File name: | [email protected] |
Full analysis: | https://app.any.run/tasks/6c2f305f-15d4-45cf-a0ab-bb5cfd086669 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 13:04:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | AD46B142361DE3EA610411962A8F04BB |
SHA1: | 22361C4251F8A8AD6A9D1B07E666D9BD81B9352C |
SHA256: | 0770D84CBC6CF82D9C04C6722C15688CD96A61C511DB35FC3401877A173DD776 |
SSDEEP: | 1536:ks5+iAcWQBfaBdblNyPLOTWuNEzZ5lOuPYbf9Ue88x30Y:QiqESBtlN8LI9215lOoYT9ozY |
.zip | | | ZIP compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1296 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\[email protected]" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2156 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIb1296.1614\Re Прыкласці доказ плацяжу.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3764 | "C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/644441640345403413/652043766257156096/TT_SWIFT_COPY_pdf_____________________________________________________________.r00 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2196 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3764 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
332 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\TT_SWIFT_COPY_pdf_____________________________________________________________.r00" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1756 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa332.6025\TT SWIFT COPY_pdf_____________________________________________________________.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa332.6025\TT SWIFT COPY_pdf_____________________________________________________________.exe | WinRAR.exe | |
User: admin Company: Atilla Best! Integrity Level: MEDIUM Description: Exit code: 1 Version: 1.1.1.1 | ||||
4024 | "C:\Users\admin\Desktop\TT SWIFT COPY_pdf_____________________________________________________________.exe" | C:\Users\admin\Desktop\TT SWIFT COPY_pdf_____________________________________________________________.exe | — | explorer.exe |
User: admin Company: Atilla Best! Integrity Level: MEDIUM Description: Exit code: 1 Version: 1.1.1.1 | ||||
2488 | "C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | TT SWIFT COPY_pdf_____________________________________________________________.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.7.3062.0 built by: NET472REL1 | ||||
2344 | "C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | TT SWIFT COPY_pdf_____________________________________________________________.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.7.3062.0 built by: NET472REL1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2156 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR25EC.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3764 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1296 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb1296.1614\Re Прыкласці доказ плацяжу.msg | msg | |
MD5:20A48FBC53E7137B651049B8FEEEB502 | SHA256:5AF27560C23A77F2381EA4F93E122BC910B473B5C6C2DE54BE97B81D38E4A915 | |||
3764 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2156 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:C40EE7095B0A4FC11B92DA08F341506A | SHA256:CA2F9D17D15B15350EC32F69CEC19FA6A284CA584E193D18ED0A2356CCEB2AE4 | |||
2196 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:D129333C4370BF1A0A5BF12B06090E5A | SHA256:AC5A65E92F73D4290FD8173F2EF95AB69BF96988A05EA73AF6DEC6F6050BD6F4 | |||
2156 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:67FF2AB08BDE86A782F6DA27168B2489 | SHA256:DDDF885438EBE827584363FB4F53AE19C8832F7467B932CFEC04C2D65BFCF65E | |||
3764 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFDD6B159CA12FDF36.TMP | — | |
MD5:— | SHA256:— | |||
2156 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FAD8CB37.dat | image | |
MD5:CE8E323C163241A771B2545CA044ECA4 | SHA256:E764A23706DC59F186D64D1978F84EA6DDBAD532CE19F3CB8821B4DFD0547729 | |||
2156 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2156 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2488 | InstallUtil.exe | GET | 200 | 216.146.43.70:80 | http://checkip.dyndns.org/ | US | html | 107 b | shared |
2344 | InstallUtil.exe | GET | 200 | 216.146.43.70:80 | http://checkip.dyndns.org/ | US | html | 107 b | shared |
3764 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3764 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2156 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2196 | iexplore.exe | 162.159.130.233:443 | cdn.discordapp.com | Cloudflare Inc | — | shared |
2488 | InstallUtil.exe | 216.146.43.70:80 | checkip.dyndns.org | Dynamic Network Services, Inc. | US | shared |
2344 | InstallUtil.exe | 199.193.7.228:587 | smtp.privateemail.com | Namecheap, Inc. | US | unknown |
2488 | InstallUtil.exe | 199.193.7.228:587 | smtp.privateemail.com | Namecheap, Inc. | US | unknown |
2344 | InstallUtil.exe | 216.146.43.70:80 | checkip.dyndns.org | Dynamic Network Services, Inc. | US | shared |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
cdn.discordapp.com |
| shared |
www.bing.com |
| whitelisted |
checkip.dyndns.org |
| shared |
smtp.privateemail.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.dyndns. Domain |
— | — | Misc activity | AV INFO Query to checkip.dyndns. Domain |
2488 | InstallUtil.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup - checkip.dyndns.org |
2488 | InstallUtil.exe | Potentially Bad Traffic | ET POLICY DynDNS CheckIp External IP Address Server Response |
2488 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
2344 | InstallUtil.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup - checkip.dyndns.org |
2344 | InstallUtil.exe | Potentially Bad Traffic | ET POLICY DynDNS CheckIp External IP Address Server Response |
2344 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |