File name: | a4b1ddf4fce066070e4c8c0c7dd8943e76b24f2a59d06f0120ad7649e320ad3e |
Full analysis: | https://app.any.run/tasks/7a6e7d92-62de-4fdc-8ed7-81bda31c3072 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 15:20:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 2D3FB8D5B4CEFC9660D98E0AD46FF91A |
SHA1: | 72ADE38861DAC1A720CA1F4E82B445E4F4379FE0 |
SHA256: | A4B1DDF4FCE066070E4C8C0C7DD8943E76B24F2A59D06F0120AD7649E320AD3E |
SSDEEP: | 3072:aIWzdBu9+0ZZHmdGHQgracn2mc9DXDmUpEJC6I6kD7kKdYc0+qXWC2n0Lkh:aIkjX0ZZHmd/Ujnzc9DXCxJCNDmsqXvG |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2984 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\a4b1ddf4fce066070e4c8c0c7dd8943e76b24f2a59d06f0120ad7649e320ad3e.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2468 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\a4b1ddf4fce066070e4c8c0c7dd8943e76b24f2a59d06f0120ad7649e320ad3e.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
752 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
2224 | "C:\Users\admin\Desktop\ChiPhiLienHoanNHNN-BC2019.exe" | C:\Users\admin\Desktop\ChiPhiLienHoanNHNN-BC2019.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office Word Exit code: 3221225477 Version: 12.0.4518.1014 | ||||
3780 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ChiPhiLienHoan.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | ChiPhiLienHoanNHNN-BC2019.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3780 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR66DA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3780 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\mso696B.tmp | — | |
MD5:— | SHA256:— | |||
2224 | ChiPhiLienHoanNHNN-BC2019.exe | C:\Users\admin\AppData\Local\Temp\ChiPhiLienHoan.docx | document | |
MD5:4DB43175FDEC6BEB36E4B59896F2A78E | SHA256:B66FBF212A671B9B84AB7C6A8CBE808BE4A7706A9C293DAB5C76DEE6E311F025 | |||
3780 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$iPhiLienHoan.docx | pgc | |
MD5:4CEB63800F4E2F4CDB263DDF1E227249 | SHA256:7CE603FEAED8DAA49CD3D7AEFDEE902E5AE17A32A17E61BAB8369257786E4B02 | |||
3780 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:85F6EC05DA7CBC4741B83AACE6023D18 | SHA256:27720BA5806C030751DC01B4A0A952B449AED5E58BAC317F2EA58DFB978BDF6C | |||
2468 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2468.19103\wwlib.dll | executable | |
MD5:655C536462944D0F3C9FCF4EC19D2015 | SHA256:EB45D216286196FE7B4CCFB05A8CD11807C174C4E622AA290195DBE2D2BC586D | |||
3780 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
3780 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0c09.lex | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 | |||
2468 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2468.19103\ChiPhiLienHoanNHNN-BC2019.exe | executable | |
MD5:CEAA5817A65E914AA178B28F12359A46 | SHA256:6C959CFB001FBB900958441DFD8B262FB33E052342948BAB338775D3E83EF7F7 |
Domain | IP | Reputation |
---|---|---|
office.allsafebrowsing.com |
| unknown |