analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

documento2_447.xls

Full analysis: https://app.any.run/tasks/7babee08-9846-4484-9af4-c9f31fe6f3ea
Verdict: Malicious activity
Analysis date: October 20, 2020, 11:55:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: ejUOVyaLbfhZ, Last Saved By: administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Oct 20 05:52:28 2020, Last Saved Time/Date: Tue Oct 20 07:10:08 2020, Security: 1
MD5:

2920F0CED58A5991E93F0AAA15D2807D

SHA1:

2A36D669FEEB4EEB3B078C3798D4B3ADDAFBC2C9

SHA256:

4F758952064045E7C93F0F99D18295C91EFD89A169F795A2D486CB1B7AAE9A14

SSDEEP:

3072:Mz1qgk5uw2iE3V8JDko/IIPN18h8ORGeQLP6hnXBAaUu3YdcDcYCrnyv+IIlZ3NU:MzoPx2LE4o/dIuEQGdaaUB7rnym/Lmn5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 380)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 380)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • EXCEL.EXE (PID: 380)

  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 380)

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 380)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: ejUOVyaLbfhZ
LastModifiedBy: administrator
Software: Microsoft Excel
CreateDate: 2020:10:20 04:52:28
ModifyDate: 2020:10:20 06:10:08
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • tFWXstEbIlBhnHPFkfg
  • Foglio2
  • Foglio3
  • Foglio4
  • Foglio5
  • Foglio6
  • Foglio7
  • Foglio8
  • Foglio9
  • Foglio10
  • Sheet1
  • N
HeadingPairs:
  • Fogli di lavoro
  • 11
  • Macro di Excel 4.0
  • 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
1952"C:\Windows\System32\rundll32.exe" qhjbBdI.dll,DllRegisterServerC:\Windows\System32\rundll32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
546
Read events
491
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
380EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR3ACF.tmp.cvr —
MD5:—
SHA256:—
380EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:8DEAFDB1F109B569E018957B6AA97C4F
SHA256:4C0420B25FA247B5F51DA2750B6B0BCDA4BF99C4CC5CD83EEAF3C162090F42DC
380EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\documento2_447.xls.LNKlnk
MD5:0C26D5D35333C3ECDDA6E911FB27ACA4
SHA256:CE0BC6E9914677082C5DF03EA8E05D8767F6CC42B56CEA508F642EB9C27D3707
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
380
EXCEL.EXE
GET
—
46.29.161.209:80
http://systemlinks.cyou/installa.dll
RU
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
380
EXCEL.EXE
46.29.161.209:80
systemlinks.cyou
LLC Baxet
RU
suspicious

DNS requests

Domain
IP
Reputation
systemlinks.cyou
  • 46.29.161.209
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
documento2_447.xls