File name: | cc7d088cae58c196d5784ea248b4f33fc282a2c7bfe6ee05590a100024835288.xls |
Full analysis: | https://app.any.run/tasks/4480ace2-5ace-4fd7-9798-2b0d33580286 |
Verdict: | Malicious activity |
Analysis date: | March 21, 2019, 02:51:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | BF68648582529990EF7D909FF2A8C275 |
SHA1: | E1771498D3984A0A20EA33C0AE0DE055C76C5084 |
SHA256: | CC7D088CAE58C196D5784EA248B4F33FC282A2C7BFE6EE05590A100024835288 |
SSDEEP: | 3072:LDAkbFb15YByCEU2HHo0pVNZjcHyFRFunifMFFYMhnUJFyOKnIq2EsyPzWryTxL:ZFbDYrEUbkVNVcEFua+UJFpqleyTB |
.xlsm | | | Excel Microsoft Office Open XML Format document (with Macro) (50.8) |
---|---|---|
.xlsx | | | Excel Microsoft Office Open XML Format document (30) |
.zip | | | Open Packaging Conventions container (15.4) |
.zip | | | ZIP compressed archive (3.5) |
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | - |
ZipCompression: | None |
ZipModifyDate: | 2019:01:31 15:14:22 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | - |
ZipUncompressedSize: | - |
ZipFileName: | docProps/ |
Application: | Microsoft Macintosh Excel |
---|---|
DocSecurity: | None |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | CapBudgWS |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 16.03 |
Keywords: | - |
LastModifiedBy: | KB4 |
CreateDate: | 2000:11:15 22:33:24Z |
ModifyDate: | 2018:07:12 12:25:46Z |
Title: | - |
---|---|
Subject: | - |
Description: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1048 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3328 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
4068 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3328 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1048 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR8E4C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3328 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QL8OMSSX\XcmVnjaXBpZWd50X2lkPTHQzNTkyuOODcypOCZjYW1wYYWelnbl9ydW5faWQ9MTg4UMTU2MyZhY3Rpb249bWFjcm8mdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvZGFjZThhZWRhM2Uy[1].txt | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabACD1.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarACD2.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabACE2.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarACE3.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabADA0.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarADA1.tmp | — | |
MD5:— | SHA256:— | |||
4068 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:1417501742264145ABC8C240C62DDD3F | SHA256:9A6BC2157139583877453BD5EECE6ABBDBCAAD982788BDB39AA7B4495B96751E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1048 | EXCEL.EXE | GET | 200 | 34.224.141.60:80 | http://http.www.secure.kb4.io/XcmVUjaXBpZWo50X2lkPTOQzNTkywwODcydOCZjYW1wnYWrlnbl9ydW5faWQ9MTg4VMTU2MyZhY3Rpb249YXR0YWNobWVudA== | US | — | — | suspicious |
4068 | iexplore.exe | GET | 200 | 34.224.141.60:80 | http://http.www.secure.kb4.io/XcmVnjaXBpZWd50X2lkPTHQzNTkyuOODcypOCZjYW1wYYWelnbl9ydW5faWQ9MTg4UMTU2MyZhY3Rpb249bWFjcm8mdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvZGFjZThhZWRhM2Uy | US | html | 334 b | suspicious |
3328 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
4068 | iexplore.exe | GET | 200 | 52.85.221.146:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
4068 | iexplore.exe | GET | 200 | 205.185.216.42:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3328 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
4068 | iexplore.exe | 205.185.216.42:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
4068 | iexplore.exe | 3.91.113.251:443 | http.www.secure.kb4.io | — | US | suspicious |
1048 | EXCEL.EXE | 34.224.141.60:80 | http.www.secure.kb4.io | Amazon.com, Inc. | US | suspicious |
4068 | iexplore.exe | 34.224.141.60:80 | http.www.secure.kb4.io | Amazon.com, Inc. | US | suspicious |
4068 | iexplore.exe | 52.85.221.146:80 | x.ss2.us | Amazon.com, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
http.www.secure.kb4.io |
| suspicious |
www.bing.com |
| whitelisted |
secured-login.net |
| whitelisted |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |