6dd9d1ae...a9d7 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Dropper, Downloader

6dd9d1ae591aa1c238d27b7d29b4d16775e02350637efc7659a7de6b062aa9d7 (SHA256)

Documento.doc

Word Document

Created at 2018-11-24 01:38:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Indicators

File (16)
»
Filename Hash Operations Source
C:\ - Access
C:\Users\ - Access
C:\Users\aETAdzjz\ - Access
C:\Users\aETAdzjz\AppData\ - Access
C:\Users\aETAdzjz\AppData\Local\ - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\ - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\ - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\cofiretlnt.exe MD5: 912807d798d35323a534fdb59399a9b0
SHA1: 2060d9f147311fdeec4de5f5d940b7a6f849846d
SHA256: 78ccba1d9e5d32658ce4cd4b2f8a8be65c6aa6a4f4eec2016777afb3a50ac843
SSDeep: 3072:ePsv/P6gmhkFDDQKSZ4k5AF6xIsawMlkgu866:S9QD+zyF6xIsaFXP
ImpHash: 83eb829a030547eb063d860f40f8e0c6 		Access Created File
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\cofiretlnt.exe:Zone.Identifier - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\TXCuQB4avHqPTPy.exe - Access
C:\Users\aETAdzjz\AppData\Local\Temp\\jtA.exe - Access, Write
C:\Users\aETAdzjz\AppData\Local\Temp\jtA.exe MD5: 912807d798d35323a534fdb59399a9b0
SHA1: 2060d9f147311fdeec4de5f5d940b7a6f849846d
SHA256: 78ccba1d9e5d32658ce4cd4b2f8a8be65c6aa6a4f4eec2016777afb3a50ac843
SSDeep: 3072:ePsv/P6gmhkFDDQKSZ4k5AF6xIsawMlkgu866:S9QD+zyF6xIsaFXP
ImpHash: 83eb829a030547eb063d860f40f8e0c6 		Access Created File
C:\Users\aETAdzjz\Desktop - Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config - Access
Registry (51)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_PERFORMANCE_DATA Access
Mutex (4)
»
Mutex Name Operations
Global\I705BA84C Access, Delete
Global\M705BA84C Access
PEMB08 Access
PEMBC8 Access
Domain (2)
»
Domain Sources
lifewithdogmovie.com PCAP, Function Log
47.32.209.86 Function Log, PCAP
URL (6)
»
URL Operations Sources
http://lifewithdogmovie.com/0K3jRwA GET Function Log
http://lifewithdogmovie.com/0K3jRwA/ GET PCAP
HTTP://72.48.172.106 GET Function Log
HTTP://201.120.89.60 GET Function Log
HTTP://47.32.209.86 GET Function Log
http://47.32.209.86/ GET PCAP
IP (5)
»
IP Protocols Sources
67.212.232.33 HTTP, TCP, UDP Function Log, PCAP
72.48.172.106 HTTP, TCP Function Log, PCAP
201.120.89.60 TCP Function Log, PCAP
47.32.209.86 HTTP, TCP Function Log, PCAP
13.107.5.88 TCP PCAP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image