File name: | d2f1dda28422a27b47f5022d834fd4330926a8c58fa0382e614425d067afa5b0 |
Full analysis: | https://app.any.run/tasks/ec4a8a89-0a45-4741-bbe9-45813c9d9f9b |
Verdict: | Malicious activity |
Analysis date: | June 12, 2019, 10:10:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | 92225C4155F33D5DF21745A1DBB9391E |
SHA1: | 70C0758D81A95AE15E0D0E302EF49C48658380E9 |
SHA256: | D2F1DDA28422A27B47F5022D834FD4330926A8C58FA0382E614425D067AFA5B0 |
SSDEEP: | 3072:q7nQarK0ueTRMgbDC3gbC3zzwS1czETcpEGc/gCcllQcuDtR:ENG0BtoGC3zzwSmgAi7IvP5gtR |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 105 |
---|---|
CharactersWithSpaces: | 131 |
Characters: | 113 |
Words: | 19 |
Pages: | 1 |
TotalEditTime: | 1 minute |
RevisionNumber: | 1 |
ModifyDate: | 2019:06:09 21:41:00 |
CreateDate: | 2019:06:09 21:40:00 |
LastModifiedBy: | Administrator |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3372 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\d2f1dda28422a27b47f5022d834fd4330926a8c58fa0382e614425d067afa5b0.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2420 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
992 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3000 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3872 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1380 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2096 | "C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -Embedding | C:\Program Files\Microsoft Office\Office14\excelcnv.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3372 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR305.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2420 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR12A5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
992 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR2591.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3000 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR330E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3872 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR4251.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1380 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR5358.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2096 | excelcnv.exe | C:\Users\admin\AppData\Local\Temp\CVR6317.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2096 | excelcnv.exe | C:\Users\admin\AppData\Local\Temp\~DFDEA31EBC7CB47101.TMP | — | |
MD5:— | SHA256:— | |||
3372 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF7BDF893EAED1C7F8.TMP | — | |
MD5:— | SHA256:— | |||
2096 | excelcnv.exe | C:\Users\admin\AppData\Local\Temp\~DFBC8C81CC04BDB153.TMP | — | |
MD5:— | SHA256:— |
Domain | IP | Reputation |
---|---|---|
amanihackz.com |
| unknown |