File name: | a4b1ddf4fce066070e4c8c0c7dd8943e76b24f2a59d06f0120ad7649e320ad3e |
Full analysis: | https://app.any.run/tasks/35d219ed-4d01-4eb8-884d-2328ca18fc98 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 15:25:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 2D3FB8D5B4CEFC9660D98E0AD46FF91A |
SHA1: | 72ADE38861DAC1A720CA1F4E82B445E4F4379FE0 |
SHA256: | A4B1DDF4FCE066070E4C8C0C7DD8943E76B24F2A59D06F0120AD7649E320AD3E |
SSDEEP: | 3072:aIWzdBu9+0ZZHmdGHQgracn2mc9DXDmUpEJC6I6kD7kKdYc0+qXWC2n0Lkh:aIkjX0ZZHmd/Ujnzc9DXCxJCNDmsqXvG |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2396 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\a4b1ddf4fce066070e4c8c0c7dd8943e76b24f2a59d06f0120ad7649e320ad3e.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3620 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
2580 | "C:\Users\admin\Desktop\ChiPhiLienHoanNHNN-BC2019.exe" | C:\Users\admin\Desktop\ChiPhiLienHoanNHNN-BC2019.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office Word Exit code: 3221225477 Version: 12.0.4518.1014 | ||||
2312 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ChiPhiLienHoan.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | ChiPhiLienHoanNHNN-BC2019.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2312 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE6BD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\msoEA0A.tmp | — | |
MD5:— | SHA256:— | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4EC568A6-E363-4EC7-9E26-0BDDBEA49D4F}.tmp | — | |
MD5:— | SHA256:— | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{66970CBA-8E0D-44F4-932D-9DD0F4A4B9F1}.tmp | — | |
MD5:— | SHA256:— | |||
2580 | ChiPhiLienHoanNHNN-BC2019.exe | C:\Users\admin\AppData\Local\Temp\ChiPhiLienHoan.docx | document | |
MD5:4DB43175FDEC6BEB36E4B59896F2A78E | SHA256:B66FBF212A671B9B84AB7C6A8CBE808BE4A7706A9C293DAB5C76DEE6E311F025 | |||
2396 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2396.47821\wwlib.dll | executable | |
MD5:655C536462944D0F3C9FCF4EC19D2015 | SHA256:EB45D216286196FE7B4CCFB05A8CD11807C174C4E622AA290195DBE2D2BC586D | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$iPhiLienHoan.docx | pgc | |
MD5:F1353568EA4E4B5BDE1E0662DC1168E8 | SHA256:5A4DEA1E862A2962A060473FB86502896303A70EDE3B1515787B31D891690C6B | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:9F5A3DB18D87B665EECD07FA41B627CC | SHA256:EC51BEEA411DD22338D70B37B8701E5679CD5D1534F2B12D174C8D269074B132 | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0c09.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2312 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 |
Domain | IP | Reputation |
---|---|---|
office.allsafebrowsing.com |
| unknown |