File name: | 15185e542a97e77e3d0bfe63575b097a39cc78b4ce1b9edd51ee5271f6caefa1.xls |
Full analysis: | https://app.any.run/tasks/3c497566-0639-45d9-8ef6-ba347c3072ac |
Verdict: | Malicious activity |
Analysis date: | March 15, 2019, 02:12:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: Victor, Last Saved By: Victor, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Oct 31 00:59:28 2016, Last Saved Time/Date: Mon Oct 31 01:08:38 2016, Security: 0 |
MD5: | DC0BF82BD435D808A31CFF0E3CC88A1E |
SHA1: | 9E603D5145AA226E0D50A25EC57B338CA26566F1 |
SHA256: | 15185E542A97E77E3D0BFE63575B097A39CC78B4CE1B9EDD51EE5271F6CAEFA1 |
SSDEEP: | 3072:o3dvxHlcaAy0iWYOcG4BDhnxD7oOEeZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAWWF:OdvxHlcaAy0iWYOcG4BDhnxD7oOEeZ+x |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 38 |
HeadingPairs: |
|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 12 |
Company: | Home |
CodePage: | Windows Cyrillic |
Security: | None |
ModifyDate: | 2016:10:31 01:08:38 |
CreateDate: | 2016:10:31 00:59:28 |
Software: | Microsoft Excel |
LastModifiedBy: | Victor |
Author: | Victor |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2712 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 Modules
| |||||||||||||||
3512 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\409129836.jse" | C:\Windows\System32\WScript.exe | EXCEL.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
|
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | 1,$ |
Value: 312C2400980A0000010000000000000000000000 | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: 980A0000BE82FF8ED4DAD40100000000 | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | 1,$ |
Value: 312C2400980A0000010000000000000000000000 | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2712) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\199717 |
Operation: | write | Name: | 199717 |
Value: 04000000980A00006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0031003500310038003500650035003400320061003900370065003700370065003300640030006200660065003600330035003700350062003000390037006100330039006300630037003800620034006300650031006200390065006400640035003100650065003500320037003100660036006300610065006600610031002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000F0ECD990D4DAD401179719001797190000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2712 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR9011.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2712 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\409129836.jse | text | |
MD5:89695C2B7FCCD67ADDB3A8A58F5BF23D | SHA256:4D029FC8908457AC63BB9D0C17D61276CF0E02C93F850AE243FCCF66040AA36B | |||
3512 | WScript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office_updater.jse | text | |
MD5:89695C2B7FCCD67ADDB3A8A58F5BF23D | SHA256:4D029FC8908457AC63BB9D0C17D61276CF0E02C93F850AE243FCCF66040AA36B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3512 | WScript.exe | 217.28.218.231:4433 | — | Telenet Ltd. | RU | unknown |