File name: | Report - 2022-06-21_0827.xls |
Full analysis: | https://app.any.run/tasks/9bc4cb3a-e844-43f2-9234-b33db341de95 |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 09:24:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: SRGHRSHSH, Last Saved By: RGSGK, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Tue Jun 21 11:58:42 2022, Security: 0 |
MD5: | BC801CEAE6B85B6CF378D1B3CE6961D1 |
SHA1: | F2442F1DC9F12220CE6F36E1D926D75308C76520 |
SHA256: | C0B609B0A994F32DFD5188AB8BA02E71B8ACD30C95C4573C6A5AEEBD4E6E01E5 |
SSDEEP: | 1536:9+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dghQvCCVQO:QKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgY |
.xls | | | Microsoft Excel sheet (78.9) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
Company: | - |
CodePage: | Windows Cyrillic |
Security: | None |
ModifyDate: | 2022:06:21 10:58:42 |
CreateDate: | 2015:06:05 18:19:34 |
Software: | Microsoft Excel |
LastModifiedBy: | RGSGK |
Author: | SRGHRSHSH |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2832 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2300 | C:\Windows\System32\regsvr32.exe /S ..\peg1.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3824 | C:\Windows\System32\regsvr32.exe /S ..\peg2.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2120 | C:\Windows\System32\regsvr32.exe /S ..\peg3.ocx | C:\Windows\System32\regsvr32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft(C) Register Server Exit code: 3 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2832 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR498E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2832 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\RCFQXQZ2.txt | text | |
MD5:4DA0D8325C5B6A325C92B824257A9FD6 | SHA256:FF06201C7970D4807A9BEA75F2F11C9FA15D0DBA407A7BCFC1A0AAA4ED3187AD | |||
2832 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | ini | |
MD5:76066E56C14D911CB57CB9B8F753D512 | SHA256:DCAD72F5D108ECCC8CBA3FC68F4735C6F28B9FA411E3E5C29B51A7C57E53B247 | |||
2832 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Report - 2022-06-21_0827.xls.LNK | lnk | |
MD5:0727F860A2D2706F4BF34281AA6C2D63 | SHA256:6AD739C0480F5A46C22BA60BA0A3C633087E773B0EBCBA5B7F773CDF6569FC19 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2832 | EXCEL.EXE | GET | — | 103.83.192.58:80 | http://www.eapro.in/wp-admin/sf2MppPW30cKaWeko/ | US | — | — | suspicious |
2832 | EXCEL.EXE | GET | 404 | 179.43.117.122:80 | http://www.campusconindigital.org/moodle_old/9giglHrg2t/ | AR | html | 196 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2832 | EXCEL.EXE | 5.9.8.16:443 | www.dnahealth.gr | Hetzner Online GmbH | DE | suspicious |
2832 | EXCEL.EXE | 148.163.122.52:443 | www.digitalkhulna.com | Input Output Flood LLC | US | suspicious |
2832 | EXCEL.EXE | 179.43.117.122:80 | www.campusconindigital.org | Dattatec.com | AR | suspicious |
— | — | 103.83.192.58:80 | www.eapro.in | LeapSwitch Networks Pvt Ltd | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.digitalkhulna.com |
| suspicious |
www.dnahealth.gr |
| suspicious |
www.campusconindigital.org |
| suspicious |
www.eapro.in |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2832 | EXCEL.EXE | Potentially Bad Traffic | ET INFO TLS Handshake Failure |