File name: | 49b367ac261a722a7c2bbbc328c32545 |
Full analysis: | https://app.any.run/tasks/30be9d4a-81e5-4070-a78e-1d71df5205e3 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 20:19:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: user, Template: Normal.dotm, Last Saved By: John, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 08:00, Create Time/Date: Fri Nov 25 19:04:00 2016, Last Saved Time/Date: Fri Nov 25 20:04:00 2016, Number of Pages: 1, Number of Words: 320, Number of Characters: 1828, Security: 0 |
MD5: | 49B367AC261A722A7C2BBBC328C32545 |
SHA1: | 5BD2E2B8DDC65931704C8C3EA57ADC2BB778F66A |
SHA256: | FF2C8CADAA0FD8DA6138CCE6FCE37E001F53A5D9CECCD67945B15AE273F4D751 |
SSDEEP: | 6144:1iuv7iu2oErXZ+e7m5OPoeKAUXso/UUsAJtfiZ:1N7iu2oaXYOrWjdfi |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 14 |
CharCountWithSpaces: | 2144 |
Paragraphs: | 4 |
Lines: | 15 |
Company: | Olymp |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 1828 |
Words: | 320 |
Pages: | 1 |
ModifyDate: | 2016:11:25 20:04:00 |
CreateDate: | 2016:11:25 19:04:00 |
TotalEditTime: | 8.0 minutes |
Software: | Microsoft Office Word |
RevisionNumber: | 11 |
LastModifiedBy: | John |
Template: | Normal.dotm |
Keywords: | - |
Author: | user |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2932 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\49b367ac261a722a7c2bbbc328c32545.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
3096 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\maintools.js" EzZETcSXyKAdF_e5I2i1 | C:\Windows\System32\WScript.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
3064 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\maintools.js" EzZETcSXyKAdF_e5I2i1 | C:\Windows\System32\WScript.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 |
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | ++; |
Value: 2B2B3B00740B0000010000000000000000000000 | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: Off | |||
(PID) Process: | (2932) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: Off |
PID | Process | Filename | Type | |
---|---|---|---|---|
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR939C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:A4BE3FE2A9810BE760A8E5504D04AA83 | SHA256:9D5D457B71B5758B9EE68216B0EF437DDA094ED1FFE474D841962A94667C2035 | |||
2932 | WINWORD.EXE | C:\Users\admin\Desktop\~$b367ac261a722a7c2bbbc328c32545.doc | pgc | |
MD5:5962280336D8BF5F58FD8E1471F180AD | SHA256:5810CF7AE17DA0DB23B19CDB1E0E99887DEA0BAD12846A2229835F06CD005CE0 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\49b367ac261a722a7c2bbbc328c32545.doc.LNK | lnk | |
MD5:A55D64557B783CD24E38F3BF78C3D877 | SHA256:3FA373C9A67F21B85AEEA1DAED1F6ACD554803A60BDD276FE85BE51EB4F95B0A | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | ini | |
MD5:A4166015741B1D8907F4B3E960EFC345 | SHA256:26E6456F6940D5F302D374B99A0D2A0627A579F16A11F2CBFBB48F693FB0FFB2 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9B8D4FDE.emf | emf | |
MD5:FDBBE99A5DD164B403945E6A98434CC1 | SHA256:D416447FB0A6AA8F66CB9C943B7FFDA365CE56D2AD8AC12AC0154EF8A52D1CA0 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD8247.emf | emf | |
MD5:FDBBE99A5DD164B403945E6A98434CC1 | SHA256:D416447FB0A6AA8F66CB9C943B7FFDA365CE56D2AD8AC12AC0154EF8A52D1CA0 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\maintools.js | text | |
MD5:5EA3FD094B69E9E00894842F95FD5D85 | SHA256:3A065547ADB0AFC63E318C2FA1F682108664E602934490A898C3DE1B23975628 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6E926D11.emf | emf | |
MD5:EB10732AA3F3BB122DC9452917A62FA1 | SHA256:750987BD6026CC8C515D0B6D65FFBE5BCBF7824EE56E82128D220EEF86390874 |