analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

0630000.xls

Full analysis: https://app.any.run/tasks/b9902ffc-5376-4049-a27f-78e430dbc509
Verdict: Malicious activity
Analysis date: May 20, 2022, 17:03:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu May 19 17:58:23 2022, Security: 0
MD5:

3BC31916746ACD2F588E27B24E5BD90D

SHA1:

F587D8B3E2E67A599FC772544C0D9AF9F3BBD31A

SHA256:

450F9B20D1647F065E7502C5990BCB0FE8D0386A7C8B2DFCB27B61C4D8A5960A

SSDEEP:

1536:dfKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg89s1a6Y+2jzLviHvDNHhOAL:9Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2532)

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 2532)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 2532)

    • Checks supported languages

      • EXCEL.EXE (PID: 2532)
      • regsvr32.exe (PID: 2936)
      • taskmgr.exe (PID: 2432)

    • Reads the computer name

      • EXCEL.EXE (PID: 2532)
      • taskmgr.exe (PID: 2432)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 2532)

    • Manual execution by user

      • taskmgr.exe (PID: 2432)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

HeadingPairs:
  • Листы
  • 4
  • Макросы Excel 4.0
  • 1
TitleOfParts:
  • Sheet
  • ESRSGB1
  • EGSHRHV2
  • ESHVGRER3
  • PKEKPPGEKKPGE
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
Company: -
CodePage: Windows Cyrillic
Security: None
ModifyDate: 2022:05:19 16:58:23
CreateDate: 2015:06:05 18:19:34
Software: Microsoft Excel
LastModifiedBy: TYHRETH
Author: Dream
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe regsvr32.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2532"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
2936C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2432"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
6 020
Read events
5 934
Write events
75
Delete events
11

Modification events

(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:ls;
Value:
6C733B00E4090000010000000000000000000000
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2532) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
0
Suspicious files
7
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
2532EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR474C.tmp.cvr —
MD5:—
SHA256:—
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DC7F871A94DCC5407E47E2A8E763A49Abinary
MD5:CCFEC7B0FCC508CDA5D7D640C6483222
SHA256:06E295E0C55C7728CB592DC66C91059D6A8D5F9E829BA411B4CD490B9AA2A67B
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691binary
MD5:ABC02887EA1AA19A294BA7623C72C4C8
SHA256:BD778D5AD94E9FD41F47E2334504BEF2CA80FB20FC8DF34BD69FDA3D83CF8842
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:330570CFB8E6C6442DED5D65D523246D
SHA256:3DFE747C23293F8BE67147D6A8812B1479274DF95CA6DC51B90C62E1796E8D0C
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DC7F871A94DCC5407E47E2A8E763A49Ader
MD5:7C7E0DF4AEB0CF2230DE592152EFE1D3
SHA256:7E531ACC3F5BF32A19CA77BF5B96200B18F46BD8B620B4296DACAFDF51AA2C36
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:B9F21D8DB36E88831E5352BB82C438B3
SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:54E9306F95F32E50CCD58AF19753D929
SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72
2532EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Tar93A9.tmpcat
MD5:E721613517543768F0DE47A6EEEE3475
SHA256:3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
2532EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Cab93A8.tmpcompressed
MD5:B9F21D8DB36E88831E5352BB82C438B3
SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
2532EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:83EA73336A65CD5BB9ED083B53D091CE
SHA256:068B322EAD447A31A51B3531285E5B23489AFFD212269E303CABC1FD2EC008EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2532
EXCEL.EXE
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?92acce417065f35b
US
compressed
60.0 Kb
whitelisted
2532
EXCEL.EXE
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
2532
EXCEL.EXE
GET
200
184.24.77.67:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQakzn38KvfTlLyfeiq3Cyyww%3D%3D
US
der
503 b
shared
2532
EXCEL.EXE
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
US
der
471 b
whitelisted
2532
EXCEL.EXE
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
US
der
728 b
whitelisted
1096
svchost.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4bf7b6919de7beb8
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2532
EXCEL.EXE
23.216.77.80:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
—
—
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
2532
EXCEL.EXE
92.42.38.45:443
www.megakonferans.com
Inetmar internet Hizmetleri San. Tic. Ltd. Sti
TR
suspicious
2532
EXCEL.EXE
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2532
EXCEL.EXE
184.24.77.67:80
r3.o.lencr.org
Time Warner Cable Internet LLC
US
unknown
2532
EXCEL.EXE
172.64.155.188:80
ocsp.comodoca.com
—
US
suspicious
2532
EXCEL.EXE
191.252.105.151:443
noronhalanches.com.br
Locaweb Serviços de Internet S/A
BR
suspicious
1096
svchost.exe
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious

DNS requests

Domain
IP
Reputation
www.megakonferans.com
  • 92.42.38.45
suspicious
ctldl.windowsupdate.com
  • 93.184.221.240
  • 23.216.77.80
  • 23.216.77.69
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.67
  • 184.24.77.54
  • 184.24.77.79
  • 184.24.77.62
shared
noronhalanches.com.br
  • 191.252.105.151
unknown
ocsp.comodoca.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0630000.xls