File name: | 40e928.doc |
Full analysis: | https://app.any.run/tasks/868ae20c-c862-479f-b6b7-9fc166bf74f3 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 18:42:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 987CDA2D7593CB61F1432D7955EB2CFD |
SHA1: | 54191C5052111BD7A8CFA06F4333C4DD99EEB366 |
SHA256: | 40E9287FF8828FB0E6BAEDCFF873E8E35520C6227200F1C84B63446F07A59289 |
SSDEEP: | 6144:fN987IjqHeVXPsrP5DLkQnAgfZZPHymnLogyM4fO:Q7IlZobnAgfW5m |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3340 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\40e928.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
4016 | C:\Users\admin\AppData\Local\Temp\winlogon.exe | C:\Users\admin\AppData\Local\Temp\winlogon.exe | — | WINWORD.EXE |
User: admin Company: Defender Inc Integrity Level: MEDIUM Description: Microsoft Defander Exit code: 0 Version: 6.6.5.1 | ||||
3104 | cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\12.0\Word\Resiliency" /F | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3172 | cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\14.0\Word\Resiliency" /F | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3288 | cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\15.0\Word\Resiliency" /F | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3500 | cmd.exe /c dir %windir% && "C:\Users\admin\Desktop\40e928.doc.rtf" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3848 | reg delete "HKCU\Software\Microsoft\Office\12.0\Word\Resiliency" /F | C:\Windows\system32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3972 | reg delete "HKCU\Software\Microsoft\Office\14.0\Word\Resiliency" /F | C:\Windows\system32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2136 | reg delete "HKCU\Software\Microsoft\Office\15.0\Word\Resiliency" /F | C:\Windows\system32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2868 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\40e928.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9E19.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\msoA8EE.tmp | — | |
MD5:— | SHA256:— | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E6DD57E5.jpeg | — | |
MD5:— | SHA256:— | |||
2868 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRB088.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RO0000.doc | pgc | |
MD5:F85E6D404B9835A015B5E14E12D2325F | SHA256:EC3ABBBD8730ACD1B67A0228EF761047C0F77387C4D69E18BAD2F322B653661C | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:70C278D8BB09C3041479A9BC2AF4E1A9 | SHA256:D69E23B5D0FBBBEA2B15D68BAE73B8D21CB5A54E7F9352E099020E7F51DABA60 | |||
3340 | WINWORD.EXE | C:\Users\admin\Desktop\40e928.doc.rtf | document | |
MD5:2D9064943A93D1129A313D7D801448C4 | SHA256:642D4794890683701D521899EA51E6A3CD698D45292591B3E064BAE13683256A | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DE0B0274.emf | emf | |
MD5:9C539DA99A279ECAF0D3867A2BA645FB | SHA256:452C55912BFE110782BA6CB47A4FEEC3A30E22F277F6B573A01F569CD3BF9E60 | |||
3340 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{7D6C5307-2974-44DC-A420-C4C6CCADD0F6}.tmp | binary | |
MD5:0B0DAF408606997DA890E38146FA586D | SHA256:98AF4804802FD446A235EA888CDFEEF4BDBF6FE71E82A19D0FB3D76A9399B115 | |||
3340 | WINWORD.EXE | C:\Users\admin\Desktop\~$e928.doc.rtf | pgc | |
MD5:E950FA12F6179CFDC8650F093BA35BF1 | SHA256:AAA3CE4EA0C1BF16F9296111C8C3613CE43661AD33EE303DAADFE022ED26EEE2 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3596 | defender.exe | 45.32.232.70:6669 | — | Choopa, LLC | NL | unknown |