Find similar analyses in TI Lookup

Analysis date (UTC): 10 October 2019, 12:36Analysis environment: Windows 7 Pro, build 7601, x86

103_1.doc

MD5:0248698A84AAA0A8E35C85A10E572E7B

SHA1:111FC5557F71DF41F6BF5BE7BAB3C94156697305

SHA256:F623BBEEEA89387F78FAF0F39FC1D2F082EEE57683929657D652326FFB06D4D2

Analysis result

Threat level:Malicious activity

Tags:

macrosmacros-on-openqbottrojanmaldoc-3

Full analysis:Analysis 103_1.doc (MD5: 0248698A84AAA0A8E35C85A10E572E7B) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Gerilax.exe (PID: 2580)
Gerilax.exe (PID: 2552)
ytfovlym.exe (PID: 4072)
ytfovlym.exe (PID: 2576)

Starts CMD.EXE for commands execution

WINWORD.EXE (PID: 2308)

Executes PowerShell scripts

cmd.exe (PID: 1748)
cmd.exe (PID: 3328)

Unusual execution from Microsoft Office

WINWORD.EXE (PID: 2308)

QBOT was detected

Gerilax.exe (PID: 2580)

Runs PING.EXE for delay simulation

cmd.exe (PID: 2156)

Downloads executable files from the Internet

powershell.exe (PID: 2968)

SUSPICIOUS

Executable content was dropped or overwritten

powershell.exe (PID: 2968)
Gerilax.exe (PID: 2580)
cmd.exe (PID: 2156)

Application launched itself

Gerilax.exe (PID: 2580)
ytfovlym.exe (PID: 4072)

Creates files in the user directory

powershell.exe (PID: 2968)
powershell.exe (PID: 520)
Gerilax.exe (PID: 2580)

Starts itself from another location

Gerilax.exe (PID: 2580)

Starts CMD.EXE for commands execution

Gerilax.exe (PID: 2580)

INFO

Creates files in the user directory

WINWORD.EXE (PID: 2308)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 2308)

Dropped object may contain Bitcoin addresses

cmd.exe (PID: 2156)

Threats

PID	Process	Class	Message
2968	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2968	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2968	powershell.exe	Misc activity	ET INFO EXE - Served Attached HTTP