analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

research-1646684671.xls

Full analysis: https://app.any.run/tasks/c4210bc2-1ada-411f-a98f-040ac7f3a6f6
Verdict: Suspicious activity
Analysis date: January 15, 2022, 22:23:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros40
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Last Saved By: Amanda, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Sun Jun 13 10:24:55 2021, Security: 0
MD5:

B775CD8BE83696CA37B2FE00BCB40574

SHA1:

60C8A9FDF2B24F8FB4913D4745A8557DF5FF8E07

SHA256:

1DF68D55968BB9D2DB4D0D18155188A03A442850FF543C8595166AC6987DF820

SSDEEP:

6144:Hknl9oBdySAx76F6XeyTVtW/9Ny9ABnl5/PBgxOHjuM9Mn:jl5/WxIji

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 1988)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 1988)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • regsvr32.exe (PID: 2744)
      • regsvr32.exe (PID: 1696)
      • EXCEL.EXE (PID: 1988)

    • Reads the computer name

      • EXCEL.EXE (PID: 1988)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 1988)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 1988)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: -
LastModifiedBy: Amanda
Software: Microsoft Excel
CreateDate: 2015:06:05 18:17:20
ModifyDate: 2021:06:13 09:24:55
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
ScaleCrop: No
LinksUpToDate: No
TitleOfParts:
  • Doc1
  • Doc2
  • Doc3
  • Doc4
HeadingPairs:
  • Worksheets
  • 1
  • Excel 4.0 Macros
  • 3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1988"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2744regsvr32 -s ..\iroto.dllC:\Windows\system32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1696regsvr32 -s ..\iroto1.dllC:\Windows\system32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
5 860
Read events
5 782
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
1988EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRE468.tmp.cvr —
MD5:—
SHA256:—
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:54E9306F95F32E50CCD58AF19753D929
SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D050A5DEFFE6693AC415A8090B3CB9Cder
MD5:FB47B6EDF55AA9E8663F4703E3DA6F92
SHA256:48476947856C448A21AE996748AF19EA861AA7A25C780D15BEC97123DFC20404
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D050A5DEFFE6693AC415A8090B3CB9Cbinary
MD5:18B5069AF523C5257E6A88AFECF9E0F9
SHA256:1B5C60B26B6A8AD7690D23F5F87EF7024C653877FE9E0721DE2316A69BAC9ABF
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:677E8ECA067CA559712C20745B1D7955
SHA256:14F84BC1C7D166196C5FFBE3DC070236BDE9A412D5A24F1B8A0B6190BD209557
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:C332A4116D04B24AB5AC94941A565FF7
SHA256:CC9654A921D591DF5EC9605B38B396C34B26FA237C6C66A7C6A70CF28A5260BD
1988EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\suspendedpage[1].htmhtml
MD5:1842EED13FDDC700A50ADADA08A0F84D
SHA256:47AC9EEF48022403111F9CEF6871AF594079ACDD88DA83E7D2B2A92FA47F7368
1988EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1988EXCEL.EXEC:\Users\admin\iroto1.dllhtml
MD5:1842EED13FDDC700A50ADADA08A0F84D
SHA256:47AC9EEF48022403111F9CEF6871AF594079ACDD88DA83E7D2B2A92FA47F7368
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1988
EXCEL.EXE
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
1988
EXCEL.EXE
GET
200
95.101.89.75:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSTEyvN51KAbxDQ9iQfKIWreQ%3D%3D
unknown
der
503 b
shared
1988
EXCEL.EXE
GET
200
2.16.186.56:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cb926953e41013fd
unknown
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1988
EXCEL.EXE
188.213.19.81:443
nws.visionconsulting.ro
Voxility S.R.L.
RO
suspicious
1988
EXCEL.EXE
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
—
—
95.101.89.75:80
r3.o.lencr.org
Akamai International B.V.
—
unknown
1988
EXCEL.EXE
2.16.186.56:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
1988
EXCEL.EXE
192.232.219.67:443
royalpalm.sparkblue.lk
Unified Layer
US
malicious

DNS requests

Domain
IP
Reputation
nws.visionconsulting.ro
  • 188.213.19.81
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared
royalpalm.sparkblue.lk
  • 192.232.219.67
suspicious
ctldl.windowsupdate.com
  • 2.16.186.56
  • 2.16.186.81
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 95.101.89.75
  • 95.101.89.74
  • 92.123.195.105
  • 92.123.195.106
  • 92.123.195.98
  • 92.123.195.83
  • 92.123.195.115
  • 92.123.195.113
  • 92.123.195.91
  • 92.123.195.116
  • 92.123.195.100
shared

Threats

PID
Process
Class
Message
1988
EXCEL.EXE
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
research-1646684671.xls