File name: | a.doc |
Full analysis: | https://app.any.run/tasks/509e5047-3552-4dea-86ce-308715b7efa9 |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | October 14, 2019, 16:14:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, unknown version |
MD5: | 874C64DD0FDAD641AB85FD78636E3714 |
SHA1: | 7AE611FBB77DAFE73321C3CDF257702346845FD7 |
SHA256: | A8D83B286651CEF3BF8E96A3727D96F246675CC604A7CF78B294233A703885B9 |
SSDEEP: | 96:rurMOqFA44XI+XoxYWgM82Z1wcf4YXCaeP:lRFA44YioxGMccfLXuP |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2396 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\a.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3892 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
656 | "C:\Users\admin\AppData\Roaming\qwertyuhgfdsadfghgf.exe" | C:\Users\admin\AppData\Roaming\qwertyuhgfdsadfghgf.exe | EQNEDT32.EXE | |
User: admin Integrity Level: MEDIUM Description: Pig Dice Game Exit code: 0 Version: 1.8.8.8 | ||||
2232 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bHPiviWSjdH" /XML "C:\Users\admin\AppData\Local\Temp\tmp9214.tmp" | C:\Windows\System32\schtasks.exe | — | qwertyuhgfdsadfghgf.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3232 | "C:\Users\admin\AppData\Roaming\qwertyuhgfdsadfghgf.exe" | C:\Users\admin\AppData\Roaming\qwertyuhgfdsadfghgf.exe | qwertyuhgfdsadfghgf.exe | |
User: admin Integrity Level: MEDIUM Description: Pig Dice Game Version: 1.8.8.8 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2396 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA4B6.tmp.cvr | — | |
MD5:— | SHA256:— | |||
656 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Local\Temp\tmp9214.tmp | — | |
MD5:— | SHA256:— | |||
3232 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Roaming\o5f3cvvw.fnh\Chrome\Default\Cookies | — | |
MD5:— | SHA256:— | |||
3232 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Roaming\o5f3cvvw.fnh\Firefox\Profiles\qldyz51w.default\cookies.sqlite | — | |
MD5:— | SHA256:— | |||
3232 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Local\Temp\637066701377218750_e7fae880-0056-42ee-a477-d2b81e5193e2.db | sqlite | |
MD5:0B3C43342CE2A99318AA0FE9E531C57B | SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8 | |||
2396 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:8B378DCC62035BBABEF8B1C2A131A338 | SHA256:7C1F83E56B3CF1632E1D1DDD8BFD13219F8133599041726FA2EA3FB98B22B275 | |||
3892 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\mezz[1].exe | executable | |
MD5:E3B622D5D710B409346C85588D97CA32 | SHA256:961CC3AAB84D229EDC13CB2DE57927FFB5AD979692F0226A658FB5547B0451AB | |||
3232 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Roaming\o5f3cvvw.fnh.zip | compressed | |
MD5:CA7B504C376AAA97343DAF5C3FB0A40C | SHA256:DE4CC3F15B7F5C6964B7B8CAD23E9F665DBFC28DFBF1A464365F708C6E475474 | |||
3892 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\qwertyuhgfdsadfghgf.exe | executable | |
MD5:E3B622D5D710B409346C85588D97CA32 | SHA256:961CC3AAB84D229EDC13CB2DE57927FFB5AD979692F0226A658FB5547B0451AB | |||
656 | qwertyuhgfdsadfghgf.exe | C:\Users\admin\AppData\Roaming\bHPiviWSjdH.exe | executable | |
MD5:E3B622D5D710B409346C85588D97CA32 | SHA256:961CC3AAB84D229EDC13CB2DE57927FFB5AD979692F0226A658FB5547B0451AB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3232 | qwertyuhgfdsadfghgf.exe | GET | 200 | 18.214.132.216:80 | http://checkip.amazonaws.com/ | US | text | 13 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3892 | EQNEDT32.EXE | 112.213.89.40:443 | tfvn.com.vn | SUPERDATA | VN | malicious |
3232 | qwertyuhgfdsadfghgf.exe | 18.214.132.216:80 | checkip.amazonaws.com | — | US | shared |
3232 | qwertyuhgfdsadfghgf.exe | 198.54.122.60:587 | mail.privateemail.com | Namecheap, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
tfvn.com.vn |
| unknown |
checkip.amazonaws.com |
| shared |
mail.privateemail.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3232 | qwertyuhgfdsadfghgf.exe | A Network Trojan was detected | MALWARE [PTsecurity] AgentTesla IP Check |