File name: | f.rtf |
Full analysis: | https://app.any.run/tasks/8b2ef73f-c4a4-45a3-bbee-6fa645c9a6f8 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 09:48:31 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with CRLF line terminators |
MD5: | E3E23C7C69E0EF102D337D0CBD1695F9 |
SHA1: | 5E68047878AA32B68AFEB7BD06E5001C2AC00841 |
SHA256: | 96034C6E64D1AE750793D5522E8FC5859236BEFD54C6CAA40B1EFE82A17187D5 |
SSDEEP: | 12288:enKVB19/Eqi5pjuXCOhptAQCsL74Tn+u4tcI5nCd:enKL/EfCjCekT+ugF5ng |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2328 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\f.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
1504 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2128 | cmd /c type %tmp%\zqaj >%tmp%\zqaj.bat AAAAAC | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2740 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2908 | cmd /c %tmp%\zqaj.bat AAAAAAAAAAAAAAAAAAAAAAC | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3952 | cmd /c "type C:\Users\admin\AppData\Local\Temp\Word.exez >C:\Users\admin\AppData\Local\Temp\Word.exe" | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2476 | cmd /c "type C:\Users\admin\AppData\Local\Temp\Word.exey >>C:\Users\admin\AppData\Local\Temp\Word.exe" | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
552 | cmd /c "type C:\Users\admin\AppData\Local\Temp\Word.exex >>C:\Users\admin\AppData\Local\Temp\Word.exe" | C:\Windows\system32\cmd.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
324 | cmd /c "C:\Users\admin\AppData\Local\Temp\Word.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3704 | C:\Users\admin\AppData\Local\Temp\Word.exe | C:\Users\admin\AppData\Local\Temp\Word.exe | cmd.exe | |
User: admin Company: Macrosoft.com Integrity Level: MEDIUM Description: Windows Host Version: v1.01-3 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR40E4.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C0F38F9.wmf | — | |
MD5:— | SHA256:— | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7DCA1AA6.wmf | — | |
MD5:— | SHA256:— | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{724A7071-CD0C-4CCC-9570-5104A8B83D59}.tmp | — | |
MD5:— | SHA256:— | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{62E0094F-B7BC-4E6A-B54E-7AA845FF65B9}.tmp | — | |
MD5:— | SHA256:— | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FC7F81AF-9EF3-46EA-B1C4-C034180746C7}.tmp | — | |
MD5:— | SHA256:— | |||
2128 | cmd.exe | C:\Users\admin\AppData\Local\Temp\zqaj.bat | text | |
MD5:60E875094B9AFD4EF3766367C414161B | SHA256:A68A7B9C3A6D60D439B720233F9E9E030B34840884A989636E8D77E9378CD16A | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word.exex | binary | |
MD5:D9E707306BC1A0620ABFA0AD28E3864D | SHA256:A3D40ECEE4AA5A7520CB0FAA16C31A312AF78A811E775F29F0CC90B1D53595E3 | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word.exez | executable | |
MD5:BFF54B9ED68877620A8169E5BCFFCDFF | SHA256:D1C162D4D7242C9D726C7EFB0C042F5CB794697D574D1E2E48C7DFECDEE19AB2 | |||
2328 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$f.rtf | pgc | |
MD5:F09C8E727576498C9840FE816733565F | SHA256:5D682EBC1AF3EC03C4A458F013E32DAE023B88EB33BF238ACA58974326F88B14 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | 404 | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | html | 1.00 Kb | malicious |
3704 | Word.exe | GET | — | 161.202.65.4:80 | http://www.ds-racing.com.tw/js/colorbox/content/ajax/index.php | JP | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3704 | Word.exe | 161.202.65.4:80 | www.ds-racing.com.tw | SoftLayer Technologies Inc. | JP | malicious |
Domain | IP | Reputation |
---|---|---|
www.ds-racing.com.tw |
| malicious |
dns.msftncsi.com |
| shared |