File name: | baddoc.doc |
Full analysis: | https://app.any.run/tasks/b221830f-18f6-4b6f-90e6-94ace7e407d0 |
Verdict: | Malicious activity |
Analysis date: | May 30, 2020, 10:17:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sun Feb 8 19:56:00 2015, Last Saved Time/Date: Tue Feb 10 15:27:00 2015, Number of Pages: 1, Number of Words: 51, Number of Characters: 291, Security: 0 |
MD5: | A3B613D128AACE09241504E8ACC678C2 |
SHA1: | EDDE71CCADFAD1380B881DA5ECAFC77FBA5885B8 |
SHA256: | 8B92C23B29422131ACC150FA1EBAC67E1B0B0F8CFC1B727805B842A88DE447DE |
SSDEEP: | 768:+0MGUUTYQin+b4C7UqCVuO1BtWmxzdrZUIdjXgAmxZp2j5s2p:+0MGUUTYQic8qS1XndrZf8pMV |
.doc | | | Microsoft Word document (35.9) |
---|---|---|
.xls | | | Microsoft Excel sheet (33.7) |
.doc | | | Microsoft Word document (old ver.) (21.3) |
CompObjUserType: | ???????? Microsoft Word 97-2003 |
---|---|
CompObjUserTypeLen: | 32 |
CodePage: | Windows Cyrillic |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 341 |
Paragraphs: | 1 |
Lines: | 2 |
Company: | - |
Security: | None |
Characters: | 291 |
Words: | 51 |
Pages: | 1 |
ModifyDate: | 2015:02:10 15:27:00 |
CreateDate: | 2015:02:08 19:56:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2156 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\baddoc.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2092 | cmd /c c:\Users\admin\AppData\Local\Temp\adobeacd-update.bat | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
580 | ping 1.1.2.2 -n 2 | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1884 | chcp 1251 | C:\Windows\system32\chcp.com | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
552 | cscript.exe "c:\Users\admin\AppData\Local\Temp\adobeacd-update"".""v""bs" | C:\Windows\system32\cscript.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Version: 5.8.7600.16385 | ||||
1144 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy bypass -noprofile -file C:\Users\admin\AppData\Local\Temp\adobeacd-update.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cscript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2208 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2108 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9CA6.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1144 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I1S7EFAQ8JAW1WFGA14V.temp | — | |
MD5:— | SHA256:— | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$baddoc.doc | pgc | |
MD5:B7CB83B667A6A8E6B934F091DB9B8221 | SHA256:C84F4C0A023F89D5D984EA4AF84BCB7B0BAE13BF281DDCF99252019282328573 | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:3FA7D20FB2918C2B467E889A1DBCEA39 | SHA256:4BC3E96DDEA9BEB70126BC25B15BB55005412972D59A5944319C244842B211E4 | |||
1144 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:4E0F44FCE986C54094A1285E2119425B | SHA256:E947381D6E962305CD55224AB7E37F590B670AA7F62180858CE3F4C218DA8012 | |||
1144 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF12d3e2.TMP | binary | |
MD5:4E0F44FCE986C54094A1285E2119425B | SHA256:E947381D6E962305CD55224AB7E37F590B670AA7F62180858CE3F4C218DA8012 | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:94B12A16AFAAD1F93980E9B5EA291E1E | SHA256:4FD7320E899B5F81D6D064A2193C4EFBBC55417B449112E22A9E03B86BD83F93 | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\adobeacd-update.bat | text | |
MD5:2B865123C5D736F3EA8A016EC51E5DE3 | SHA256:7BBB8A216527E939F0D576273B96B2E98415A400229F77BF56D8D365DA4B84F7 | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\adobeacd-update.vbs | text | |
MD5:969E1C8517CC2B734A1094AEF45AF8CD | SHA256:115508388A3ABF1674BE6A056459D5A2C9EE3627F8FBB4A03F73DA5598D37B5C | |||
2156 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1144 | powershell.exe | GET | — | 91.220.131.44:80 | http://91.220.131.44/upd/install.exe | unknown | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 91.220.131.44:80 | — | — | — | suspicious |