File name:

2d26a4db7b6710d4ed76eae360da599f2b166c78c8c6cb34cd4e587382149ae0

Full analysis: https://app.any.run/tasks/b3e01c22-4612-4654-9237-069ccf279ce4
Verdict: Malicious activity
Analysis date: November 07, 2024, 21:20:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Posik, Last Saved By: HRdtjnd, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Sun Mar 27 18:53:40 2022, Security: 0
MD5:

DA9B7F78B078602B4C4683B090707387

SHA1:

38BB0535E87FCED260924CC5A3EDAF43074021AE

SHA256:

2D26A4DB7B6710D4ED76EAE360DA599F2B166C78C8C6CB34CD4E587382149AE0

SSDEEP:

1536:7YX04P/zLmZWgHHHHHHHHHHHHHHHHHHHHHHHeCprvO:E0QH6WgHHHHHHHHHHHHHHHHHHHHHHHed

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 6828)

    • Unusual execution from MS Office

      • EXCEL.EXE (PID: 6828)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: Posik
LastModifiedBy: HRdtjnd
Software: Microsoft Excel
CreateDate: 2015:06:05 18:19:34
ModifyDate: 2022:03:27 18:53:40
Security: None
CodePage: Windows Cyrillic
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet
  • Rvfs1
  • Rvfs2
  • Rvfs3
  • PFEV
  • С1
  • С2
HeadingPairs:
  • Листы
  • 4
  • Макросы Excel 4.0
  • 3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe regsvr32.exe no specs splwow64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1792C:\Windows\SysWow64\regsvr32.exe -s ..\adw.dllC:\Windows\SysWOW64\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6216C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6828"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" C:\Users\admin\Desktop\2d26a4db7b6710d4ed76eae360da599f2b166c78c8c6cb34cd4e587382149ae0.xlsC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\combase.dll
Total events
9 774
Read events
9 531
Write events
223
Delete events
20

Modification events

(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\6828
Operation:writeName:0
Value:
0B0E104EEB136A69A7FE4DA030B075163DE5C6230046D2C2E4E4AEABCCED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511AC35D2120965007800630065006C002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(6828) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
0
Suspicious files
9
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
6828EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\2d26a4db7b6710d4ed76eae360da599f2b166c78c8c6cb34cd4e587382149ae0.xls.LNKlnk
MD5:D640192350D15DDDC64444EA31C1C9E8
SHA256:F4ACEA549DE1A48CD59956A11603B0005DE401A40F7F14E718FEE634F1D1806E
6828EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:2035A225FE87E8C3BA12ABC4776D6630
SHA256:10AD21EF2AA94997DDA9C8A794FF54358A1A935D4F5626A75D72AA790E54ABCD
6828EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:391C6643855FBEE3F4E2277B4E76DF54
SHA256:02BDE3FCF14BCA3010B2FCF66D796A44F1A685C0885B29032E572B64AC5A5D8B
6828EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\gADHL9UXSFUTN[1].htmtext
MD5:98F4A2FC2ED62A2D58DFD8665525BDF6
SHA256:3C1A63B59C237D3BB143E42EB9D309BE15312FF604C51BC8AB1FDD1C4B3E08FE
6828EXCEL.EXEC:\Users\admin\adw.dlltext
MD5:98F4A2FC2ED62A2D58DFD8665525BDF6
SHA256:3C1A63B59C237D3BB143E42EB9D309BE15312FF604C51BC8AB1FDD1C4B3E08FE
6828EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:F89D0C193998FB6ED0A69C1789708DF7
SHA256:FD5E19B54428CCE9B9AE9E09220401ADCEC4798FDCEBE1827C26D16D26D34FC4
6828EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ACB30EEF-1587-45C2-86A8-84FA63629109xml
MD5:D10D20CC2495EC238480B3DCA1620A04
SHA256:F7F490427341D3CEA04CE5DD2357251550CCF2CE63ED1427D8E6962AA44B08BD
6828EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:2EECBBCCBD2062A98F15F6F097251E46
SHA256:C59DA07FBE767E7F65404D5E4BEDDDF79F394F155A94562AC60E5A23D146252F
6828EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\436TCM1ZIVX7NQ6B3Y17.tempbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
6828EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-msbinary
MD5:E4A1661C2C886EBB688DEC494532431C
SHA256:B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
34
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
184.30.24.41:443
https://uci.cdn.office.net/mirrored/smartlookup/current/version.json
unknown
—
—
—
6944
svchost.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6320
RUXIMICS.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6320
RUXIMICS.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6828
EXCEL.EXE
GET
404
151.236.62.132:80
http://church.ktc-center.net/PbSkdCOW/
unknown
—
—
malicious
—
—
GET
200
52.109.28.46:443
https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3
unknown
xml
176 Kb
whitelisted
—
—
GET
200
184.30.24.41:443
https://uci.cdn.office.net/mirrored/smartlookup/current/main_ssr.html
unknown
html
396 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6320
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.204.158:443
—
Akamai International B.V.
DE
unknown
6320
RUXIMICS.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6320
RUXIMICS.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.32.238.34
  • 2.19.198.194
whitelisted
www.microsoft.com
  • 23.37.237.227
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
church.ktc-center.net
  • 151.236.62.132
malicious
chobemaster.com
  • 103.215.139.89
unknown
christianchapman.com
  • 54.85.251.137
malicious
messaging.lifecycle.office.com
  • 52.111.236.7
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2d26a4db7b6710d4ed76eae360da599f2b166c78c8c6cb34cd4e587382149ae0