File name: | ACH Payment Advice.zip |
Full analysis: | https://app.any.run/tasks/e97a0ef1-3887-444b-9f95-1bc2898b7f27 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 17:27:56 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 166CB382D2BC8FCFBC54E380818F9EF8 |
SHA1: | 5CC75693C932C65BD231E826B0CE0DDF5650C401 |
SHA256: | 02BDA274DCE2F7A23EB5569767F695950F6C99618396FB60CBB497FF71A316D2 |
SSDEEP: | 768:HCZ/4dyr7ppIrBOSnKE8ZZfeZpbJ606qEWDG4+QrI00NXA+JWXaAA9/enm1Rln0x:Hl4r7pmBMVZZfQpI3WpaLJWqAiWnylLI |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | ACH Payment Advice.xls |
---|---|
ZipUncompressedSize: | 86528 |
ZipCompressedSize: | 43309 |
ZipCRC: | 0xf196f715 |
ZipModifyDate: | 2022:05:18 21:54:01 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2828 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ACH Payment Advice.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
1656 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3608 | C:\Windows\System32\regsvr32.exe ..\hvxda.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2232 | C:\Windows\System32\regsvr32.exe ..\hvxda.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2328 | C:\Windows\System32\regsvr32.exe ..\hvxda.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1656 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR25FF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA | der | |
MD5:D5E270D74DBADE0F3350ED531128DC9A | SHA256:C242010C3AB0A663751A5F035A19D1A3A5FAB13ABD2E13D5AF97A49D63C09FB5 | |||
1656 | EXCEL.EXE | C:\Users\admin\hvxda.ocx | html | |
MD5:D9B41A88DD3AA3956EF5F5F311794772 | SHA256:2A6F1FC2E0B0E6A05D8669FA77458BF4F240EEC932FC1DD67C559385677C7384 | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\xDjDiXhcS[1].htm | html | |
MD5:A0E5B8F7FD0C7EAC629A58A38ABB4869 | SHA256:766B3EFBD43596022AEBEE083C5AAD28108990C2D86CA0B236D3B283038DB9D3 | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691 | der | |
MD5:D9AD86C16BB8DF5F783C447663F752E9 | SHA256:05FBF77343768D2E2079347876363E50A9D3F35A365183019212B8F42530F0AE | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\suspendedpage[1].htm | html | |
MD5:D9B41A88DD3AA3956EF5F5F311794772 | SHA256:2A6F1FC2E0B0E6A05D8669FA77458BF4F240EEC932FC1DD67C559385677C7384 | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:5A42856BD6B8DBAF387ADCE7F88598E9 | SHA256:DF3F253A4DBFE788DF76CDBA2C39E305790F02500E44E74A711DB31F0F4F0290 | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFA6A019873869E18C.TMP | document | |
MD5:4E4DF02827873A28025EDE9E95FC1210 | SHA256:ED70287965F97755B7369F9ED5114040734EC285C2E2406A7013703FC72AC3D9 | |||
2828 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2828.34780\ACH Payment Advice.xls | document | |
MD5:7BA8D019F4BFBF169AA4C31DBF28EDB8 | SHA256:871C3A560FE16EBB0C953F84FF95E05EB7C5075B8356B09AA43BDDEEC9C21826 | |||
1656 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFA33C8D8322C06503.TMP | gmc | |
MD5:80D729763A6473BFA558845D73A050D2 | SHA256:E0DDFAEA5DE0384520652C85E67D4A36B89B85AA5D154F9E908B08AE696FDE8E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1656 | EXCEL.EXE | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY | US | der | 728 b | whitelisted |
1656 | EXCEL.EXE | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D | US | der | 471 b | whitelisted |
1656 | EXCEL.EXE | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?63264cac790bb351 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1656 | EXCEL.EXE | 209.197.3.8:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
1656 | EXCEL.EXE | 104.18.32.68:80 | ocsp.comodoca.com | Cloudflare Inc | US | suspicious |
1656 | EXCEL.EXE | 209.59.139.149:443 | oftalmocity.com | Liquid Web, L.L.C | US | suspicious |
Domain | IP | Reputation |
---|---|---|
oftalmocity.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |