Find similar analyses in TI Lookup
Analysis date (UTC): 28 November 2023, 05:09Analysis environment: Windows 7 Pro, build 7601, x86

research-1646684671.xls

MD5:B775CD8BE83696CA37B2FE00BCB40574
SHA1:60C8A9FDF2B24F8FB4913D4745A8557DF5FF8E07
SHA256:1DF68D55968BB9D2DB4D0D18155188A03A442850FF543C8595166AC6987DF820

Analysis result

Threat level:Malicious activity
Tags:
macros40
Full analysis:Analysis research-1646684671.xls (MD5: B775CD8BE83696CA37B2FE00BCB40574) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Calls Win API functions (MACROS)

  • EXCEL.EXE (PID: 2936)

Unusual execution from MS Office

  • EXCEL.EXE (PID: 2936)

Connection from MS Office application

  • EXCEL.EXE (PID: 2936)

Registers / Runs the DLL via REGSVR32.EXE

  • EXCEL.EXE (PID: 2936)

SUSPICIOUS

No suspicious indicators.

INFO

Reads the computer name

  • wmpnscfg.exe (PID: 3592)

Checks supported languages

  • wmpnscfg.exe (PID: 3592)

Reads the machine GUID from the registry

  • wmpnscfg.exe (PID: 3592)

Manual execution by a user

  • wmpnscfg.exe (PID: 3592)

Threats

No threats detected

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED