flash

v22Pc0qA.doc.doc

Status: finished
Submission Time: 01.02.2021 23:14:29
Malicious
Trojan
Evader
Emotet

Comments

Tags

Details

  • Analysis ID:
    347028
  • API (Web) ID:
    595978
  • Analysis Started:
    01.02.2021 23:17:26
  • Analysis Finished:
    01.02.2021 23:33:12
  • MD5:
    7a7d325948481b0557b035249bf5c96a
  • SHA1:
    0529727ffad8388fc94155d1652ca65189cda5df
  • SHA256:
    47e4926bc53fb131b2e976d7b1c2f4b3c0f665242aa493d7e21b4df773b60919
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious
New

System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
96/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Potential for more IOCs and behavior

malicious
100/100

malicious
45/62

malicious
20/36

malicious
26/27

malicious

IPs

IP Country Detection
97.120.3.198
United States
35.208.182.43
United States
70.180.33.202
United States
Click to see the 3 hidden entries
50.116.111.59
United States
173.249.20.233
Germany
194.209.195.106
Switzerland

Domains

Name IP Detection
isatechnology.com
35.208.182.43
www.isatechnology.com
0.0.0.0
physio-svdh.ch
194.209.195.106

URLs

Name Detection
http://isatechnology.com
https://www.isatechnology.com/training/b/
http://transfersuvan.com/wp-admin/OVl/
Click to see the 97 hidden entries
http://arquivopop.com.br/index_htm_files/Kxh/
https://cairocad.com/cgi-bin/1PBB/
https://www.isatechnology.comArAC
http://ownitconsignment.com/files/b/
https://shell.suite.office.com:1443
https://autodiscover-s.outlook.com/
https://corp.roblox.com/contact/
https://physio-svdh.ch/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.3
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
https://physio-svdh.ch/angebot/physiotherapie/
https://cdn.entity.
https://physio-svdh.ch/wp-content/themes/econature/gutenberg/css/frontend-style.css?ver=1.0.0
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
https://rpsticket.partnerservices.getmicrosoftkey.com
https://lookup.onenote.com/lookup/geolocation/v1
https://physio-svdh.ch/wp-content/themes/econature/js/jquer0
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
https://api.aadrm.com/
https://physio-svdh.ch/angebot/hausbesuche/
https://physio-svdh.ch/wp-content/themes/econature/js/scrollspy.js?ver=1.0.0
http://cps.root-x1.letsencrypt.
https://use.fontawesome.com/releases/v5.8.2/css/all.css?ver=5.5.3
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
https://api.microsoftstream.com/api/
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
https://cr.office.com
https://nuget.org/nuget.exe
https://physio-svdh.ch/kontakt/
https://physio-svdh.ch/wp-content/themes/econature/css/animate.css?ver=1.0.0
https://physio-svdh.ch/wp-includes/js/wp-embed.min.js?ver=5.5.3
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://res.getmicrosoftkey.com/api/redemptionevents
https://tasks.office.com
https://officeci.azurewebsites.net/api/
https://www.hulu.com/do-not-sell-my-info
https://store.office.cn/addinstemplate
http://pesterbdd.com/images/Pester.png
http://cps.letsencrypt.org0
https://wus2-000.pagecontentsync.
http://www.apache.org/licenses/LICENSE-2.0.html
https://physio-svdh.ch/wp-content/plugins/buttonizer-multifunctional-button/assets/frontend.css?v=7c
https://www.roblox.com/develop
https://contoso.com/Icon
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://physio-svdh.ch/
https://www.odwebp.svc.ms
https://api.powerbi.com/v1.0/myorg/groups
https://web.microsoftstream.com/video/
https://corp.roblox.com/parents/
https://graph.windows.net
https://physio-svdh.ch/wp-content/themes/econature/css/fontello.css?ver=1.0.0
https://github.com/Pester/Pester
https://physio-svdh.ch/wp-content/themes/econature/css/retina.css?ver=1.0.0
https://physio-svdh.ch/wp-content/uploads/cmsms_styles/econature.css?ver=1.0.0
http://gmpg.org/xfn/11
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
https://physio-svdh.ch
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
http://weather.service.msn.com/data.aspx
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
https://physio-svdh.ch/ueber-uns/about-us/
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
https://clients.config.office.net/user/v1.0/ios
https://o365auditrealtimeingestion.manage.office.com
https://outlook.office365.com/api/v1.0/me/Activities
https://physio-svdh.ch/wp-content/themes/econature/css/ie.css?ver=1.0.0
https://clients.config.office.net/user/v1.0/android/policies
https://physio-svdh.ch/offene-stellen/
https://physio-svdh.ch/angebot/training-fuer-senioren/
https://entitlement.diagnostics.office.com
https://physio-svdh.ch/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
https://outlook.office.com/
https://physio-svdh.ch/angebot/med-trainingstherapie-mtt/
https://physio-svdh.ch/wp-includes/wlwmanifest.xml
https://storage.live.com/clientlogs/uploadlocation
https://www.hulu.com/ca-privacy-rights
http://www.g5e.com/G5_End_User_License_Supplemental_Terms
https://physio-svdh.ch/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.kreaturamedi
https://physio-svdh.ch/xmlrpc.php
https://graph.windows.net/
https://devnull.onenote.com
https://physio-svdh.ch/wp-content/plugins/LayerSlider/static/layerslider/js/greensock.js?ver=1.19.0
https://messaging.office.com/
https://physio-svdh.ch/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?
https://physio-svdh.ch/wp-content/themes/econature/css/style.css?ver=1.0.0
https://physio-svdh.ch/comments/feed/
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
https://skyapi.live.net/Activity/
https://physio-svdh.ch/wp-content/plugins/buttonizer-multifunctional-button/assets/frontend.min.js?v
https://api.cortana.ai
https://physio-svdh.ch/wp-content/themes/econature/css/ilightbox-skins/dark-skin.css?ver=2.2.0
https://visio.uservoice.com/forums/368202-visio-on-devices
https://staging.cortana.ai
https://onedrive.live.com/embed?
https://augloop.office.com

Dropped files

Name File Type Hashes Detection
C:\Users\user\F2nefq6\Prs2ndh\Chpieog.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DC97C0E2-E492-4CE8-9253-DB063F2B7EA0
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{179EC3B7-37E0-4560-80F5-16F3BFE059F5}.tmp
data
#
Click to see the 11 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{87200191-4D4F-4DCD-B181-904D5E386871}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbmhr0zq.ixu.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zyrecgys.4kk.ps1
very short file (no magic)
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\v22Pc0qA.doc.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:53 2020, mtime=Mon Feb 1 21:25:06 2021, atime=Mon Feb 1 21:25:03 2021, length=207253, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Little-endian UTF-16 Unicode text, with CR line terminators
#
C:\Users\user\Desktop\~$2Pc0qA.doc.doc
data
#
C:\Users\user\Documents\20210201\PowerShell_transcript.724536.D_cV0UCD.20210201232511.txt
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
#