File name: | 2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.zip |
Full analysis: | https://app.any.run/tasks/828b37f2-4ebf-445d-85b7-e0cec66bbebc |
Verdict: | Malicious activity |
Analysis date: | May 30, 2020, 11:37:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 245C082DA4CAA14E563A364589776BAB |
SHA1: | F7C2408A6E86C5C7A15BBD8B654140B46CDC2FEC |
SHA256: | 2EF17221BB393841D7E78D6F5D64FA161DC95038157CEE4B40F10498499D36B7 |
SSDEEP: | 1536:2kJ3bFGjqSF+Al8WYjR8jqqWI2csQU9fVeiio0xJDAQciVbgGOtOsZ1ahovdsJNW:2+rFk0o8WDtGQaVei30xBa3tJZcadUud |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0003 |
ZipCompression: | Unknown (99) |
ZipModifyDate: | 2020:05:30 11:34:08 |
ZipCRC: | 0x5e69178c |
ZipCompressedSize: | 94642 |
ZipUncompressedSize: | 219648 |
ZipFileName: | 2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.xlsx |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2448 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
1476 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2060 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2824 | "C:\Windows\system32\reg.exe" EXPORT HKCU\Software\Microsoft\Office\14.0\Excel\Security C:\Users\Public\BHnxRi.reg /y | C:\Windows\system32\reg.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2404 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1476 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR34D0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1476 | EXCEL.EXE | C:\Users\admin\Desktop\~$2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.xlsx | — | |
MD5:— | SHA256:— | |||
2060 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR982E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2824 | reg.exe | C:\Users\admin\AppData\Local\Temp\REG9E58.tmp | — | |
MD5:— | SHA256:— | |||
2060 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF5D660519D7617149.TMP | — | |
MD5:— | SHA256:— | |||
2404 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR39AD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2060 | EXCEL.EXE | C:\Users\admin\Desktop\2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.xls | document | |
MD5:39CAF9E45C903D78832BB75C941C2CAE | SHA256:9178F019E6C219AB86EEDF20314D53DE37BE4C840C419A53BBC9831FB79A7C2D | |||
2060 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:3C4CB919DC19765582B64DCC0728A13E | SHA256:3CD811E3318A1AEDA72B03C90548671261ED2A95B323FBFE1229BFD3A1785705 | |||
2060 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.xls.LNK | lnk | |
MD5:35A8130E7975E53F99C0E352AB6C043A | SHA256:DFE529F318065E04D6394E5D9BC25CD682CA3348A46D246AD67E18AB0F67CFF7 | |||
2448 | WinRAR.exe | C:\Users\admin\Desktop\2087072711881a088bdbb1c6c669f3221a09b8ca0e681e7957eb9e980cc4cd5f.xlsx | document | |
MD5:F6BD17A313A73D70672EFA852D84C5C1 | SHA256:2087072711881A088BDBB1C6C669F3221A09B8CA0E681E7957EB9E980CC4CD5F |