analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ORDER_SHEET_SPEC.zip

Full analysis: https://app.any.run/tasks/37648ef1-2c47-42a4-8764-db2e7de27af4
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:45:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

93BF58D227852A25C0AD12750EBFEA86

SHA1:

BFAB6ABB9C7444FF31DBBCBA92FEE92DAAAA5679

SHA256:

22E8E4FB8B26AD737393013F09FDD97AAD5E7D69CB7D6A7154CA3C476B920E7C

SSDEEP:

1536:fPUnQ+SlGNawF+lG6xzDK4qyq+niREciATBkvJp2WEgcySKeGI/f:fPUnQlUawkE6BDK4qeiWc3BkX2bgcOeZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1872)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2628)
      • cMD.exe (PID: 2736)
      • EQNEDT32.EXE (PID: 1872)
      • cscript.exe (PID: 2584)
      • cmd.exe (PID: 3780)
      • wscript.exe (PID: 3840)
      • cscript.exe (PID: 1380)

    • Reads the computer name

      • WinRAR.exe (PID: 2628)
      • EQNEDT32.EXE (PID: 1872)
      • wscript.exe (PID: 3840)
      • cscript.exe (PID: 2584)
      • cscript.exe (PID: 1380)

    • Executed via COM

      • EQNEDT32.EXE (PID: 1872)

    • Creates files in the program directory

      • EXCEL.EXE (PID: 3984)

  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 3984)

    • Manual execution by user

      • EXCEL.EXE (PID: 3984)

    • Reads the computer name

      • EXCEL.EXE (PID: 3984)

    • Checks Windows Trust Settings

      • cscript.exe (PID: 2584)
      • wscript.exe (PID: 3840)
      • cscript.exe (PID: 1380)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ORDER SHEET & SPEC.xlsm
ZipUncompressedSize: 2793487
ZipCompressedSize: 69232
ZipCRC: 0x2bf8580d
ZipModifyDate: 2021:01:29 09:28:04
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs excel.exe no specs eqnedt32.exe cmd.exe no specs wscript.exe no specs cmd.exe no specs cscript.exe cscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
2628"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ORDER_SHEET_SPEC.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3984"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1872"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2736cMD /c REN %tmp%\q v& WSCrIpT %tmp%\v?..wsf  CC:\Windows\system32\cMD.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3840WSCrIpT C:\Users\admin\AppData\Local\Temp\v?..wsf  CC:\Windows\system32\wscript.exe—cMD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
3780"C:\Windows\System32\cmd.exe" /c cscript C:\Users\admin\AppData\Local\Temp\xx.vbsC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2584cscript C:\Users\admin\AppData\Local\Temp\xx.vbsC:\Windows\system32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cscript.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1380"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbsC:\Windows\System32\cscript.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
3 041
Read events
2 907
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
3984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR89F7.tmp.cvr —
MD5:—
SHA256:—
3984EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ORDER SHEET & SPEC.xlsm.LNKlnk
MD5:17DC43DBDD7FE6C030C54EE8D7EE4697
SHA256:80B86DBE9203E5212D7B1D42A084CD9A1DB57A616E1F63FD1FBC6CF0F9FBC708
2628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2628.20590\ORDER SHEET & SPEC.xlsmcompressed
MD5:7CCF88C0BBE3B29BF19D877C4596A8D4
SHA256:7BCD31BD41686C32663C7CABF42B18C50399E3B3B4533FC2FF002D9F2E058813
3984EXCEL.EXEC:\programdata\asc.txt:script1.vbstext
MD5:6196CE936B2131935E89615965438ED4
SHA256:2EAA9D08D7E29C99D616AACCC4728F120E1E9A14816FECAB17F388665A89B6E4
3984EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AEF61620.emfemf
MD5:1DA917FE3A7E876F3F711FE30E1F46DB
SHA256:4D4D1E7B04C99DCB8E885915068AD6F74CC2333E91580CDAE5CCAA00C427247F
2736cMD.exeC:\Users\admin\AppData\Local\Temp\vhtml
MD5:EF556C44786A88CDF0F705AC03D9099A
SHA256:6CE8F2114ACAC0CE2EED32D302A6A40185D3388CAA722B0724DA2AEBDEABEB3C
3984EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:153BB8139145D1DD4B9D7CDB12AF3A0B
SHA256:F11D812D79913B2FC4B702D5142E449C88BAFF49412CF47DBADD696A893CC9DE
3984EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5819ADDB.emfemf
MD5:B59DD20DE3FDC50CD6B3C4BAF9C12DE8
SHA256:979DDE2AED02F077C16AE53546C6DF9EED40E8386D6DB6FC36AEE9F966D2CB82
3984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\q:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\xx:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2584
cscript.exe
177.53.143.89:443
multiwaretecnologia.com.br
Brasil Site Informatica LTDA
BR
suspicious
1380
cscript.exe
177.53.143.89:443
multiwaretecnologia.com.br
Brasil Site Informatica LTDA
BR
suspicious

DNS requests

Domain
IP
Reputation
multiwaretecnologia.com.br
  • 177.53.143.89
suspicious

Threats

PID
Process
Class
Message
1380
cscript.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1380
cscript.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2584
cscript.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ORDER_SHEET_SPEC.zip