File name: | 2b793e1f9769a09a8fdf0684d9d2aeb0c6504b08.xls |
Full analysis: | https://app.any.run/tasks/3278be9d-e5fe-476b-92e8-fedf8e852fa4 |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 14:07:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Sep 28 01:53:43 2020, Last Saved Time/Date: Wed Sep 30 10:40:20 2020, Security: 1 |
MD5: | C244DAEB9493A3802B68E99AD913DD29 |
SHA1: | 2B793E1F9769A09A8FDF0684D9D2AEB0C6504B08 |
SHA256: | 1D107DDC0BA1F3483B396FD60274AAA289C1AFA2E751893937A48CB541F4F515 |
SSDEEP: | 768:D7mjlXKIqMEHKmosiOjyL5y/T53L/D/aofm06l:D9IrRm6O2oT5L7/aoE |
.xls | | | Microsoft Excel sheet (78.9) |
---|
Title: | - |
---|---|
Author: | - |
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2020:09:28 00:53:43 |
ModifyDate: | 2020:09:30 09:40:20 |
Security: | Password protected |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3216 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
1868 | explorer.exe C:\Users\admin\AppData\Local\Temp\vYR.vbs | C:\Windows\explorer.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2168 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2068 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\vYR.vbs" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3216 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRA682.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3216 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFACE490B6DDBA2BB3.TMP | — | |
MD5:— | SHA256:— | |||
3216 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\2b793e1f9769a09a8fdf0684d9d2aeb0c6504b08.xls.LNK | lnk | |
MD5:1A3B64AD9428913CF2F09FFB9CFE0758 | SHA256:BD85784CCC6DE0851CA715D711797BCE2AF895E63620BC030F5C5007CB48D39E | |||
3216 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\vYR.vbs | text | |
MD5:7A593B6076CF4CD90B540B32049B591B | SHA256:A6E7C224A70A9AAF521CE45E3DA5DDB98D0C79BF18D248EE0D18AAA800213B63 | |||
3216 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:21D73612FD1B3C84DD7891AE867470B9 | SHA256:5F92E0F3304469040F1F0701AEDB0250740239905C5AECD4068AEA245055B5CA | |||
2068 | WScript.exe | C:\Users\admin\AppData\Local\Temp\dFf7aHp.txt | text | |
MD5:A5EA0AD9260B1550A14CC58D2C39B03D | SHA256:F1B2F662800122BED0FF255693DF89C4487FBDCF453D3524A42D4EC20C3D9C04 |