analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PTJ3315MIC Sky Pending.xlsx

Full analysis: https://app.any.run/tasks/3bad568e-8731-43c8-a26d-2f45175a7322
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: June 19, 2019, 05:27:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
exploit
CVE-2017-11882
rat
nanocore
trojan
stealer
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

9373E9A023AD342D124C53C3B8FA531F

SHA1:

043494526A0059C47BB3EDA24C33C9791AE36563

SHA256:

2104BEC2CEC495DC006773FFEB5CCD1E058D0DB5B3DC326542C8691AD1101934

SSDEEP:

1536:+vaVVUzTxzgPKMegwxxhQYN/kzvVqj7q0SRlLcRCEIyN1yMrzbJH4NXKsyv/rDCo:+mUfmPzegwxx6TzvVqjeLRuZIM8slYa7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3692)
      • svchost.exe (PID: 3276)
    • NanoCore was detected

      • RegAsm.exe (PID: 3692)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3364)
    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3692)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3876)
    • Stealing of credential data

      • vbc.exe (PID: 3876)
      • vbc.exe (PID: 796)
    • Connects to CnC server

      • RegAsm.exe (PID: 3692)
  • SUSPICIOUS

    • Creates executable files which already exist in Windows

      • EQNEDT32.EXE (PID: 3364)
    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 3692)
      • EQNEDT32.EXE (PID: 3364)
    • Executed via COM

      • EQNEDT32.EXE (PID: 3364)
    • Creates files in the user directory

      • RegAsm.exe (PID: 3692)
      • EQNEDT32.EXE (PID: 3364)
    • Executes scripts

      • RegAsm.exe (PID: 3692)
    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 796)
  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2840)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe svchost.exe no specs #NANOCORE regasm.exe vbc.exe vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
2840"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3364"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3276"C:\Users\Public\svchost.exe" C:\Users\Public\svchost.exeEQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3692"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3876"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\btmj55vx.4ti"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
796"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\gv3ey2b0.wd4"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
543
Read events
486
Write events
50
Delete events
7

Modification events

(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:$!=
Value:
24213D00180B0000010000000000000000000000
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
180B0000346402A95F26D50100000000
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:$!=
Value:
24213D00180B0000010000000000000000000000
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2840) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\12144C
Operation:writeName:12144C
Value:
04000000180B00003200000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00500054004A0033003300310035004D0049004300200053006B0079002000500065006E00640069006E0067002E0078006C0073007800000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000000685EAA5F26D5014C1412004C14120000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
3
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
2840EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRDA4.tmp.cvr
MD5:
SHA256:
3692RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:643EACADAC22CF46698563E2F8CA4B02
SHA256:0DA7EB05C22AA4865B10DE88FA468C50B18B91402A04D94C6E7556EB724EBDCB
3364EQNEDT32.EXEC:\Users\Public\svchost.exeexecutable
MD5:BBDDEFFC4177BCA5F06394D76DE35624
SHA256:BBE076582474870FE64391F4A25B520BB652EBBEED75B4D1E3D91B8AEAD338A7
2840EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\PTJ3315MIC Sky Pending.xlsx.LNKlnk
MD5:06E2E18FB2001CAF19E085AD53267907
SHA256:08928DDC2B46A4BB4E0961EA011D6FB57E6356D1B6B25446543E23848BCD4895
3692RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:6CDD1560AA8C88E9F0B8FDE0BF675D0A
SHA256:E378541ABF9478EE9A875FB59C14EEBCDAA17F77F1F1C60A63BD46D85387732A
3364EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\new[1].exeexecutable
MD5:BBDDEFFC4177BCA5F06394D76DE35624
SHA256:BBE076582474870FE64391F4A25B520BB652EBBEED75B4D1E3D91B8AEAD338A7
2840EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:097E77E587E4E03328D37FE4235EAAFD
SHA256:E191EE3EA0EC5EA3AD05203B6D05C5E88A305BE00B94221AC2D3A93750456DBA
3876vbc.exeC:\Users\admin\AppData\Local\Temp\btmj55vx.4tihtml
MD5:817B840A155D370843AA8330F0EBD11E
SHA256:E1E94EE4A2719216E7FD8787E02D7B0042CF736F88852774B3FB0F4C662D0C2A
3364EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3692RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3692
RegAsm.exe
8.8.8.8:53
Google Inc.
US
whitelisted
3692
RegAsm.exe
160.116.15.155:1122
nanoman.ddns.net
ZA
malicious
3364
EQNEDT32.EXE
5.77.60.176:443
prosec.co.tz
iomart Cloud Services Limited.
GB
suspicious

DNS requests

Domain
IP
Reputation
prosec.co.tz
  • 5.77.60.176
unknown
nanoman.ddns.net
  • 160.116.15.155
malicious

Threats

PID
Process
Class
Message
3692
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3692
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
71 ETPRO signatures available at the full report
No debug info