| File name: | FedEx Shipping Document.xlsx.exe |
| Full analysis: | https://app.any.run/tasks/c1e68480-39ca-4558-abd6-42acde49260f |
| Verdict: | Malicious activity |
| Analysis date: | August 20, 2024, 11:52:18 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | CFEA57FBC5EEAFC1033B264177997B73 |
| SHA1: | 67C18A9A7294FB9CAF42FC5A7469355453836D68 |
| SHA256: | 47FEAD51578D89FA88A11B70D131EDACE94C4E7FFDFEEF85B5E4046713CEAB8B |
| SSDEEP: | 6144:eDe6Ddsjt1buXaolp9k+tQPsR03VH2x97SoxsQQpQTF5lgFwa98Ksa6BBrdLXyEK:eDejXbQL6VH2xVSoxsQQpQTFf |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- FedEx Shipping Document.xlsx.exe (PID: 6840)
Reads security settings of Internet Explorer
- FedEx Shipping Document.xlsx.exe (PID: 6840)
Executes application which crashes
- FedEx Shipping Document.xlsx.exe (PID: 6840)
INFO
Checks supported languages
- FedEx Shipping Document.xlsx.exe (PID: 6840)
Checks proxy server information
- WerFault.exe (PID: 7076)
- FedEx Shipping Document.xlsx.exe (PID: 6840)
Creates files or folders in the user directory
- WerFault.exe (PID: 7076)
Reads the computer name
- FedEx Shipping Document.xlsx.exe (PID: 6840)
Reads the software policy settings
- WerFault.exe (PID: 7076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2058:03:18 16:45:08+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 555520 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x8981e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.72.4.0 |
| ProductVersionNumber: | 4.72.4.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This assembly implements a docking layout system for WPF. Add some feauture: CanResize ... |
| CompanyName: | Open Source |
| FileDescription: | AvalonDock |
| FileVersion: | 4.72.4 |
| InternalName: | AvalonDock.dll |
| LegalCopyright: | 2017-2023 |
| OriginalFileName: | AvalonDock.dll |
| ProductName: | Dirkster.AvalonDock |
| ProductVersion: | 4.72.4+879d508df3e8a69e46626a45129953e0c5f6ee5b |
| AssemblyVersion: | 4.72.4.0 |
Total processes
137
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6840 | "C:\Users\admin\AppData\Local\Temp\FedEx Shipping Document.xlsx.exe" | C:\Users\admin\AppData\Local\Temp\FedEx Shipping Document.xlsx.exe | explorer.exe | ||||||||||||
User: admin Company: Open Source Integrity Level: MEDIUM Description: AvalonDock Exit code: 3762504530 Version: 4.72.4 Modules
| |||||||||||||||
| 7076 | C:\WINDOWS\system32\WerFault.exe -u -p 6840 -s 1552 | C:\Windows\System32\WerFault.exe | FedEx Shipping Document.xlsx.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
4 658
Read events
4 647
Write events
11
Delete events
0
Modification events
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6840) FedEx Shipping Document.xlsx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
0
Suspicious files
2
Text files
2
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7076 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FedEx Shipping D_c127f1e3efd2b306a296d40a43284d62ff9f8f_9c771bbc_71565f51-fbea-4581-8f80-67a696ca60b2\Report.wer | — | |
MD5:— | SHA256:— | |||
| 7076 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\FedEx Shipping Document.xlsx.exe.6840.dmp | — | |
MD5:— | SHA256:— | |||
| 7076 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:FB64A9EBEDF48D3895381D5B7D80743D | SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42 | |||
| 7076 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF71.tmp.WERInternalMetadata.xml | xml | |
MD5:ABB20B4B7F3F8AAA34F0E34FA21DB5A2 | SHA256:81BAE33945710E38790DD2C83D271466B380FD27EA714A5009E093CBDF07A988 | |||
| 7076 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:82C30E45BF5F93A5DB1D5E47F913053B | SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967 | |||
| 7076 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE09.tmp.dmp | dmp | |
MD5:32AF4B3F24938094950F0820FC73B0DA | SHA256:F7405F57029573BDE898DB9BB190EF1EE89059B6515D4FEF9289303B0EBC068F | |||
| 7076 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF91.tmp.xml | xml | |
MD5:9F85BA48E96F8E2C270240C90BD667C3 | SHA256:879002A75C8153B430B46DF068C661F1883182A605B01A1C32991B23413482EB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
29
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4404 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6832 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6664 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3164 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5904 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7076 | WerFault.exe | 20.42.73.29:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4404 | svchost.exe | 20.190.160.17:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4404 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6664 | backgroundTaskHost.exe | 20.74.47.205:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
malesytisconbox.com |
| malicious |
watson.events.data.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |