analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Urgent Quotation-0021103211.xlsx

Full analysis: https://app.any.run/tasks/dee4046e-052e-4ed9-8080-96ab0b4f2ad0
Verdict: Malicious activity
Analysis date: May 24, 2019, 05:05:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

1280C41C289F32A91783FF8BE5697BEF

SHA1:

48A0850819EA78C26BC85907A2DD0E723210EB16

SHA256:

3C557F9F373F47F65B7CCB859C0996709E5C3142F48B30DF8A1C4DD1D37E5D7F

SSDEEP:

384:I45lAxBP+FgylEmF91hDDWhAp0Q+gJkAY2C8c/aIawJ9PpOxx5E:h5l8BP+5lEu1hDDWhAp0ZgJk0C8cRasZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2888)

    • Application was dropped or rewritten from another process

      • urgentquotation0032111xls.exe (PID: 3172)

  • SUSPICIOUS

    • Starts Internet Explorer

      • EXCEL.EXE (PID: 2888)

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 2888)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2604)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 2316)
      • EXCEL.EXE (PID: 2888)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2888)

    • Changes internet zones settings

      • iexplore.exe (PID: 3792)

    • Application launched itself

      • iexplore.exe (PID: 3792)

    • Manual execution by user

      • WinRAR.exe (PID: 1464)
      • WinRAR.exe (PID: 2604)
      • urgentquotation0032111xls.exe (PID: 3172)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 2316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsx | Excel Microsoft Office Open XML Format document (61.2)
.zip | Open Packaging Conventions container (31.5)
.zip | ZIP compressed archive (7.2)

EXIF

XMP

Creator: Double-Dee

XML

ModifyDate: 2019:05:23 22:58:30Z
CreateDate: 2016:08:23 21:52:25Z
LastModifiedBy: USER
AppVersion: 14.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
TitlesOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1726
ZipCompressedSize: 408
ZipCRC: 0x8546296f
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe iexplore.exe iexplore.exe winrar.exe no specs winrar.exe urgentquotation0032111xls.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2888"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3792"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2316"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3792 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1464"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\urgentquotation0032111xls.zip" C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2604"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\urgentquotation0032111xls.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3172"C:\Users\admin\Desktop\urgentquotation0032111xls.exe" C:\Users\admin\Desktop\urgentquotation0032111xls.exe—explorer.exe
User:
admin
Company:
kuytfguikjhsuk
Integrity Level:
MEDIUM
Description:
kytdfhjifdfghj
Version:
1.7.1.0
Total events
1 807
Read events
1 643
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
10
Unknown types
5

Dropped files

PID
Process
Filename
Type
2888EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVREBD.tmp.cvr —
MD5:—
SHA256:—
2888EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\urgentquotation0032111xls[1].zip —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1F837F9CF9A949CD.TMP —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0A66A864A1095BB8.TMP —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9CFCC79D-7DE1-11E9-B63D-5254004A04AF}.dat —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9CFCC79E-7DE1-11E9-B63D-5254004A04AF}.datbinary
MD5:A9F8CC10E1053E32A337D7DA1B9DB073
SHA256:7BDF414C645360815C5ED5ABF2983DBFBBE35F6D115EF68C0BAA21D1E0A9C0C8
2316iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:8CF3E8A5655265336FC957BD8C7740BE
SHA256:747657CB7BB7997AA41F79737D9DD9403A672E3907B993914A3452890A50D8B2
2316iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019052420190525\index.datdat
MD5:EE0DD5177562226327C1A0A5186E56FE
SHA256:17A3C5D66699227BA83034D7F0A9C596CE0DF61AA698B1797A083033AF64600C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2888
EXCEL.EXE
GET
—
88.99.251.203:80
http://officestore.mk/urgentquotation0032111xls.zip
DE
—
—
malicious
2316
iexplore.exe
GET
200
88.99.251.203:80
http://officestore.mk/urgentquotation0032111xls.zip
DE
compressed
749 Kb
malicious
3792
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3792
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2316
iexplore.exe
88.99.251.203:80
officestore.mk
Hetzner Online GmbH
DE
malicious
2888
EXCEL.EXE
88.99.251.203:80
officestore.mk
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
officestore.mk
  • 88.99.251.203
malicious
www.bing.com
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Urgent Quotation-0021103211.xlsx