analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

NEW ORDER.xlsx

Full analysis: https://app.any.run/tasks/d0d407da-36fb-48fa-ad8a-e0ad91526821
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 11, 2019, 08:10:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
rat
nanocore
trojan
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

0B0B33FE6C1BCCADCA4A02BB741AFE2C

SHA1:

4F5DF91DAFC17978F104F3329E2EAE4A3D0F5488

SHA256:

5D33E25F8CACA88C30976B990E252EFB5106A9CFA5EF4A786479D94E4DACFC55

SSDEEP:

3072:dpvmFEif+AXo9nGGuy+GNjNcDNustZOV+O1iHkpw5DXdnuYXn6fn1uj4:dpvmCi1XeGGuqUUstwOHky5MY3m/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • LZF.exe (PID: 2296)
      • LZF.exe (PID: 2052)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2972)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2972)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2972)

    • Changes the autorun value in the registry

      • LZF.exe (PID: 2052)

    • NanoCore was detected

      • LZF.exe (PID: 2052)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2824)

    • Connects to CnC server

      • LZF.exe (PID: 2052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2972)
      • LZF.exe (PID: 2052)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2972)
      • LZF.exe (PID: 2052)

    • Application launched itself

      • LZF.exe (PID: 2296)

    • Connects to unusual port

      • LZF.exe (PID: 2052)

    • Executes scripts

      • LZF.exe (PID: 2052)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 1744)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsx | Excel Microsoft Office Open XML Format document (61.2)
.zip | Open Packaging Conventions container (31.5)
.zip | ZIP compressed archive (7.2)

EXIF

XMP

Creator: -

XML

ModifyDate: 2018:07:08 10:49:35Z
CreateDate: 2006:09:16 00:00:00Z
LastModifiedBy: -
AppVersion: 16.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts:
  • Sheet1
  • تقرير المبيعات
  • مبيعات
  • العقود
  • السندات المفقودة
  • Customer List
  • المصروفات
  • شيكات المسحوبة
  • كشف الحساب
  • المصروفات (2)
  • مبيعات (2)
  • Sales Invoice List
  • 'كشف الحساب'!Print_Titles
HeadingPairs:
  • Worksheets
  • 12
  • Named Ranges
  • 1
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 3388
ZipCompressedSize: 466
ZipCRC: 0xcece5190
ZipModifyDate: 2019:02:10 23:34:08
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe lzf.exe no specs #NANOCORE lzf.exe vbc.exe vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
2972"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2296C:\Users\admin\AppData\Roaming\LZF.exeC:\Users\admin\AppData\Roaming\LZF.exe—EQNEDT32.EXE
User:
admin
Company:
Arola6
Integrity Level:
MEDIUM
Description:
Aylwin
Exit code:
0
Version:
1.03.0006
2052:\Users\admin\AppData\Roaming\LZF.exeC:\Users\admin\AppData\Roaming\LZF.exe
LZF.exe
User:
admin
Company:
Arola6
Integrity Level:
MEDIUM
Description:
Aylwin
Version:
1.03.0006
2824"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\nofpyy41.cck"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
LZF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
1744"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\2pf1rjzm.npz"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe—LZF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
726
Read events
670
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
3
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2980EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR8A83.tmp.cvr —
MD5:—
SHA256:—
2980EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$NEW ORDER.xlsx —
MD5:—
SHA256:—
2824vbc.exeC:\Users\admin\AppData\Local\Temp\nofpyy41.cck —
MD5:—
SHA256:—
2972EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\PUL[1].exeexecutable
MD5:AE6BFB06131F0AB34497DC4D3A0A2E89
SHA256:C90A743610E4897C98BE5D0CED617A3AB315FEFD8074B6363F6BDAE3640EA4D6
2972EQNEDT32.EXEC:\Users\admin\AppData\Roaming\LZF.exeexecutable
MD5:AE6BFB06131F0AB34497DC4D3A0A2E89
SHA256:C90A743610E4897C98BE5D0CED617A3AB315FEFD8074B6363F6BDAE3640EA4D6
2052LZF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:3460E89F69A6CC28C1A64D87B0B0A13B
SHA256:0419506A947801D32873E0C2211C33645D438AEAE420FA8B4177985FF5BB7B83
2052LZF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:AE6BFB06131F0AB34497DC4D3A0A2E89
SHA256:C90A743610E4897C98BE5D0CED617A3AB315FEFD8074B6363F6BDAE3640EA4D6
2296LZF.exeC:\Users\admin\AppData\Local\Temp\~DFA6A45938BA875B7B.TMPbinary
MD5:B616D3F2B11B477701FA03D9C0C34F24
SHA256:6918192C04C614D9E099DBBA1BD512856DCB4B3F65A442995C2F82DF213D6226
2972EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
2052LZF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
EQNEDT32.EXE
GET
200
92.62.131.38:80
http://realdealhouse.eu/ABU/PUL.exe
LT
executable
460 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2052
LZF.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
2972
EQNEDT32.EXE
92.62.131.38:80
realdealhouse.eu
UAB Baltnetos komunikacijos
LT
suspicious
2052
LZF.exe
185.244.30.93:2040
giovan234.ddns.net
—
—
malicious

DNS requests

Domain
IP
Reputation
realdealhouse.eu
  • 92.62.131.38
suspicious
giovan234.ddns.net
  • 185.244.30.93
malicious

Threats

PID
Process
Class
Message
2972
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2052
LZF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2052
LZF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
29 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
NEW ORDER.xlsx