File name: | details_2909s.xls |
Full analysis: | https://app.any.run/tasks/ab342a76-8838-4a64-b826-28c1401ec270 |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 11:15:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: fVMakTTGsTpDRxQCGfU, Last Saved By: fckav, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Sep 14 22:28:14 2020, Last Saved Time/Date: Tue Sep 29 19:07:39 2020, Security: 1 |
MD5: | EC8FCB4756BC4C0AB2B9484991D5F94B |
SHA1: | 1204EEDA224C9E301A8F260EE4D9619FC61A54E2 |
SHA256: | D1FB5680D011C22DDADB72A81E6177708F0A21FC53A5FFE77CE760233E2C4006 |
SSDEEP: | 6144:P1H8RmO81u+O+J2MT79Sa866Zqcr7pn0vMrHENH/pEaWo:t4mZ1/OQ2ha86grd0vaHEN5 |
.xls | | | Microsoft Excel sheet (78.9) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | Password protected |
ModifyDate: | 2020:09:29 18:07:39 |
CreateDate: | 2020:09:14 21:28:14 |
Software: | Microsoft Excel |
LastModifiedBy: | fckav |
Author: | fVMakTTGsTpDRxQCGfU |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2132 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
252 | "C:\Windows\System32\rundll32.exe" C:\joZSZER\QgkmeET\sMHvbkl.dll,DllRegisterServer | C:\Windows\System32\rundll32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRAC00.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CabF167.tmp | — | |
MD5:— | SHA256:— | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\TarF168.tmp | — | |
MD5:— | SHA256:— | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | der | |
MD5:30142B9712DB3BF56074DDC675C257FD | SHA256:E097553550D5FC623C5EF334D0ED27BD29BEFEDD25927556D934364E56A22A69 | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC7F75C304F4CF0B7BB86860AECC9154 | der | |
MD5:17B542DE9B99BB50030543BDEA8E088C | SHA256:3DFF0BD30EC4C2F23A7B697C73512999EDD3238117BB48BEEE952158FC097AA6 | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\xls_s_2909.exe1[1].c1 | executable | |
MD5:E027C3F15DC0927595B0D334970498A5 | SHA256:635643795ACE3D11D9FCEE724A6489DEFF5FD488005EFE0FFE223B01C63109C6 | |||
2132 | EXCEL.EXE | C:\joZSZER\QgkmeET\sMHvbkl.dll | executable | |
MD5:E027C3F15DC0927595B0D334970498A5 | SHA256:635643795ACE3D11D9FCEE724A6489DEFF5FD488005EFE0FFE223B01C63109C6 | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | binary | |
MD5:FCC506BF3844D85A21FC1BC2E96FA3B9 | SHA256:41B6EA4DE49C83CC1AF125A56FAC87097F2057236729F5D433354DCE9F6FE336 | |||
2132 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC7F75C304F4CF0B7BB86860AECC9154 | binary | |
MD5:B36DE119771D40518AF1351D014A54C7 | SHA256:F6E254708B4FCA020B6FDBBDAE632A814B85AFF3C6CD3124FF521DE01451B6CB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.186.27:80 | http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMUCa%2Fbr4RVVQqyuCwvRqJ7cg%3D%3D | unknown | der | 527 b | whitelisted |
2132 | EXCEL.EXE | GET | 200 | 2.16.186.11:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | unknown | der | 1.37 Kb | whitelisted |
1052 | svchost.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
1052 | svchost.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7yTSbUNi7CXXtef0luXqk%3D | US | der | 279 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2132 | EXCEL.EXE | 2.16.186.11:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | — | whitelisted |
— | — | 2.16.186.27:80 | ocsp.int-x3.letsencrypt.org | Akamai International B.V. | — | whitelisted |
2132 | EXCEL.EXE | 47.254.26.204:443 | winsetup220.com | Alibaba (China) Technology Co., Ltd. | US | suspicious |
1052 | svchost.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
winsetup220.com |
| suspicious |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
ocsp.digicert.com |
| whitelisted |