File name: | sample2 (1).zip |
Full analysis: | https://app.any.run/tasks/75b45588-64ae-47b2-ac98-7302a4c90ca5 |
Verdict: | Malicious activity |
Analysis date: | May 24, 2019, 06:59:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 5F9528D0C9B23469E11C53FB23B1DC2C |
SHA1: | 6C2CFC368B5FE8B8BC7360DE2AE1D2A59DBD6635 |
SHA256: | 3EE06373A9379930A4C76E6E0DCDC4A53BB71B79272C252CD5478A9A3DD4F95F |
SSDEEP: | 6144:RR0nDBq9NL9hIiC0n9WIrwtjwnj48M1aICiBdC:RR0ONLfC09pUto48AaYBdC |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | sample2.doc |
---|---|
ZipUncompressedSize: | 317952 |
ZipCompressedSize: | 256372 |
ZipCRC: | 0xe4b58566 |
ZipModifyDate: | 2019:05:24 11:03:24 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2820 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample2 (1).zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3128 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2820.17822\sample2.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3688 | C:\Windows\system32\cmd.exe /c echo Set oShell = WScript.CreateObject ("WScript.Shell") : oShell.run "cmd.exe /c Powershell -exec bypass -Windowstyle hidden -File C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.ps1 ",0,0 > "C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.vbs" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3756 | C:\Windows\system32\cmd.exe /c SchTasks /Create /SC MINUTE /MO 1 /TN "Conhost" /TR "wscript C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.vbs" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2744 | SchTasks /Create /SC MINUTE /MO 1 /TN "Conhost" /TR "wscript C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.vbs" | C:\Windows\system32\schtasks.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3480 | C:\Windows\system32\wscript.EXE C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.vbs | C:\Windows\system32\wscript.EXE | — | taskeng.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2592 | "C:\Windows\System32\cmd.exe" /c Powershell -exec bypass -Windowstyle hidden -File C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.ps1 | C:\Windows\System32\cmd.exe | — | wscript.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3292 | Powershell -exec bypass -Windowstyle hidden -File C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4052 | "C:\Windows\system32\cmd.exe" /c start /b schtasks /delete /tn Conhost /f | C:\Windows\system32\cmd.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2304 | schtasks /delete /tn Conhost /f | C:\Windows\system32\schtasks.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3128 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2034.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3292 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1BF5D6YL2GXIOGK7V5S9.temp | — | |
MD5:— | SHA256:— | |||
3128 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb2820.17822\~$ample2.doc | pgc | |
MD5:54E49AA66A68A2B7B7C43718C2F3EF82 | SHA256:9A15513F4DDCBB32B1F0052C1F258B50AD537BD3ADE30B10A0FB822F97B21768 | |||
3292 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3292 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF155f5f.TMP | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3128 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:FA6762733E452CC11D05168FAFA95EA9 | SHA256:7FA689318C8A7337637D560F763BE5727C34FC7BB5EF8560F074386722CC8F3E | |||
3292 | powershell.exe | C:\Users\admin\AppData\Local\Temp\AdobeAcrobatLicenseVerify.vbs | text | |
MD5:05609DE5C12BF51D325C0CC5E438CFC8 | SHA256:C2A7EA6D1EBB5822D07CF27F6DA4DEF3DF6968F50B4777321724903E527129A2 | |||
2820 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2820.17822\sample2.doc | document | |
MD5:486BDF835A453C6FFB5F56647E697871 | SHA256:1F6369B42A76D02F32558912B57EDE4F5FF0A90B18D3B96A4FE24120FA2C300C | |||
3688 | cmd.exe | C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.vbs | text | |
MD5:BA2B36EC76F13B0B6CC3B263EF9D3026 | SHA256:B7DFDBC89FABF327F9A6AAEB233030B04A7AF202CC72559BD9BEE39A98ADFD4C | |||
3128 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\AdobeAcrobatLicenseVerify.ps1 | text | |
MD5:93B79FEA62A774DD781E3278CDDAE898 | SHA256:322C502CBE74FA99FA1F162CC6AC6CE1D9594945E68584DC326D39298589B328 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3292 | powershell.exe | GET | 200 | 204.11.56.48:80 | http://www.acrobatverify.com/ | VG | html | 738 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3292 | powershell.exe | 204.11.56.48:443 | www.acrobatverify.com | Confluence Networks Inc | VG | malicious |
3292 | powershell.exe | 204.11.56.48:80 | www.acrobatverify.com | Confluence Networks Inc | VG | malicious |
Domain | IP | Reputation |
---|---|---|
www.acrobatverify.com |
| malicious |