File name: | Material requirements.doc |
Full analysis: | https://app.any.run/tasks/679fdc3b-1624-453a-9ba2-98bf7e1d3cdd |
Verdict: | Malicious activity |
Threats: | Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America. |
Analysis date: | January 23, 2019, 09:18:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | F7D99A92E0440C4EC673AC028D436D84 |
SHA1: | 1ADE37F59FE018EA9DB8233517C0F87D1D2832A5 |
SHA256: | 3C54A69ECEFECD778431E43913BF4A60095CDC90C17AD17F489ECF70159C5515 |
SSDEEP: | 12288:ia83pREnhd0rN4XZJ7cOkwV3zhRwTDm2+SS9DTdkmxoWq6Zb966OQfgr:ia8Ad0R4JK+xvndkWnJcR |
.rtf | | | Rich Text Format (100) |
---|
Author: | wuyan |
---|---|
LastModifiedBy: | wuyan |
CreateDate: | 2019:01:03 16:14:00 |
ModifyDate: | 2019:01:03 16:34:00 |
RevisionNumber: | 3 |
TotalEditTime: | 1 minute |
Pages: | 1 |
Words: | 4 |
Characters: | 24 |
CharactersWithSpaces: | 27 |
InternalVersionNumber: | 57435 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3028 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Material requirements.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
4072 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2784 | cmd /c %tmp%\A.R | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3236 | C:\Users\admin\AppData\Local\Temp\A.R | C:\Users\admin\AppData\Local\Temp\A.R | cmd.exe | |
User: admin Company: Facebook Integrity Level: MEDIUM Description: Metadata Userdel Asp Exit code: 0 Version: 6.4.6.537 | ||||
3096 | cmd /c ""C:\Users\admin\AppData\Local\Temp\2189359.bat" "C:\Users\admin\AppData\Local\Temp\A.R" " | C:\Windows\system32\cmd.exe | — | A.R |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1320 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRECF4.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{548E5AC4-6698-426E-8A2D-62BB7CADBB17}.tmp | — | |
MD5:— | SHA256:— | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{822D647E-E416-4006-992F-C560E9589ABF}.tmp | — | |
MD5:— | SHA256:— | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$terial requirements.doc | pgc | |
MD5:714B22787F0CFDD829A40F32C5472774 | SHA256:B7515E26192062C82BC6176CF45745D6B4CB8013AF0331B1FDCAB75A4B591B2D | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:D8FD8B8FAC0DBDE7F68D50F5FC3BAA32 | SHA256:4B94FC7B43771EB8BEA914AFF6A56E0164499257C8CC334774EC155AAD143E4A | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3FF639A6-C22C-4E9B-B5CF-2F235241CC7D}.tmp | binary | |
MD5:A041497025967A889B93DC9C44ABCCE0 | SHA256:D2BE6A7015360524E18A2E14E241AED603EFB21B3E2D6264DE059321321C6C6C | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FE95D2B3.emf | emf | |
MD5:F7961E44FE51CEEE06391905162E18E0 | SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\A.R | executable | |
MD5:F34BC3136D990C18148205BA3488B025 | SHA256:A35B175A20A9A7F17A169FFFF3DFF0376CE3C6FED3E5BB7659C37C2DB9617771 | |||
3236 | A.R | C:\Users\admin\AppData\Local\Temp\2189359.bat | text | |
MD5:3880EEB1C736D853EB13B44898B718AB | SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3236 | A.R | GET | — | 5.154.178.12:80 | http://sobeteracotafancris.ro/eng/shit.exe | RO | — | — | malicious |
3236 | A.R | POST | 200 | 5.154.178.12:80 | http://sobeteracotafancris.ro/eng/gate.php | RO | binary | 20 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3236 | A.R | 5.154.178.12:80 | sobeteracotafancris.ro | Space Ro Srl | RO | malicious |
Domain | IP | Reputation |
---|---|---|
sobeteracotafancris.ro |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3236 | A.R | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 2 |
3236 | A.R | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |
3236 | A.R | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. |
3236 | A.R | A Network Trojan was detected | ET TROJAN Trojan Generic - POST To gate.php with no referer |
3236 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Pony encrypted POST Data Request |
3236 | A.R | A Network Trojan was detected | ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98 |
3236 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Fareit/Pony Downloader Checkin |
3236 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Pony encrypted C2 Response |
3236 | A.R | A Network Trojan was detected | MALWARE [PTsecurity] Fareit/Pony CnC Server stdResponse |
3236 | A.R | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 3 |