File name: | Doc_7435.doc |
Full analysis: | https://app.any.run/tasks/aac45dc8-902a-4d21-b5b4-a95bef2935fb |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 07:46:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | B8E1A1EFB94A995E7447D51541F08DE9 |
SHA1: | 2440429F66F1260F18E35DE3B7F749B746858CD1 |
SHA256: | EC21432052298640B54673391E93DF26375776F511D9CA1EFCF93FA939C2FF48 |
SSDEEP: | 768:OvyXCdJWz7zpgegbFz8Lob2GR/yapptJdRH4v:cm7gJz/BrH74v |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 24689 |
---|---|
CharactersWithSpaces: | 4 |
Characters: | 4 |
Words: | - |
Pages: | 1 |
TotalEditTime: | 1 minute |
RevisionNumber: | 2 |
ModifyDate: | 2019:06:20 00:52:00 |
CreateDate: | 2019:06:20 00:52:00 |
LastModifiedBy: | Windows User |
Author: | C |
Title: | Not |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3040 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Doc_7435.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.5123.5000 | ||||
2492 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Version: 00110900 | ||||
2060 | "C:\Windows\system32\taskmgr.exe" | C:\Windows\system32\taskmgr.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | s/ |
Value: 732F2000E00B0000010000000000000000000000 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1324482602 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1324482686 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1324482687 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: E00B0000446D0F023D3DD50100000000 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | 44 |
Value: 34342000E00B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | 44 |
Value: 34342000E00B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (3040) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2B73.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\wd32PrvSE.wmf | binary | |
MD5:C8BBD69BB58F455FD68CE82892139525 | SHA256:DA65E5D170765F586BD067BC32648B01E6FFDBBDC55FBED9DA5AAD8F5724E84B | |||
3040 | WINWORD.EXE | C:\Users\admin\Desktop\~$c_7435.doc.rtf | pgc | |
MD5:6F5111F7957CE40EEE5D1EDE7DD08F1E | SHA256:DB29CA754E4DD92BDAAB657B6B9C07F39B9C8DBEDB1208371721E66AFC2BD2EB | |||
3040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\wd32PrvSE.wmf:Zone.Identifier | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 |