File name: | 4846317728202752.zip |
Full analysis: | https://app.any.run/tasks/b04872d0-4764-489d-bd56-60646280d1aa |
Verdict: | Malicious activity |
Analysis date: | July 12, 2020, 10:54:51 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | AFFC8FC737A395C291300855E5877605 |
SHA1: | 8794F160EDE190A5A2D8D94D58523A483B71BC79 |
SHA256: | 8DE2DF0DF21B7A1E1629EC60437A144BA42B0F09DFADFAA5B9D373B86C0A6ACB |
SSDEEP: | 49152:vuBYdLA5z2ML3buKU2TA1s7wuu2PJ3UDotjUwOxT:WmdcEjhCu2h32otjET |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | 2ba13a3e540229677456d1e320f682bed8e6733bf6547b89a496b8d020eea698 |
---|---|
ZipUncompressedSize: | 4069376 |
ZipCompressedSize: | 2212749 |
ZipCRC: | 0xa4dcd769 |
ZipModifyDate: | 1980:00:00 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1876 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4846317728202752.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2056 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\2ba13a3e540229677456d1e320f682bed8e6733bf6547b89a496b8d020eea698.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2096 | "C:\Users\admin\AppData\Roaming\Microsoft\MicroScMgmt.exe" | C:\Users\admin\AppData\Roaming\Microsoft\MicroScMgmt.exe | — | WINWORD.EXE |
User: admin Company: Quick Heal Technologies Ltd. Integrity Level: MEDIUM Description: Online Protection Version: 11.1.0.11 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1876 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1876.14322\2ba13a3e540229677456d1e320f682bed8e6733bf6547b89a496b8d020eea698 | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR42E9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1492B793.jpeg | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\micro | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6DF2E478.jpeg | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AC156A19.jpeg | — | |
MD5:— | SHA256:— | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$vid19_Guidelines.docx | pgc | |
MD5:EB4FCAE7FC62D60168409A74965C032A | SHA256:517E60428A9DF93F2DA0EA408EC03965669A4E89C5C34D2C3B984DCFE78F49DE | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\982D066C.wmf | wmf | |
MD5:01076DB91E42E258D6D1A0D96465C263 | SHA256:461E5D266021A377DFF8C26ADDAAC249E3E55766C112928874A58D0D79D9A27E | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:C49358304191636C0B4C3468DEE0E9BD | SHA256:4722021C4ABA5BCE22DF0FFF1B23473135083A6733C296CD4302EEC5BB166F4A | |||
2056 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:5CF51E4F0CB86A7C857A847A37A50F5B | SHA256:551292F4A88A0717C7E88FCBEEC94D71E9166C72643DC8A460371B088CA10A29 |