analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Quotation.xlsx

Full analysis: https://app.any.run/tasks/baecc5ca-65a0-43ea-93b8-d885d6f7f777
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: July 17, 2019, 09:05:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
exploit
CVE-2017-11882
loader
evasion
trojan
rat
agenttesla
keylogger
stealer
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

03507B58DC5AE0AD0FF224EA997B1E2A

SHA1:

E55E6B608A9E82173A5F324F91720B6FBC4F3E55

SHA256:

1AEEFAA9E8682241E218999DBE8BFFF1FB98F9D9CD101810E0155D4EFD0E5354

SSDEEP:

3072:UDVCAo9pw4BylwYPUwNGRks5JWhlTeQqMG:UQr3wGy+Ys5cfEMG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 3120)
      • RegAsm.exe (PID: 2184)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3396)
    • Downloads executable files from IP

      • EQNEDT32.EXE (PID: 3396)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 3396)
    • AGENTTESLA was detected

      • RegAsm.exe (PID: 2184)
    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 2184)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 2184)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3396)
      • RegAsm.exe (PID: 2184)
    • Executed via COM

      • EQNEDT32.EXE (PID: 3396)
    • Creates files in the user directory

      • RegAsm.exe (PID: 2184)
    • Checks for external IP

      • RegAsm.exe (PID: 2184)
    • Uses REG.EXE to modify Windows registry

      • RegAsm.exe (PID: 2184)
  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe vbc.exe no specs #AGENTTESLA regasm.exe reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3432"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3396"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3120"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exeEQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2184"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3876REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\system32\REG.exeRegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
659
Read events
603
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3432EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRD05F.tmp.cvr
MD5:
SHA256:
2184RegAsm.exeC:\Users\admin\AppData\Local\Temp\636989547985202500_61e47f7d-5b2e-4158-be8c-f207a78b35cb.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
3396EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:274B7648377CF491C81D4789D201ECEE
SHA256:17AC3E76B5C9719D443B2D2923FE44740AD57DBED4CA0B837996B98915A87100
3396EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\qwertyjae[1].exeexecutable
MD5:274B7648377CF491C81D4789D201ECEE
SHA256:17AC3E76B5C9719D443B2D2923FE44740AD57DBED4CA0B837996B98915A87100
2184RegAsm.exeC:\Users\admin\AppData\Roaming\MyApp\MyApp.exeexecutable
MD5:278EDBD499374BF73621F8C1F969D894
SHA256:C6999B9F79932C3B4F1C461A69D9DC8DC301D6A155ABC33EFE1B6E9E4A038391
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3396
EQNEDT32.EXE
GET
200
23.249.164.162:80
http://23.249.164.162/qwertyjae.exe
US
executable
569 Kb
suspicious
2184
RegAsm.exe
GET
200
18.211.215.84:80
http://checkip.amazonaws.com/
US
text
16 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2184
RegAsm.exe
18.211.215.84:80
checkip.amazonaws.com
US
shared
3396
EQNEDT32.EXE
23.249.164.162:80
ColoCrossing
US
suspicious
192.185.41.47:587
mail.dormakeba.com
CyrusOne LLC
US
malicious

DNS requests

Domain
IP
Reputation
checkip.amazonaws.com
  • 18.211.215.84
  • 52.206.161.133
  • 34.233.102.38
  • 52.202.139.131
  • 34.197.157.64
  • 52.6.79.229
shared
mail.dormakeba.com
  • 192.185.41.47
suspicious

Threats

PID
Process
Class
Message
3396
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3396
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3396
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3396
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
3396
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2184
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2 ETPRO signatures available at the full report
No debug info