File name: | Application bomber.bat |
Full analysis: | https://app.any.run/tasks/ea663afc-e4b4-423a-827e-58b7e36bd390 |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 01:08:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/x-msdos-batch |
File info: | DOS batch file, ASCII text, with CRLF line terminators |
MD5: | 262DF7604ED5DBB13CA653B07C3CD3B0 |
SHA1: | 032238A9F4444C27D74DB76F90591F74FF637FC4 |
SHA256: | 2EFB0CA1D80F8DF7D2369E2DC89F59D8576653136408A6BE24585A919BD1E860 |
SSDEEP: | 3:mKDDc1lRJM1wDzaz2jizkMmoORKfe7zYEXCREzdLlORKTIoBRCn:hel/MsOCjiRmFc2PSRExL1VBUn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3836 | cmd /c ""C:\Users\admin\AppData\Local\Temp\Application bomber.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3932 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3084 | mspaint | C:\Windows\system32\mspaint.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Paint Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3876 | notepad | C:\Windows\system32\notepad.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3752 | write | C:\Windows\system32\write.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Write Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2800 | cmd | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2700 | explorer | C:\Windows\explorer.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2856 | control | C:\Windows\system32\control.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Control Panel Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
612 | calc | C:\Windows\system32\calc.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1524 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA885.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1524 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRAC3E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRB0E2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
4048 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRB6CD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2380 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRBD75.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRC4C8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRCCB7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD458.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3784 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDBAB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3112 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE35C.tmp.cvr | — | |
MD5:— | SHA256:— |