File name: | inv_7299.xls |
Full analysis: | https://app.any.run/tasks/e04437bc-37b9-4f35-a00b-1d579b624aed |
Verdict: | Malicious activity |
Analysis date: | November 30, 2020, 02:38:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: oEUdueQj, Last Saved By: Administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Nov 27 10:49:40 2020, Last Saved Time/Date: Fri Nov 27 10:49:41 2020, Security: 0 |
MD5: | B780DFF06AD6BB32A7AF38A71966FDF2 |
SHA1: | B248977B3E01A479A69BD7D5E10D5C205E4B9C03 |
SHA256: | 0FD30FF1B09E2284476A68AB03ABC61FD43CE9E22ED440C8B4649960B0A15DD8 |
SSDEEP: | 768:oPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ9E1wvxNpOigUaE:Eok3hbdlylKsgqopeJBWhZFGkE+cL2No |
.xls | | | Microsoft Excel sheet (78.9) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
ModifyDate: | 2020:11:27 10:49:41 |
CreateDate: | 2020:11:27 10:49:40 |
Software: | Microsoft Excel |
LastModifiedBy: | Administrator |
Author: | oEUdueQj |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2424 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2784 | "C:\Windows\system32\rundll32.exe" C:\Users\Public\Documents\k4CRlR9B.txt,DllRegisterServer | C:\Windows\system32\rundll32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2424 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRCAC9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CabD662.tmp | — | |
MD5:— | SHA256:— | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\TarD663.tmp | — | |
MD5:— | SHA256:— | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\UMECGQIC.txt | — | |
MD5:— | SHA256:— | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFBB9A71ACFF0625A3.TMP | — | |
MD5:— | SHA256:— | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\4Q78LUWN.txt | text | |
MD5:C5D367945EF51EA41C43189F0477FDC4 | SHA256:C49BFCEC4A5D226ACE52AC2D1402C1951E8608243C54B51CFFA9421CB013F289 | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_BB764F80BB15C11285C7965909FACD9D | der | |
MD5:DD5B6B2A616C589AF9F187BDCCEBC42D | SHA256:C37192A4265DAE0D40D0DD77FB4B781967C063E9E06966F00D670F5A93F64A3A | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B | binary | |
MD5:772ABF9FE54BF4971CA47C9041CED963 | SHA256:78EE5FABEFD7DD40DA7CE096D30F309D141E1DDDC579B5AE1244E2D234A1B424 | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:B056033C9B18F5BCC6A5CA40049207F5 | SHA256:E75B4B9CF9C7D2E71E97518DB42FCC2A34390E9DFCABDAB249790714B2F403B9 | |||
2424 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_00822B812F3071D0A5AB02FB7D4F1DF9 | binary | |
MD5:DBE856CD0C2AF7F318130622B55E0265 | SHA256:D086B6369461F17429ADC343DFC9B68C326CDA0AEEBECC2079010A309DB79D60 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2424 | EXCEL.EXE | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA0I3vrAGJM5UU%2BQSOJCQ3E%3D | US | der | 279 b | whitelisted |
2424 | EXCEL.EXE | GET | 200 | 172.217.16.163:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDliVAU%2F6ZWzwIAAAAAgFX%2B | US | der | 472 b | whitelisted |
2424 | EXCEL.EXE | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
2424 | EXCEL.EXE | GET | 200 | 172.217.16.163:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2424 | EXCEL.EXE | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2424 | EXCEL.EXE | 172.217.22.4:443 | www.google.com | Google Inc. | US | whitelisted |
2424 | EXCEL.EXE | 172.217.16.163:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2424 | EXCEL.EXE | 104.18.62.178:443 | rinoviral.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
rinoviral.com |
| unknown |
ocsp.digicert.com |
| whitelisted |
www.google.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |