File name: | 5231680984383488.zip |
Full analysis: | https://app.any.run/tasks/a85c3d42-4d8b-4c09-9c9e-f7dfa03a0085 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 14:51:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | D3FE3B7F359F49E682803EE9C77DB3F1 |
SHA1: | 07557E9C61D03444D620BA9A4FF29034D10E9060 |
SHA256: | 910D8547E144C17FA9211C47F4986C2B06B4A9716DAEAAE85E6BEE18FCCF8593 |
SSDEEP: | 48:9skGYBUXufDiytFCK5LyYoYrDcAv9+dHGVoNbusgbJ3KenO:OPdeNvRmY5kdHtusgbJaenO |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Unknown (99) |
ZipModifyDate: | 1980:00:00 00:00:00 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | 2062 |
ZipUncompressedSize: | 4176 |
ZipFileName: | d0a73aaa93aa180a7fc51d4e9f54dbf9e7f00c5ab6242d25fdbf73575107a709 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3564 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\5231680984383488.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3276 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Product Inquiry-Zato_19062019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1696 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3712 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Product Inquiry-Zato_19062019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
124 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Product Inquiry-Zato_19062019 - Copy.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
572 | "C:\Users\admin\AppData\Roaming\fjhrekdml;sa.exe" | C:\Users\admin\AppData\Roaming\fjhrekdml;sa.exe | — | EQNEDT32.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1424 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3060 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | fjhrekdml;sa.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 4294967295 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
2520 | "C:\Users\admin\AppData\Roaming\fjhrekdml;sa.exe" | C:\Users\admin\AppData\Roaming\fjhrekdml;sa.exe | — | EQNEDT32.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1372 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | fjhrekdml;sa.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3564 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb3564.38460\d0a73aaa93aa180a7fc51d4e9f54dbf9e7f00c5ab6242d25fdbf73575107a709 | — | |
MD5:— | SHA256:— | |||
3276 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR7274.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3712 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2BF0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3712 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRC0000.tmp | — | |
MD5:— | SHA256:— | |||
3712 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4C1D888D-2752-4BF5-88FB-875F277E9BA4}.tmp | — | |
MD5:— | SHA256:— | |||
124 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6EF0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3276 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Product Inquiry-Zato_19062019.doc.LNK | lnk | |
MD5:B1D9661CE583A90ED7BEABF75FEE7518 | SHA256:41C5B0905D2159AFDA9F70EC5D68CA537DBB9AF7A3C21D9A1EA43590625EAC51 | |||
3276 | WINWORD.EXE | C:\Users\admin\Desktop\~$oduct Inquiry-Zato_19062019.doc | pgc | |
MD5:C0C3523DAD9682820970D81D4E038A2E | SHA256:684465F171D7F3B593722FFA674F275998CA86C93A54DB0B01D2261884403D7B | |||
3276 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:46867060E2735D6C9B7BA5FECA22F5A6 | SHA256:22C4541F0C075DFCDF57B9C18866CBB5E8D2DC9BBD3C6E730E49F3E3329DDA2F | |||
3276 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:E0A2843758894B4090FFC30F302D2763 | SHA256:4E0980AD39447A01F99DD5CD5E1510AC6E74B41878839346B74F23020FAB755E |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1696 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
3060 | RegAsm.exe | 198.54.122.60:587 | mail.privateemail.com | Namecheap, Inc. | US | suspicious |
1424 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
1372 | RegAsm.exe | 198.54.122.60:587 | mail.privateemail.com | Namecheap, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
tfvn.com.vn |
| unknown |
mail.privateemail.com |
| shared |