File name: | Inbound Fax received from (423).one |
Full analysis: | https://app.any.run/tasks/bc86e6f6-3adc-40de-b7d9-da675172c7c5 |
Verdict: | Malicious activity |
Analysis date: | December 02, 2019, 18:37:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/octet-stream |
File info: | data |
MD5: | 4CC5A3DC3AA8CFD26BEEB4CCFBF7C5E2 |
SHA1: | 9FEE5C1AB48E553BD6FA7114508F678C6E77AF72 |
SHA256: | E48244099606259D2FA6DBE003934CCA181338D5E96132C2D531157753116605 |
SSDEEP: | 1536:/ELTDB188HMNGEOytDzwa44N6yGfaCcFEANani:/ELnB188HMNvD0a5EfxcFEAQn |
.one | | | Microsoft OneNote note (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
944 | "C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" "C:\Users\admin\AppData\Local\Temp\Inbound Fax received from (423).one" | C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneNote Version: 14.0.6022.1000 | ||||
1884 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | ONENOTE.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2812 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1884 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1784 | /tsr | C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE | — | ONENOTE.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneNote Quick Launcher Version: 14.0.6015.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\CVRA737.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1884 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1884 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{BD644A3F-24BA-4577-8BFE-A6151959A882} | image | |
MD5:17FC7531B0DE3ED843DEB95CD220461C | SHA256:5F27830A031F90FDB9E95ABCB9EDC6A1D76E5E5F0E9EC797A2029967AE9CD489 | |||
2812 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:B84223A3215078DBCF492BDF5FD216C8 | SHA256:8B1392519545948790F748CEBC66E7D420E39A127FD651154BC91C0CF532C01E | |||
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\f8f8698b-d7ab-40ba-9067-244241fca1b4.png | image | |
MD5:17FC7531B0DE3ED843DEB95CD220461C | SHA256:5F27830A031F90FDB9E95ABCB9EDC6A1D76E5E5F0E9EC797A2029967AE9CD489 | |||
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{AD2C8946-5905-483E-9C59-C87224864D8E} | image | |
MD5:4E109BD1750DFE71CF3EDF536B29DBDC | SHA256:2A3ACE3296228CE647A2C06C514273564CE31403EFEC8064386B754AB012B93F | |||
2812 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019120220191203\index.dat | dat | |
MD5:BC7A9F26F684ABF2EFAFEE8F60403CE4 | SHA256:D61EA6F4EE75E8713163713724CC53E0E25944F590AA0265A50D65787C16E51F | |||
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{FB2A0A1C-0946-4EE8-AF50-7F1C0C51E643} | image | |
MD5:3C9E35F347B2B524F18E610DB5CF53C7 | SHA256:75E136DBC97F54DC155E416E44024EEE522AD3636F7331AA46F74FECDF863E2F | |||
944 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\dfcbd1cb-0a4c-474f-beae-23f1c3c69891.png | image | |
MD5:3C9E35F347B2B524F18E610DB5CF53C7 | SHA256:75E136DBC97F54DC155E416E44024EEE522AD3636F7331AA46F74FECDF863E2F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
944 | ONENOTE.EXE | GET | 301 | 2.19.38.37:80 | http://www.smartfax.com/ | unknown | — | — | malicious |
1884 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1884 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2812 | iexplore.exe | 20.150.50.1:443 | smartfax.z20.web.core.windows.net | — | US | unknown |
— | — | 18.197.25.107:443 | anrlivestream.com | Amazon.com, Inc. | DE | suspicious |
944 | ONENOTE.EXE | 20.150.50.1:443 | smartfax.z20.web.core.windows.net | — | US | unknown |
1884 | iexplore.exe | 20.150.50.1:443 | smartfax.z20.web.core.windows.net | — | US | unknown |
2812 | iexplore.exe | 18.197.25.107:443 | anrlivestream.com | Amazon.com, Inc. | DE | suspicious |
944 | ONENOTE.EXE | 2.19.38.37:80 | www.smartfax.com | Akamai International B.V. | — | whitelisted |
— | — | 2.19.39.72:443 | www.efax.eu | Akamai International B.V. | — | whitelisted |
944 | ONENOTE.EXE | 2.19.39.72:443 | www.efax.eu | Akamai International B.V. | — | whitelisted |
944 | ONENOTE.EXE | 104.47.33.28:443 | nam01.safelinks.protection.outlook.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
smartfax.z20.web.core.windows.net |
| unknown |
www.bing.com |
| whitelisted |
anrlivestream.com |
| suspicious |
nam01.safelinks.protection.outlook.com |
| whitelisted |
www.smartfax.com |
| malicious |
www.efax.eu |
| suspicious |