8de655e6...32b8

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Dropper, Downloader

8de655e68ab3408b1101cd0e5f4c3dbe1a361cbb2a5ee10888f5ad30b95332b8 (SHA256)

cm_coupon_6185.doc

Word Document

Created at 2018-11-26 15:52:00

Notifications (1/1)

The operating system was rebooted during the analysis.

Indicators

File (27)

Filename	Hash	Operations	Source
C:\	-	Access
C:\Users	-	Access
C:\Users\aETAdzjz	-	Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\cofiretlnt.exe	MD5: 31342e4b67aaa69e9a8a6bd6604dc668 SHA1: d4159ed9b7f143d9c686a51b16960d33565bec4a SHA256: 5f1032665271c1fdf50e36a10afca8f2413e297b73d5114a2ed3d0022008c649 SSDeep: 3072:rX/2i7MRvfSlSu+oV1D2y+Gsi1iOH++jj3fVQhxbfNWb8uTmTZ98+qZMKQTvIhEX:yi7MRvfSlSu+oV1D2y+GskiOH++j4xb3 ImpHash: d98de4a30bf76dd8592ade1c467f9292	Access	Created File
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\cofiretlnt.exe:Zone.Identifier	-	Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe	-	Access
C:\Users\aETAdzjz\AppData\Local\Temp\\bGD.exe	-	Access, Write
C:\Users\aETAdzjz\AppData\Local\Temp\bGD.exe	MD5: 31342e4b67aaa69e9a8a6bd6604dc668 SHA1: d4159ed9b7f143d9c686a51b16960d33565bec4a SHA256: 5f1032665271c1fdf50e36a10afca8f2413e297b73d5114a2ed3d0022008c649 SSDeep: 3072:rX/2i7MRvfSlSu+oV1D2y+Gsi1iOH++jj3fVQhxbfNWb8uTmTZ98+qZMKQTvIhEX:yi7MRvfSlSu+oV1D2y+GskiOH++j4xb3 ImpHash: d98de4a30bf76dd8592ade1c467f9292	Access	Created File
C:\Users\aETAdzjz\Desktop	-	Access
C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1	-	Access
C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1	-	Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml	-	Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	-	Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	-	Access, Read

Registry (78)

Registry Key Name	Operations
HKEY_CLASSES_ROOT\Licenses	Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7	Read
HKEY_CLASSES_ROOT\TypeLib	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64	Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}	Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7	Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64	Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409	Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64	Access, Read
HKEY_CURRENT_USER\Environment	Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor	Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common	Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability	Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\PipelineMaxStackSizeMB	Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\ApplicationBase	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\path	Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH	Read
HKEY_PERFORMANCE_DATA	Access
System	Access
System\PowerShell	Access
Windows PowerShell	Access
Windows PowerShell\PowerShell	Access

Mutex (6)

Mutex Name	Operations
Global\I705BA84C	Access, Delete
Global\M705BA84C	Access
PEM3A0	Access
PEM4D0	Access
PEM89C	Access
PEMABC	Access

Domain (2)

Domain	Sources
greatvacationgiveaways.com	PCAP, Function Log
75.161.71.124:990	Function Log, PCAP

URL (6)

URL	Operations	Sources
http://greatvacationgiveaways.com/i0Qwfwrn	GET	Function Log
http://greatvacationgiveaways.com/i0Qwfwrn/	GET	PCAP
HTTP://79.129.42.122	GET	Function Log
HTTP://50.74.56.147	GET	Function Log
HTTP://75.161.71.124	GET	Function Log
http://75.161.71.124:990/	GET	PCAP

IP (4)

IP	Protocols	Sources
199.241.186.126	HTTP, TCP, UDP	Function Log, PCAP
79.129.42.122	TCP	Function Log, PCAP
50.74.56.147	TCP	Function Log, PCAP
75.161.71.124	TCP	Function Log, PCAP

Export IOCs

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (1/1)

Indicators

Before

After