File name: | 9560d55b23a980c38b2218fc971dbc4cdd8dce391eb779b18fe2f46806bc30da.xls |
Full analysis: | https://app.any.run/tasks/3908cc7a-41d4-4792-89be-3f48da9aacf0 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 01:53:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 936, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Mar 20 03:21:22 2019, Security: 0 |
MD5: | F287F0F1647DC33EC5E503011C1D8E62 |
SHA1: | F2BA5D774E8758DA227090800A66B073917EAAD3 |
SHA256: | 9560D55B23A980C38B2218FC971DBC4CDD8DCE391EB779B18FE2F46806BC30DA |
SSDEEP: | 3072:1JVUpjDqF+wRj/eA05iisCs1DMKvc4uSb80rH8gqFo2jcc0lbxOsttJtXwXlW:XVUpjDqF+wRj/eA05iisCs1DMKvc4uSm |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2006:09:16 00:00:00 |
ModifyDate: | 2019:03:20 03:21:22 |
Security: | None |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CodePage: | Windows Simplified Chinese (PRC, Singapore) |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_Enabled: | |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_SiteId: | 21f195bc-13e5-4339-82ea-ef8b8ecdd0a9 |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_Ref: | https://api.informationprotection.azure.com/api/21f195bc-13e5-4339-82ea-ef8b8ecdd0a9 |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_SetBy: | [email protected] |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_SetDate: | 2018-01-03T09:46:59.8442254+08:00 |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_Name: | Internal |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_Application: | Microsoft Azure Information Protection |
MSIP_Label_f5210792-6e5f-4945-9946-e33b2c1b77aa_Extended_MSFT_Method: | Automatic |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Enabled: | |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_SiteId: | 21f195bc-13e5-4339-82ea-ef8b8ecdd0a9 |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Ref: | https://api.informationprotection.azure.com/api/21f195bc-13e5-4339-82ea-ef8b8ecdd0a9 |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_SetBy: | [email protected] |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_SetDate: | 2018-01-03T09:46:59.8598254+08:00 |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Name: | CFAA-INTERNAL |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Application: | Microsoft Azure Information Protection |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Extended_MSFT_Method: | Automatic |
MSIP_Label_e4c3274d-1fad-4ccc-865c-c627dd242d1d_Parent: | f5210792-6e5f-4945-9946-e33b2c1b77aa |
Sensitivity: | Internal CFAA-INTERNAL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
688 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2344 | C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS" | C:\Windows\system32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2200 | C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS" | C:\Windows\system32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2884 | C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS" | C:\Windows\system32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 267 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2304 | attrib -S -h "C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS" | C:\Windows\system32\attrib.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | ~{2 |
Value: 7E7B3200B0020000010000000000000000000000 | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: B002000072D68DE588DFD40100000000 | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | ~{2 |
Value: 7E7B3200B0020000010000000000000000000000 | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (688) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\F9216 |
Operation: | write | Name: | F9216 |
Value: 04000000B00200006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0039003500360030006400350035006200320033006100390038003000630033003800620032003200310038006600630039003700310064006200630034006300640064003800640063006500330039003100650062003700370039006200310038006600650032006600340036003800300036006200630033003000640061002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00010000000000000030AE4BE788DFD40116920F0016920F0000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
688 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR8B5E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
688 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\k4.xls | document | |
MD5:AAF2798965F061EFB88F5A55B86058C2 | SHA256:6E4597E3829B2646CA128AE3E100314C326ABF430B30562B61AA00EE4CD74ED2 |