File name: | Draft BL.doc |
Full analysis: | https://app.any.run/tasks/43e5f755-668e-4683-b86b-0108d7e75332 |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | May 15, 2019, 13:27:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | AC3A35769F141166C120DE2B8E95DB1C |
SHA1: | A6C2249E8808B65991370DD0E47D7BACE23D1549 |
SHA256: | A29A39D6D139A468FCB953587423C9B02D4D68B333922B7783E24FFAB5F69FB0 |
SSDEEP: | 24576:pd6qlMEjK5kyHty99BE7f8Gh+lN4z4Z19tWLAs1Uwq0/4oveckLKOidW0GdmChP:F |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3004 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Draft BL.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 1 Version: 14.0.5123.5000 | ||||
1924 | "C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD" | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2604 | CmD | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2836 | C:\Windows\system32\cmd.exe /K mt6nzqofd.CMD | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2444 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2076 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2264 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2660 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2968 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2512 | TIMEOUT /T 1 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3004 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRFCEA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2836 | cmd.exe | C:\Users\admin\Desktop\Draft BL.doc.rtf\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:9E2E41D3A4CA424777A85F3A29A83626 | SHA256:9251730D7879FFEA0408CA4F445C547F905E08A3B27DFC5A44249FF432E766EA | |||
2856 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR1DEF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Draft BL.doc.LNK | lnk | |
MD5:79AB6BCE1E8D17718F282250DE653524 | SHA256:00CD8534BE038E074B5993B0A5AD7564561ADB400BA24041B8BAAE9A3297DBDC | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\mt6nzqofd.cmd | text | |
MD5:B5B6D0CC5AE87D9B02585E5B3246C1A2 | SHA256:15C6536DD7A47ADD995049F4E54D86F69F50BB20FE29B88B5AE809A888730A5E | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\uffm.cmd:Zone.Identifier | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{5DA0C8FA-9F8D-4C46-8D59-B22390C87247}.tmp | binary | |
MD5:6AE9A47835BE77DBB98AFF42C07A8755 | SHA256:5E07C5C96285344E4230F8751DB9B3E5302E709D6EB4DECA1F536624E068BD3C | |||
3004 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{DA542BFB-4A51-4A8A-8D79-D66DB34941C4}.tmp | binary | |
MD5:FF2971E8E12ACFF2D1B310386EBEC4CA | SHA256:78981E4E6AFF2E0638540A13E4692B4D4C06230668F4F44F3CB2E5B20EFB4DF4 | |||
3048 | cscript.exe | C:\Users\admin\AppData\Local\Temp\saver.scr | executable | |
MD5:0A389BF75072D8AB4B152CD4A14B3581 | SHA256:F031A414E5C6881E2207D38006166CE1F6C86D7F8176AE6B3DCEBCA88DDC2935 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2548 | saver.scr | GET | 503 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | html | 6.61 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2548 | saver.scr | 104.16.154.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
whatismyipaddress.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2548 | saver.scr | A Network Trojan was detected | MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck) |