analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3e95022feeeb95b834ef004ccfe62d9ef8afce1f362335010eae602ab58f0cf7.xls

Full analysis: https://app.any.run/tasks/78a5b218-0404-4a1c-8ef6-e357540985cf
Verdict: Malicious activity
Analysis date: June 19, 2019, 03:00:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: User, Last Saved By: User, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Jun 26 14:22:52 2018, Last Saved Time/Date: Tue Jun 26 14:22:56 2018, Security: 0
MD5:

EB00FCBA4BCE36E1122F4B8E69DA6590

SHA1:

9A64B2BB65571041DD9CDC25DC75A7A971D3CDCC

SHA256:

3E95022FEEEB95B834EF004CCFE62D9EF8AFCE1F362335010EAE602AB58F0CF7

SSDEEP:

49152:OfvrD4yZvuyXYFlENMODR2J6SGxGoK5O:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CertUtil for decode files

      • EXCEL.EXE (PID: 3164)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3164)

    • Application was dropped or rewritten from another process

      • Z2L4H2E4.exe (PID: 276)

  • SUSPICIOUS

    • Creates files in the user directory

      • certutil.exe (PID: 2908)

    • Executable content was dropped or overwritten

      • certutil.exe (PID: 2908)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3164)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3164)

    • Application was crashed

      • Z2L4H2E4.exe (PID: 276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: User
LastModifiedBy: User
Software: Microsoft Excel
CreateDate: 2018:06:26 13:22:52
ModifyDate: 2018:06:26 13:22:56
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe no specs certutil.exe z2l4h2e4.exe

Process information

PID
CMD
Path
Indicators
Parent process
3164"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2908certutil -decode C:\Users\admin\AppData\Roaming\Microsoft\AddIns\K9I6O4W5.txt C:\Users\admin\AppData\Roaming\Microsoft\AddIns\Z2L4H2E4.exeC:\Windows\system32\certutil.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
276C:\Users\admin\AppData\Roaming\Microsoft\AddIns\Z2L4H2E4.exeC:\Users\admin\AppData\Roaming\Microsoft\AddIns\Z2L4H2E4.exe
EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226356
Total events
540
Read events
513
Write events
20
Delete events
7

Modification events

(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:44>
Value:
34343E005C0C0000010000000000000000000000
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
5C0C0000B02DCD2A4B26D50100000000
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:44>
Value:
34343E005C0C0000010000000000000000000000
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3164) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\1208A4
Operation:writeName:1208A4
Value:
040000005C0C00006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0033006500390035003000320032006600650065006500620039003500620038003300340065006600300030003400630063006600650036003200640039006500660038006100660063006500310066003300360032003300330035003000310030006500610065003600300032006100620035003800660030006300660037002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000B08CC62C4B26D501A4081200A408120000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3164EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR85.tmp.cvr —
MD5:—
SHA256:—
3164EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\AddIns\K9I6O4W5.txttext
MD5:1E015CF26DB1D54C4E585EC4127122A2
SHA256:A261B019392892D3D52E7B34222BC8B96C352977494C8515742AD2B1BC2C0CFC
2908certutil.exeC:\Users\admin\AppData\Roaming\Microsoft\AddIns\Z2L4H2E4.exeexecutable
MD5:EDCFC3105AB18AA6D8783E8121BAB22A
SHA256:279E1D2BB0235C979A41F94192366CA2BD60DAC87C0D90A30932E3936DDEEF6E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
3e95022feeeb95b834ef004ccfe62d9ef8afce1f362335010eae602ab58f0cf7.xls