File name: | details1910p.xls |
Full analysis: | https://app.any.run/tasks/e127546e-bc7a-4ba8-a610-4adbb5bb8505 |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 01:21:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: UJdTKYiRR, Last Saved By: fckav, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Sep 14 22:28:14 2020, Last Saved Time/Date: Mon Oct 19 12:56:47 2020, Security: 1 |
MD5: | 81AE5B7E0425EF813F1876A287E3C19F |
SHA1: | AFEB5B8A3FCC28152889600C86374D31B3A1E21E |
SHA256: | E758B12EA734EE85058F8D42FC1DCE15F535BDA4DDFF3B424C92FA617622A675 |
SSDEEP: | 6144:WDuwQe5W9G2ylfROuStedGVK5wnoq1Yw194oGAYUIW4yyfsrH2:CQl42yPNStedIK5qoz7ohYUI5fKH2 |
.xls | | | Microsoft Excel sheet (78.9) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: |
|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | Password protected |
ModifyDate: | 2020:10:19 11:56:47 |
CreateDate: | 2020:09:14 21:28:14 |
Software: | Microsoft Excel |
LastModifiedBy: | fckav |
Author: | UJdTKYiRR |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2524 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3368 | "C:\Windows\System32\rundll32.exe" C:\MChqqpu\RYfKXWm\YTvxeyE.dll,DllRegisterServer | C:\Windows\System32\rundll32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2524 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR3E75.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Cab6F5A.tmp | — | |
MD5:— | SHA256:— | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Tar6F5B.tmp | — | |
MD5:— | SHA256:— | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | der | |
MD5:AF315FA1A389D30310D95403D7DC486E | SHA256:E080E402317DE429DC4A761928298D49107D3D7CDCEDBB0BA06AA90CC214C501 | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\xlsp[1].c1 | executable | |
MD5:B8501381C88EFE1D4C5DE2D805EBA1F3 | SHA256:DA02F4B04F198DA2850C182B95B7776FD40DD3ACA7C03672741EAC1091488126 | |||
2524 | EXCEL.EXE | C:\MChqqpu\RYfKXWm\YTvxeyE.dll | executable | |
MD5:B8501381C88EFE1D4C5DE2D805EBA1F3 | SHA256:DA02F4B04F198DA2850C182B95B7776FD40DD3ACA7C03672741EAC1091488126 | |||
3368 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\tmp.txt | binary | |
MD5:6088418801E87B8B50DDD4054CE8C1CF | SHA256:37968DBF425EDD44A8B99DE125BEF696C354FFE27FCAF6C1FE5220044102BE0C | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B5FE026684E25755B7DDA2B6DA04802E | der | |
MD5:30A2303CF6492C340ABF12D13240223C | SHA256:BBEF6CCDE016E5D4ED274395B4A5A76AB86DE3617E937C68197C342B8E9E0C46 | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | binary | |
MD5:139629D823C7180DC90603124B354FEE | SHA256:86B00C3BA5DAE3C147A2D814BEEF2D7BC71A0A3D8FBA59D8CC9F66B425767CC8 | |||
2524 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B5FE026684E25755B7DDA2B6DA04802E | binary | |
MD5:46A8333842BF7F9FEE49B5892D3BE1C0 | SHA256:AF4C3E31A4262C9F8ECC357020689F0241B4A9CE33226A358CC2CA71D694C0FE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2524 | EXCEL.EXE | GET | 200 | 2.16.186.35:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | unknown | der | 1.37 Kb | whitelisted |
2524 | EXCEL.EXE | GET | 200 | 2.16.186.11:80 | http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgP%2FwJM4%2B%2BW8XmaTs%2B1dnHZ4sQ%3D%3D | unknown | der | 527 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 2.16.186.11:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | — | whitelisted |
— | — | 2.16.186.35:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | — | whitelisted |
2524 | EXCEL.EXE | 8.208.102.117:443 | donwloadfiles.top | Level 3 Communications, Inc. | US | unknown |
— | — | 45.128.207.226:443 | fqnceas.su | — | — | unknown |
Domain | IP | Reputation |
---|---|---|
donwloadfiles.top |
| suspicious |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
fqnceas.su |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET DNS Query for .su TLD (Soviet Union) Often Malware Related |