File name: | factura.zip |
Full analysis: | https://app.any.run/tasks/38e2136e-9940-446c-b337-93788f070b82 |
Verdict: | Malicious activity |
Analysis date: | April 10, 2023, 19:40:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | E109BE482E82D1BD14AF64D070D2670C |
SHA1: | 30532B7EC2FE340939A18E8F328C17DDFA3276EF |
SHA256: | DF9F9BED6685EEBA38DEFA87A755A0C8120F7B572094368E3AEF41829039980D |
SSDEEP: | 96:pJpDQKSK6aetXennFi0A/Txzdxh40jV4/b23r/wF5fyY+zCGiM5oEo7k13e:p0KT6aetHfNz7iMVh/wDfyY+zCGiMPo3 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2021:02:27 08:53:06 |
ZipCRC: | 0x474e65f8 |
ZipCompressedSize: | 4844 |
ZipUncompressedSize: | 11734 |
ZipFileName: | factura.doc |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1300 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\factura.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
3772 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb1300.10295\factura.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
2120 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
|
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (1300) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3772) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (3772) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: On |
PID | Process | Filename | Type | |
---|---|---|---|---|
3772 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6548.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3772 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIb1300.10295\~$actura.doc | pgc | |
MD5:639CF9354CB886E90190B5B2D1DAA1ED | SHA256:9D4743CD184A02ADD092532228EE36BB6BE24AF9517E954EDF8C4F8E4B3CBDF6 | |||
1300 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb1300.10295\factura.doc | text | |
MD5:05C137D8E79CE59ED6E4B7CD78E5B8A2 | SHA256:5A31C77293AF2920D7020D5D0236691ADCEA2C57C2716658CE118A5CBA9D4913 | |||
3772 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:85FB7CE9BA4D006950004E03B7392858 | SHA256:4BF4EC1E0E5A8E7F64EBFC73D0715FB4055C88E7DBA5493A1BEF1A9CE7C5A59B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2120 | EQNEDT32.EXE | GET | 404 | 185.36.74.48:80 | http://seed-bc.com/juop4/plwr/mklo/rbn/jan2.exe | IT | html | 315 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2120 | EQNEDT32.EXE | 185.36.74.48:80 | seed-bc.com | Fastweb | IT | suspicious |
Domain | IP | Reputation |
---|---|---|
seed-bc.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2120 | EQNEDT32.EXE | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |