We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
9 April 2024, 17:33
Analysis environment:
Windows 7 Pro, build 7601, x86
304416985693-107-0_attach.1.F.DOC.2019 A 720 SPA.xls
MD5:
0CDA12FA42EBAEEB9A4718B753912BD5
SHA1:
7E84A6FA7C0A290E1D52A74600901C53F8AD5C99
SHA256:
3849381059D9E8BBCC59C253D2CBE1C92F7E1F1992B752D396E349892F2BB0E7
Analysis result
Threat level:
Malicious activity
Tags:
macros
macros-on-open
Full analysis:
Analysis 304416985693-107-0_attach.1.F.DOC.2019 A 720 SPA.xls (MD5: 0CDA12FA42EBAEEB9A4718B753912BD5) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes powershell execution policy (Bypass)
cmd.exe (PID: 2760)
cmd.exe (PID: 3292)
Bypass execution policy to execute commands
powershell.exe (PID: 2020)
powershell.exe (PID: 3132)
Run PowerShell with an invisible window
powershell.exe (PID: 2020)
powershell.exe (PID: 3132)
Starts CMD.EXE for commands execution
EXCEL.EXE (PID: 1784)
Unusual execution from MS Office
EXCEL.EXE (PID: 1784)
Microsoft Office executes commands via PowerShell or Cmd
EXCEL.EXE (PID: 1784)
SUSPICIOUS
Non-standard symbols in registry
EXCEL.EXE (PID: 1808)
EXCEL.EXE (PID: 1696)
EXCEL.EXE (PID: 3068)
EXCEL.EXE (PID: 2240)
EXCEL.EXE (PID: 1784)
Runs shell command (SCRIPT)
EXCEL.EXE (PID: 1784)
Starts POWERSHELL.EXE for commands execution
cmd.exe (PID: 2760)
cmd.exe (PID: 3292)
The process bypasses the loading of PowerShell profile settings
cmd.exe (PID: 2760)
cmd.exe (PID: 3292)
The process hide an interactive prompt from the user
cmd.exe (PID: 2760)
cmd.exe (PID: 3292)
Uses RUNDLL32.EXE to load library
rundll32.exe (PID: 2096)
Reads the Internet Settings
rundll32.exe (PID: 2096)
Application launched itself
rundll32.exe (PID: 2096)
INFO
Manual execution by a user
EXCEL.EXE (PID: 2240)
control.exe (PID: 1928)
EXCEL.EXE (PID: 3068)
EXCEL.EXE (PID: 1808)
rundll32.exe (PID: 1976)
rundll32.exe (PID: 2096)
rundll32.exe (PID: 2324)
EXCEL.EXE (PID: 1784)
Script raised an exception (POWERSHELL)
powershell.exe (PID: 2020)
powershell.exe (PID: 3132)
Checks current location (POWERSHELL)
powershell.exe (PID: 2020)
powershell.exe (PID: 3132)
Reads security settings of Internet Explorer
rundll32.exe (PID: 2096)
Threats
No threats detected