File name: | sample20200331-02.xls |
Full analysis: | https://app.any.run/tasks/7f77e15c-6704-4ee7-8ec8-a2c7042d47e1 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2020, 09:53:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-excel |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Feb 29 08:17:24 2020, Last Saved Time/Date: Sat Feb 29 08:18:02 2020, Security: 0 |
MD5: | AD7677318E9FF63FA0ACE3AB445D036F |
SHA1: | F8705B9F5FA84A9DF85320680B1430329664EABC |
SHA256: | F424B6EB3B855C89E4D2329115E1C43B8DA179D40750B7AEE1D192D700610331 |
SSDEEP: | 768:+hY+aZoMlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0L0QC5MC8F0K2YWdI:+hY+olYkEIbSkKBEqEXPgsRZmbaoFhZx |
.xls | | | Microsoft Excel sheet (78.9) |
---|
Author: | - |
---|---|
LastModifiedBy: | - |
Software: | Microsoft Excel |
CreateDate: | 2020:03:31 08:17:24 |
ModifyDate: | 2020:03:31 08:18:02 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | Foglio1 |
HeadingPairs: |
|
CompObjUserTypeLen: | 42 |
CompObjUserType: | (Foglio di lavoro di Microsoft Excel 2003 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2124 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.4756.1000 | ||||
2456 | powershell | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | EXCEL.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2156 | "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2124 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRD24C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2456 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LU7MK8HOXOAYUT30HUAC.temp | — | |
MD5:— | SHA256:— | |||
2156 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K1UN3CSQ8HD1BS8QCOLS.temp | — | |
MD5:— | SHA256:— | |||
2124 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFBEEAFA45340FCAAA.TMP | — | |
MD5:— | SHA256:— | |||
2124 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E2D7EC47.emf | emf | |
MD5:8C999313F446C66B867D728F5A79779E | SHA256:9A16976C701F6813B7A8D98761299F94E5ECA283636006616AEBBDD14393FE75 | |||
2124 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A00A499C.emf | emf | |
MD5:BF712F7CD122F15CB291365FCE01F9FC | SHA256:D058D04DC80FB2A3BC39CB1CFD6F4EF87A1A0027FE32FA0D2381A4C7CF5C1D66 | |||
2124 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\sample20200331-02.xls.LNK | lnk | |
MD5:9300B5D8D35B4F96CFEC900520D69F99 | SHA256:ADD9DBF7E1F0BAAE82337B27419FB8D31AF22D13CE51C04878A4D52E18E6D31F | |||
2456 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF12e42e.TMP | binary | |
MD5:4E6AD0ECE45F8A679C9EC44CBA8DF008 | SHA256:50D19BA8D1C732686F7AA1CBE1D10092FB18E222E88183EF9648069BEDBA45D2 | |||
2124 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:848F66496C68AE26C6DD763672A03971 | SHA256:839D71F4F3F2487CE5D3ED191BAD880537B5047FC45232D1618699F668277340 | |||
2456 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:4E6AD0ECE45F8A679C9EC44CBA8DF008 | SHA256:50D19BA8D1C732686F7AA1CBE1D10092FB18E222E88183EF9648069BEDBA45D2 |
Process | Message |
---|---|
powershell.exe |
*** Status Originated: -1073741811
*** Source File: d:\iso_whid\amd64fre\base\ntos\rtl\lblob.cpp, line 1020
|
powershell.exe |
*** Status propagated: -1073741811
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\identityauthority.cpp, line 147
|
powershell.exe |
*** Status Originated: -1073741811
*** Source File: d:\iso_whid\amd64fre\base\ntos\rtl\lblob.cpp, line 1020
|
powershell.exe |
*** Status propagated: -1073741811
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\identityauthority.cpp, line 147
|