File name: | details1910p.xls |
Full analysis: | https://app.any.run/tasks/f5fbc56b-28ef-4c43-b823-d13ae87a27fe |
Verdict: | Malicious activity |
Analysis date: | October 19, 2020, 21:54:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: UJdTKYiRR, Last Saved By: fckav, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Sep 14 22:28:14 2020, Last Saved Time/Date: Mon Oct 19 12:56:47 2020, Security: 1 |
MD5: | 81AE5B7E0425EF813F1876A287E3C19F |
SHA1: | AFEB5B8A3FCC28152889600C86374D31B3A1E21E |
SHA256: | E758B12EA734EE85058F8D42FC1DCE15F535BDA4DDFF3B424C92FA617622A675 |
SSDEEP: | 6144:WDuwQe5W9G2ylfROuStedGVK5wnoq1Yw194oGAYUIW4yyfsrH2:CQl42yPNStedIK5qoz7ohYUI5fKH2 |
.xls | | | Microsoft Excel sheet (78.9) |
---|
Author: | UJdTKYiRR |
---|---|
LastModifiedBy: | fckav |
Software: | Microsoft Excel |
CreateDate: | 2020:09:14 21:28:14 |
ModifyDate: | 2020:10:19 11:56:47 |
Security: | Password protected |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2508 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2760 | "C:\Windows\System32\rundll32.exe" C:\MChqqpu\RYfKXWm\YTvxeyE.dll,DllRegisterServer | C:\Windows\System32\rundll32.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2508 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR4192.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Cab8CD4.tmp | — | |
MD5:— | SHA256:— | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Tar8CD5.tmp | — | |
MD5:— | SHA256:— | |||
2760 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\tmp.txt | — | |
MD5:— | SHA256:— | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B5FE026684E25755B7DDA2B6DA04802E | binary | |
MD5:3FE6515C7897CF307CECDA08293CF385 | SHA256:66D112B5D2223F18A2974F79DED99254077AA72C6615741A42DBF71B03A24543 | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | der | |
MD5:AF315FA1A389D30310D95403D7DC486E | SHA256:E080E402317DE429DC4A761928298D49107D3D7CDCEDBB0BA06AA90CC214C501 | |||
2508 | EXCEL.EXE | C:\MChqqpu\RYfKXWm\YTvxeyE.dll | executable | |
MD5:A0478E894C26CFBED2D863B09415B500 | SHA256:2D16DBDBBF095CF07CBB0CA6F52B805FBF017B0C17ADDDCC97501AF0744A2249 | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | binary | |
MD5:09D6545483DB08EAED9579214FE12B7F | SHA256:82E4D593AECA016124A31E2A6C13C8AD55577FDE12A6F6D435D9185CE2047E5A | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\xlsp[1].c1 | executable | |
MD5:A0478E894C26CFBED2D863B09415B500 | SHA256:2D16DBDBBF095CF07CBB0CA6F52B805FBF017B0C17ADDDCC97501AF0744A2249 | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B5FE026684E25755B7DDA2B6DA04802E | der | |
MD5:30A2303CF6492C340ABF12D13240223C | SHA256:BBEF6CCDE016E5D4ED274395B4A5A76AB86DE3617E937C68197C342B8E9E0C46 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2508 | EXCEL.EXE | GET | 200 | 2.16.186.11:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | unknown | der | 1.37 Kb | whitelisted |
2508 | EXCEL.EXE | GET | 200 | 2.16.186.27:80 | http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgP%2FwJM4%2B%2BW8XmaTs%2B1dnHZ4sQ%3D%3D | unknown | der | 527 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2508 | EXCEL.EXE | 2.16.186.11:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | — | whitelisted |
— | — | 2.16.186.27:80 | ocsp.int-x3.letsencrypt.org | Akamai International B.V. | — | whitelisted |
2508 | EXCEL.EXE | 8.208.102.117:443 | donwloadfiles.top | Level 3 Communications, Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
donwloadfiles.top |
| suspicious |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |