File name: | b6bebd19b6eb622dccd099cbbb044d34b03e893845fb24c310ef737a0b5a2d91.xlsm |
Full analysis: | https://app.any.run/tasks/d861f796-e4f7-4974-9452-033bef7eca92 |
Verdict: | Malicious activity |
Analysis date: | August 26, 2019, 01:55:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 13BCD10F9EC9A048DE53EEC3924817A4 |
SHA1: | 976D35441A709BEB92B07CB3C9328D94765196FC |
SHA256: | B6BEBD19B6EB622DCCD099CBBB044D34B03E893845FB24C310EF737A0B5A2D91 |
SSDEEP: | 24576:Od9vBWjZbrqXKr+sfNd1DVx9JsqiG7oZppiOM7GAjRfIbF3/e+lvNt+7U3yW:6Z4beXRs1LRxfZ8hT8GF/e+3tgU3yW |
.xlam | | | Excel Macro-enabled Open XML add-in (42.4) |
---|---|---|
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (29.2) |
.xlsx | | | Excel Microsoft Office Open XML Format document (17.3) |
.zip | | | Open Packaging Conventions container (8.9) |
.zip | | | ZIP compressed archive (2) |
AppVersion: | 14.03 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2019:06:24 17:55:39Z |
CreateDate: | 2015:01:15 16:55:01Z |
LastModifiedBy: | Usuário do Windows |
Creator: | RPC1 |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2012 |
ZipCompressedSize: | 483 |
ZipCRC: | 0x3adb5d4e |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2752 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2120 | cmd.exe /c C:\Users\admin\AppData\Local\Temp\~$cache1.exe | C:\Windows\system32\cmd.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | nl! |
Value: 6E6C2100C00A0000010000000000000000000000 | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: C00A00005CB94F66B15BD50100000000 | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | nl! |
Value: 6E6C2100C00A0000010000000000000000000000 | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2752) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\168C19 |
Operation: | write | Name: | 168C19 |
Value: 04000000C00A00006700000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0062003600620065006200640031003900620036006500620036003200320064006300630064003000390039006300620062006200300034003400640033003400620030003300650038003900330038003400350066006200320034006300330031003000650066003700330037006100300062003500610032006400390031002E0078006C0073006D00000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000004D2667B15BD501198C1600198C160000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2752 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR886E.tmp.cvr | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2752 | EXCEL.EXE | GET | — | 140.82.59.108:80 | http://140.82.59.108/client | US | — | — | suspicious |
2752 | EXCEL.EXE | GET | 301 | 69.197.18.176:80 | http://xfl.mooo.com/ | US | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2752 | EXCEL.EXE | 69.197.18.176:80 | xfl.mooo.com | Staminus Communications | US | suspicious |
2752 | EXCEL.EXE | 140.82.59.108:80 | — | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
xfl.mooo.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com |
2752 | EXCEL.EXE | Potentially Bad Traffic | ET INFO DYNAMIC_DNS HTTP Request to Abused Domain *.mooo.com |