File name: | Shqyrtimi i taksave 2019 03172_k2.xls |
Full analysis: | https://app.any.run/tasks/4244fa26-0ebf-4140-8315-5538c906e734 |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 18:21:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Tue Nov 19 14:58:31 2019, Last Saved Time/Date: Wed Nov 20 21:49:32 2019, Security: 0 |
MD5: | B1D34757594DC11A3FA9F917083C4358 |
SHA1: | 0726DA8B5DF0D79B1D9CF73AE7ED6361C7FC183D |
SHA256: | E537F6064E582602E4F1E64A6FDBCE2C7A6FD923D7B39D91BC3C1B5052340210 |
SSDEEP: | 1536:+fQzl3ZpWh+QO3uMdS9dSttRJwyE/4XZlLAr+cd5UG:+fQzl3ZpWh+QO3uMdS9dSttRJwyE/4XI |
.xls | | | Microsoft Excel sheet (78.9) |
---|
CreateDate: | 2019:11:19 14:58:31 |
---|---|
ModifyDate: | 2019:11:20 21:49:32 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2236 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2896 | "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1216 | C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Application Error Reporting Exit code: 0 Version: 14.0.6015.1000 | ||||
3032 | C:\Windows\system32\dwwin.exe -x -s 1216 | C:\Windows\system32\dwwin.exe | — | DW20.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Watson Client Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2236 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRE08C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2236 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF6BBC0FB4B13B0B1A.TMP | — | |
MD5:— | SHA256:— | |||
2236 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Shqyrtimi i taksave 2019 03172_k2.xls | document | |
MD5:8C37F324D179BC1BAD588F0E92580E43 | SHA256:9DC6EF3E8922FAE1F318714CEACC753408FD5786B9167CE42ED1404E82E3AF70 | |||
2236 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\3729421.cvr | sqm | |
MD5:BD619799CCD39E1BB117A308C74537BF | SHA256:9C177C8996C9659962838C316CD028A36056423CA94E06AF557D622AFB9C8A4C | |||
3032 | dwwin.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_EXCEL.EXE_12627ebc4a28c4f4366481728a4a1c645d5e7d0_0be10394\Report.wer | binary | |
MD5:90988F65AD7185F47330D5DED87530E6 | SHA256:1B543D43074C8E1ECFEDCFFE508EA4A123F6B01CF12EBF7C431EDD3199479A60 |