File name: | Запит клієнта.doc |
Full analysis: | https://app.any.run/tasks/7f0f28da-1b8f-446c-80e3-7758343e9ef0 |
Verdict: | Malicious activity |
Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
Analysis date: | July 17, 2019, 08:40:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 2E352DD74AE1F771B2B6501BEE5752AB |
SHA1: | 8AE034C4AF737D743FC83D3E7311AF2592776A06 |
SHA256: | 40FB06033E15298A38C15580DAA88F81AEB83739DA0E2763F0358B0162D746E9 |
SSDEEP: | 768:OvyXCdJWz7zpgegbFzBLob2GR/yapptJdRH4v:cm7gJe/BrH74v |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 24689 |
---|---|
CharactersWithSpaces: | 4 |
Characters: | 4 |
Words: | - |
Pages: | 1 |
TotalEditTime: | 1 minute |
RevisionNumber: | 2 |
ModifyDate: | 2019:06:20 00:52:00 |
CreateDate: | 2019:06:20 00:52:00 |
LastModifiedBy: | Windows User |
Author: | C |
Title: | Not |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2812 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Запит клієнта.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2404 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3136 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | EQNEDT32.EXE | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
4004 | C:\Users\admin\AppData\Roaming\4017388.exe | C:\Users\admin\AppData\Roaming\4017388.exe | — | EQNEDT32.EXE |
User: admin Company: http://zenden.ws Integrity Level: MEDIUM Description: To Slur Icn Exit code: 0 Version: 197.572.224.492 | ||||
3860 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | 4017388.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3984 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 4017388.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
780 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 4017388.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
2504 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 4017388.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
1916 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 4017388.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
1692 | "C:\Users\admin\AppData\Local\Temp\tmp3798.tmp.exe" | C:\Users\admin\AppData\Local\Temp\tmp3798.tmp.exe | RegAsm.exe | |
User: admin Integrity Level: MEDIUM Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2812 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDB10.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Cab9CD9.tmp | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Tar9CDA.tmp | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Cab9CEB.tmp | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Tar9CEC.tmp | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Cab9DE7.tmp | — | |
MD5:— | SHA256:— | |||
1692 | tmp3798.tmp.exe | C:\Users\admin\AppData\Local\Temp\Tar9DE8.tmp | — | |
MD5:— | SHA256:— | |||
3860 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmp3798.tmp.exe | executable | |
MD5:BB0B6DBF1E4EB5207D94C651124ABD75 | SHA256:E0DF4FA50A9424088BBD958DD7653F7B5B2E4B5BE398AC656BE53754143DD76D | |||
2812 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\wd32PrvSE.wmf | binary | |
MD5:274FBE7423A2650BC5432767F3869EE5 | SHA256:BFF30FCC9A9A78F2D1F45B238DF628B82E4FB1E9A8DD4E062BE6BF77A978F082 | |||
3136 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\zaha[1].exe | executable | |
MD5:6A3939CE898CDA8339C14FDF0BF65667 | SHA256:305C1C7D2B2DCAE6624EDE564F764058B15E972EFF012518A537FC9FF7AEDDEF |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1692 | tmp3798.tmp.exe | GET | 200 | 8.248.131.254:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 56.3 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3136 | EQNEDT32.EXE | 104.27.143.252:443 | m.put.re | Cloudflare Inc | US | shared |
3860 | RegAsm.exe | 104.20.208.21:443 | pastebin.com | Cloudflare Inc | US | shared |
3860 | RegAsm.exe | 185.247.228.69:1990 | eg-east.com | — | — | malicious |
1692 | tmp3798.tmp.exe | 185.247.228.69:5505 | eg-east.com | — | — | malicious |
1692 | tmp3798.tmp.exe | 8.248.131.254:80 | www.download.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
m.put.re |
| suspicious |
pastebin.com |
| shared |
eg-east.com |
| malicious |
www.download.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3860 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT/Bladabindi (Lime-RAT) |