | Malicious activity |
| Threats: | CryptoWall is a notorious ransomware family that emerged in early 2014 and rapidly became one of the most destructive cyber threats of its time. This malware encrypts victims' files using strong AES encryption, demands ransom payments in Bitcoin, and has generated hundreds of millions of dollars for cybercriminals. |
| Analysis date: | May 21, 2021, 19:46:52 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | 54BD0EE44C394B526FB57B10FD20A407 |
| SHA1: | EDD3A85DC994012DCAF5EA8080EFB1C768F4A129 |
| SHA256: | 5A56547721D751A12ACBF2135A0C054BD72A09DA3AC93A1562786EDBF4B591EE |
| SSDEEP: | 6144:jFbJfPUzOtPzlR2TD9P4pqFOkD25jzPa8C8KnJs2RlTdoWT8p:xJHUzOt/2/9P4YYD5Xi8CPnJs2RdaWgp |
MALICIOUS
Executable content was dropped or overwritten
- WINWORD.EXE (PID: 2584)
Application was dropped or rewritten from another process
- iaEhcYUCko.exe (PID: 3412)
- iaEhcYUCko.exe (PID: 2868)
Changes the autorun value in the registry
- explorer.exe (PID: 4036)
Writes to a start menu file
- explorer.exe (PID: 4036)
Starts BCDEDIT.EXE to disable recovery
- explorer.exe (PID: 4036)
CRYPTOWALL was detected
- svchost.exe (PID: 2708)
Uses SVCHOST.EXE for hidden code execution
- explorer.exe (PID: 4036)
Drops executable file immediately after starts
- explorer.exe (PID: 4036)
Deletes shadow copies
- explorer.exe (PID: 4036)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2584)
Connects to CnC server
- svchost.exe (PID: 2708)
SUSPICIOUS
Application launched itself
- iaEhcYUCko.exe (PID: 3412)
Executable content was dropped or overwritten
- explorer.exe (PID: 4036)
Creates files in the user directory
- explorer.exe (PID: 4036)
Checks for external IP
- svchost.exe (PID: 2708)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2584)
Creates files in the user directory
- WINWORD.EXE (PID: 2584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
|---|---|---|
| .docx | | | Word Microsoft Office Open XML Format document (24.2) |
| .zip | | | Open Packaging Conventions container (18) |
| .zip | | | ZIP compressed archive (4.1) |
EXIF
XMP
| Description: | - |
|---|---|
| Creator: | Admin |
| Subject: | - |
| Title: | - |
XML
| ModifyDate: | 2015:09:11 13:58:00Z |
|---|---|
| CreateDate: | 2015:06:24 11:31:00Z |
| RevisionNumber: | 253 |
| LastModifiedBy: | MX |
| Keywords: | - |
| AppVersion: | 14 |
| HyperlinksChanged: | No |
| SharedDoc: | No |
| CharactersWithSpaces: | 932537 |
| LinksUpToDate: | No |
| Company: | - |
| TitlesOfParts: | - |
| HeadingPairs: |
|
| ScaleCrop: | No |
| Paragraphs: | 1865 |
| Lines: | 6624 |
| DocSecurity: | None |
| Application: | Microsoft Office Word |
| Characters: | 794940 |
| Words: | 139462 |
| Pages: | 404 |
| TotalEditTime: | 8.0 hours |
| Template: | Normal.dotm |
ZIP
| ZipFileName: | [Content_Types].xml |
|---|---|
| ZipUncompressedSize: | 1696 |
| ZipCompressedSize: | 434 |
| ZipCRC: | 0xcb72ec2e |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCompression: | Deflated |
| ZipBitFlag: | 0x0006 |
| ZipRequiredVersion: | 20 |
Total processes
48
Monitored processes
8
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2584 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Patricia_Daniel_resume.doc.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2612 | bcdedit /set {default} recoveryenabled No | C:\Windows\system32\bcdedit.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Boot Configuration Data Editor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2708 | -k netsvcs | C:\Windows\system32\svchost.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2796 | vssadmin.exe Delete Shadows /All /Quiet | C:\Windows\system32\vssadmin.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2868 | C:\Users\admin\iaEhcYUCko.exe | C:\Users\admin\iaEhcYUCko.exe | — | iaEhcYUCko.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3268 | bcdedit /set {default} bootstatuspolicy ignoreallfailures | C:\Windows\system32\bcdedit.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Boot Configuration Data Editor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3412 | "C:\Users\admin\iaEhcYUCko.exe" | C:\Users\admin\iaEhcYUCko.exe | — | WINWORD.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4036 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | iaEhcYUCko.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 549
Read events
941
Write events
530
Delete events
78
Modification events
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 8:? |
Value: 383A3F00180A0000010000000000000000000000 | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (2584) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
Executable files
4
Suspicious files
10
Text files
0
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2584 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR7A98.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2584 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\mso8305.tmp | — | |
MD5:— | SHA256:— | |||
| 2708 | svchost.exe | C:\Users\admin\AppData\Local\Temp\CabCEB3.tmp | — | |
MD5:— | SHA256:— | |||
| 2708 | svchost.exe | C:\Users\admin\AppData\Local\Temp\TarCEB4.tmp | — | |
MD5:— | SHA256:— | |||
| 2584 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 2708 | svchost.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | binary | |
MD5:— | SHA256:— | |||
| 2584 | WINWORD.EXE | C:\Users\admin\iaEhcYUCko.exe | executable | |
MD5:E7D1D86A3B3EEF70D4EFF0FBF94D7CAB | SHA256:09CCE2A039BF72E9C9896E475556563C00C467DC59D2535B0A0343D6741F9921 | |||
| 2584 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$tricia_Daniel_resume.doc.docm | pgc | |
MD5:— | SHA256:— | |||
| 2708 | svchost.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:— | SHA256:— | |||
| 2708 | svchost.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13 | der | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
8
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2708 | svchost.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/DigiCertGlobalRootCA.crl | US | der | 631 b | whitelisted |
2708 | svchost.exe | POST | — | 104.167.2.223:80 | http://freepolyclinic.com/gallery/small/ap1.php?a=blnck0ipesufe | US | — | — | malicious |
2708 | svchost.exe | GET | 308 | 188.165.164.184:80 | http://ip-addr.es/ | FR | html | 180 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 188.165.164.184:80 | ip-addr.es | OVH SAS | FR | suspicious |
2708 | svchost.exe | 34.117.59.81:80 | myexternalip.com | — | US | whitelisted |
2708 | svchost.exe | 142.250.186.131:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2708 | svchost.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 104.167.2.223:80 | freepolyclinic.com | Cloud South | US | malicious |
2708 | svchost.exe | 34.117.59.81:443 | myexternalip.com | — | US | whitelisted |
2708 | svchost.exe | 177.12.170.39:80 | gaiga.net | IPV6 Internet Ltda | BR | malicious |
2708 | svchost.exe | 177.12.170.39:443 | gaiga.net | IPV6 Internet Ltda | BR | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ip-addr.es |
| shared |
myexternalip.com |
| shared |
ocsp.pki.goog |
| whitelisted |
gaiga.net |
| malicious |
ocsp.digicert.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
freepolyclinic.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2708 | svchost.exe | A Network Trojan was detected | ET POLICY Possible IP Check ip-addr.es |
2708 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY External IP Check myexternalip.com |
2708 | svchost.exe | A Network Trojan was detected | ET TROJAN CryptoWall Check-in |