File name: | fcdb074e87ffbb15e545865462c9f515b257b2bc.xlsx |
Full analysis: | https://app.any.run/tasks/43b8dcb6-f96c-4ed5-a3a5-690a899f1fb3 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 08:47:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | A65EF50A67A5303DAD3E24719343F682 |
SHA1: | FCDB074E87FFBB15E545865462C9F515B257B2BC |
SHA256: | 063DDF19C4AD94FD058FC714412290D991579B91BB79F667EED375D7181E5509 |
SSDEEP: | 3072:1cKPw3ea43Sn0CueMJd0BEikE6qsNIh2TiWpEc1v5HG0ML7Cg:15na5jsdoEDsgIhdWpVhHcz |
.xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (31.5) |
.zip | | | ZIP compressed archive (7.2) |
AppVersion: | 12 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2019:04:14 23:34:55Z |
CreateDate: | 2018:06:05 19:24:24Z |
LastModifiedBy: | FUJITSU |
Creator: | CYBORG_DE_VEGAS |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1506 |
ZipCompressedSize: | 421 |
ZipCRC: | 0x0b896950 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2904 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3996 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2132 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3996 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | }w> |
Value: 7D773E00580B0000010000000000000000000000 | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: 580B000036C123E567F3D40100000000 | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | }w> |
Value: 7D773E00580B0000010000000000000000000000 | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2904) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\12FFF4 |
Operation: | write | Name: | 12FFF4 |
Value: 04000000580B00004F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0066006300640062003000370034006500380037006600660062006200310035006500350034003500380036003500340036003200630039006600350031003500620032003500370062003200620063002E0078006C0073007800000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00010000000000000080F2F7E567F3D401F4FF1200F4FF120000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2904 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFBDD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2904 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF7E67A03016C31DB0.TMP | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFED8845486A901819.TMP | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF5C45378A4FA7C316.TMP | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF099A3B8D62CE421B.TMP | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{288109E2-5F5B-11E9-B3B3-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF890D308E68BE8C68.TMP | — | |
MD5:— | SHA256:— | |||
3996 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{288109E1-5F5B-11E9-B3B3-5254004A04AF}.dat | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2904 | EXCEL.EXE | GET | 200 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/k80iu2uwepz4kwedfz9vxc96.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | IE | html | 1.11 Kb | malicious |
2904 | EXCEL.EXE | GET | 302 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/ | IE | html | 253 b | malicious |
2904 | EXCEL.EXE | GET | 301 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z | IE | html | 253 b | malicious |
2132 | iexplore.exe | GET | 404 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/k80iu2uwepz4kwedfz9vxc96.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | IE | html | 367 b | malicious |
3996 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3996 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2904 | EXCEL.EXE | 34.245.92.45:80 | tyannmeans.info | Amazon.com, Inc. | IE | malicious |
2132 | iexplore.exe | 34.245.92.45:80 | tyannmeans.info | Amazon.com, Inc. | IE | malicious |
Domain | IP | Reputation |
---|---|---|
tyannmeans.info |
| malicious |
www.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2904 | EXCEL.EXE | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
2132 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |