File name: | Re Factuur # 19071610.zip |
Full analysis: | https://app.any.run/tasks/57ffa329-96e9-441f-af39-5d7cee87b30a |
Verdict: | Malicious activity |
Analysis date: | July 17, 2019, 12:04:28 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 682A556FE6FF57F7D5A887D4FF9B5093 |
SHA1: | 32F6A3BA3594AD2BE4E2B920BC2F84C1A8BDCBC5 |
SHA256: | FB94BC65D9E7CC7DD2E705CE28E44A589EF91115CCA936CAF93C1CDE691ED8DE |
SSDEEP: | 768:zGoPU3KkkGM3Vw4eqZm6Yy9cF+2CcH5Uq/BUDWGfnjUPmfqBPHlYqOUv3Oi1zUn:nPUwGM3qSfY0cTtH5U4kvGRHlm8Oi1zI |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:07:17 13:44:26 |
ZipCRC: | 0x5b21b54f |
ZipCompressedSize: | 43326 |
ZipUncompressedSize: | 88576 |
ZipFileName: | Re Factuur # 19071610.msg |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2880 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Re Factuur # 19071610.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3040 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIa2880.10005\Re Factuur # 19071610.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2808 | "C:\Program Files\Internet Explorer\iexplore.exe" http://sudorafexocap.com/office365 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3568 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2808 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRC340.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F5F2137.dat | image | |
MD5:FB6B849A4B7593C5FD8D446531BFCFAD | SHA256:F7F41894F0DA4D63236C85B74F6A7BABB950ACA5259C04395EDEDEDF29B6E84F | |||
2880 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2880.10005\Re Factuur # 19071610.msg | msg | |
MD5:36487CF1D07FC306C71E53EDB5631EAC | SHA256:FB36315E5738403D018D9D8F9BDA682E7812A400300BDF9205347C50405D298C | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3D6F99CC.dat | image | |
MD5:121E6A29D4A70CAA30213E2847B55DE5 | SHA256:0A2A6795AD22073244FFD750FE64642C147969BDDB9FD1472CFC6A3EC09D094D | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:A68E364267FB825CA5117E9511CF336C | SHA256:9A152B5AC179DD6564257EAB6A28F5795D2741AF06CA488BA386372299388B41 | |||
3568 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VFE9R4PC\office365[1].txt | — | |
MD5:— | SHA256:— | |||
3568 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VFE9R4PC\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_BA3152A4897065439A57430FBD3A3479.dat | xml | |
MD5:807EF0FC900FEB3DA82927990083D6E7 | SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913 | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_9A0C26C9D49B184F9B1DE5ACF8C4F34D.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
3040 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_D9B2434CD79E8B43941F43837E102D6A.dat | xml | |
MD5:BBCF400BD7AE536EB03054021D6A6398 | SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3568 | iexplore.exe | POST | 302 | 107.180.58.16:80 | http://sudorafexocap.com/office365/ | US | — | — | suspicious |
3568 | iexplore.exe | GET | 200 | 107.180.58.16:80 | http://sudorafexocap.com/office365/index.php | US | html | 1.08 Kb | suspicious |
3568 | iexplore.exe | GET | 200 | 107.180.58.16:80 | http://sudorafexocap.com/office365/Login.php | US | text | 74 b | suspicious |
3568 | iexplore.exe | GET | 304 | 107.180.58.16:80 | http://sudorafexocap.com/office365/img/0.jpg | US | compressed | 1.08 Kb | suspicious |
2808 | iexplore.exe | GET | 200 | 107.180.58.16:80 | http://sudorafexocap.com/office365/img/favicon_a.ico | US | image | 540 b | suspicious |
2808 | iexplore.exe | GET | 200 | 13.107.21.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2808 | iexplore.exe | GET | 404 | 107.180.58.16:80 | http://sudorafexocap.com/favicon.ico | US | html | 857 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2808 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3040 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3568 | iexplore.exe | 107.180.58.16:80 | sudorafexocap.com | GoDaddy.com, LLC | US | suspicious |
2808 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2808 | iexplore.exe | 107.180.58.16:80 | sudorafexocap.com | GoDaddy.com, LLC | US | suspicious |
3568 | iexplore.exe | 95.100.79.183:443 | secure.aadcdn.microsoftonline-p.com | Akamai Technologies, Inc. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
sudorafexocap.com |
| suspicious |
www.bing.com |
| whitelisted |
secure.aadcdn.microsoftonline-p.com |
| whitelisted |