File name: | ICONIX.zip |
Full analysis: | https://app.any.run/tasks/2021fd1e-9e54-4b8c-96d8-5730aade3b7d |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 13:43:19 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | D57439707C77FA49A7FE4CA32BF478E8 |
SHA1: | EE53A48F4C376FFF0935FA582E071D9972112A3C |
SHA256: | 6869BF7AF0214A488EDD62A0D1D92D0890639F9E714B7F681BD6162824E4A03C |
SSDEEP: | 3072:GhbQa3ALIB4qIHYRGjxJ4zsxnDPOCu11tz55GmXA27IMn1PB:GIEBIYIxd4t15GmA27IMnpB |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Deflated |
ZipModifyDate: | 2020:10:20 02:39:27 |
ZipCRC: | 0x04834e92 |
ZipCompressedSize: | 141661 |
ZipUncompressedSize: | 147972 |
ZipFileName: | tell 010.20.doc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3072 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ICONIX.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3536 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3072.29745\tell 010.20.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2348 | regsvr32 c:\users\public\HlGKL.txt | C:\Windows\system32\regsvr32.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4028 | regsvr32 c:\users\public\HlGKL.txt | C:\Windows\system32\regsvr32.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR58AF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\config14[1].xml | — | |
MD5:— | SHA256:— | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Cab807D.tmp | — | |
MD5:— | SHA256:— | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Tar807E.tmp | — | |
MD5:— | SHA256:— | |||
3536 | WINWORD.EXE | C:\users\public\HlGKL.txt | html | |
MD5:3F63AB090937AD2C74E0BC6E53B56C1D | SHA256:2F67424D25D59035821D0BAD13B2A237904F1C826632123542046A71F8DE4EE2 | |||
3072 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3072.29745\tell 010.20.doc | document | |
MD5:57A883455E729BC16BAD63F75E633B78 | SHA256:BA83B48A660695BAF0724965A7ED516CDF29C99FA417D787B11835B75556C5F0 | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\ONetConfig\b6419f5bc3093b5f22142ce454e02407.sig | binary | |
MD5:6212A5A8EA46E74C0A4561E24927FF02 | SHA256:BD4B2AF01071BF348D862C4B7F6DAD7D8665E29F9E5B579BB6DB0A3DE724EFE3 | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F | der | |
MD5:B62D0A9064DADEA95C251DEB7D68AC20 | SHA256:DD3C7415CF4D75FE083DD4F2D9A2250409BB9F09033F8B2BA6BEB2CD13971918 | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb3072.29745\~$ll 010.20.doc | pgc | |
MD5:1D5AEF5BEEB1820AA4075B2DBE083D4E | SHA256:579973EAE34F8D33398DE7B778888E2368CE85800CB5D9565627F2B926308D4E | |||
3536 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\ONetConfig\b6419f5bc3093b5f22142ce454e02407.xml | xml | |
MD5:D2DB602365C5FEDCE3CF614B4F69C333 | SHA256:96D974C0B3B70BF9245A3C61AB17E31C90B216F84A38D1D535E74ED8CDC3DFE1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3536 | WINWORD.EXE | GET | 200 | 52.109.76.6:80 | http://office14client.microsoft.com/config14?UILCID=1033&CLCID=1033&ILCID=1033&HelpLCID=1033&App={019C826E-445A-4649-A5B0-0BF08FCC4EEE}&build=14.0.6023 | IE | xml | 1.99 Kb | whitelisted |
3536 | WINWORD.EXE | GET | 200 | 178.250.157.193:80 | http://gm9rlei16lamz5.com/_bxlzcpjlmpxlkzblf_zhlsplspz/wtlmwrqnnxfwgzzlkvzdbvnp_mphdqpggxfljvffj_.php?l=chfon13.ppt&lhe=_qzqsogkctxarvtnqdpt | RU | html | 208 b | unknown |
3536 | WINWORD.EXE | GET | 200 | 178.250.157.193:80 | http://gm9rlei16lamz5.com/_bxlzcpjlmpxlkzblf_zhlsplspz/wtlmwrqnnxfwgzzlkvzdbvnp_mphdqpggxfljvffj_.php?l=chfon13.ppt&lhe=_qzqsogkctxarvtnqdpt | RU | html | 208 b | unknown |
3536 | WINWORD.EXE | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3536 | WINWORD.EXE | 178.250.157.193:80 | gm9rlei16lamz5.com | — | RU | unknown |
3536 | WINWORD.EXE | 52.109.76.6:80 | office14client.microsoft.com | Microsoft Corporation | IE | whitelisted |
— | — | 178.250.157.193:80 | gm9rlei16lamz5.com | — | RU | unknown |
3536 | WINWORD.EXE | 52.109.120.29:443 | rr.office.microsoft.com | Microsoft Corporation | HK | whitelisted |
3536 | WINWORD.EXE | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
gm9rlei16lamz5.com |
| unknown |
office14client.microsoft.com |
| whitelisted |
rr.office.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |