File name: | 721071b7aae15466c9b017e43e79d9d0281aec24f03d8858af1df1fb25a1db4b |
Full analysis: | https://app.any.run/tasks/027ac30a-9a8b-4ad8-afc6-dc823a7e956f |
Verdict: | Malicious activity |
Analysis date: | November 08, 2018, 07:28:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | D959F5CB4A5640C60D734CF1A8D0E53D |
SHA1: | 37BA1BD5B2341C488FEA79E0B862EB9BFD68ECCB |
SHA256: | 721071B7AAE15466C9B017E43E79D9D0281AEC24F03D8858AF1DF1FB25A1DB4B |
SSDEEP: | 24576:+Lkgd6fUT9Jrvogak6Mb8uMQU0CNuxnzrhYsl+r6An1FfqL4iG4b5:k |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3988 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\721071b7aae15466c9b017e43e79d9d0281aec24f03d8858af1df1fb25a1db4b.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 1 Version: 14.0.6024.1000 | ||||
4040 | "C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\DqFm.cMD" | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2488 | CmD | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1100 | C:\Windows\system32\cmd.exe /K C:\Users\admin\AppData\Local\Temp\i1mzn.cmd | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3296 | "C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\DqFm.cMD" | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3256 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1564 | CmD | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2052 | TASkKILL /F /IM winword.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3800 | reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\Resiliency /f | C:\Windows\system32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
928 | C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | 'p' |
Value: 27702700940F0000010000000000000000000000 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1298661393 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1298661508 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1298661509 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: 940F00002E5422B13477D40100000000 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | ws' |
Value: 77732700940F000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | ws' |
Value: 77732700940F000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3988) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR3498.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3384 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4A81.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3384 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFC289B624C4AE9C79.TMP | — | |
MD5:— | SHA256:— | |||
3384 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B50F03B1-6CDB-4AA4-8265-E1B9C5C1028B}.tmp | — | |
MD5:— | SHA256:— | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRADEE.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1100 | cmd.exe | C:\Users\admin\Desktop\721071b7aae15466c9b017e43e79d9d0281aec24f03d8858af1df1fb25a1db4b.rtf | document | |
MD5:83A2B3F8808C6FB761ABA052F7FC12E9 | SHA256:F6FE7C44BC18A900E368F5127DC2D57AF1E569004974E9DF3394034F62D9FE6C | |||
3988 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:D60D20A20527B37836471105C937C8C9 | SHA256:D732ED54E40AA23E1F5E768DA5969B8DA55C63266851B617B2E390CE2BF33573 | |||
3988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\ParT2.BiN | binary | |
MD5:D03D18090E43DE685800AB06DBD13E12 | SHA256:7B66A7A5988A434BA9401F5F30F18CD020DE36B117D25E143F17C2C0C6393D74 | |||
3988 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\721071b7aae15466c9b017e43e79d9d0281aec24f03d8858af1df1fb25a1db4b.rtf.LNK | lnk | |
MD5:95430BABC1C3A0E7619753E98296B2B1 | SHA256:38A617CDFB694F2C165D8E844CBD32B2181F47D6564EDB433FD7152F0835855D | |||
3988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{340ADD81-3706-4A12-B2C2-12B623EC074F}.tmp | document | |
MD5:DBFAB99B82AA00701C1DA91C78CEA980 | SHA256:D1085E7F034C10A088A3372931CB367789DD87E8E2B04B9DB566552FBCDF8F59 |