analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

6019376185fdac890ed050fa950032b626b26dec529f93179ffef4e3f0616a79.xls

Full analysis: https://app.any.run/tasks/ceffe947-ded4-49b1-b8a1-50c679397ee9
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: June 12, 2019, 02:30:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Last Saved By: boo loo, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed May 8 03:07:49 2019, Last Saved Time/Date: Wed May 8 05:09:42 2019, Security: 0
MD5:

CD52C994361DB998575B5EA49B023A1C

SHA1:

E5B3F81480EBBFA5BCA31D0911AF7B51421B5C37

SHA256:

6019376185FDAC890ED050FA950032B626B26DEC529F93179FFEF4E3F0616A79

SSDEEP:

1536:hlk3hbdlylKsgqopeJBWhZFGkE+cL2NdAonliFgDlJVdcKvTMGcCdZQuNrj:hlk3hbdlylKsgqopeJBWhZFGkE+cL2Nf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 3324)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 3324)
  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3324)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

CompObjUserType: Microsoft Excel 2003 Worksheet
CompObjUserTypeLen: 31
HeadingPairs:
  • Worksheets
  • 1
TitleOfParts: Sheet1
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 15
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2019:05:08 04:09:42
CreateDate: 2019:05:08 02:07:49
Software: Microsoft Excel
LastModifiedBy: boo loo
Author: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe

Process information

PID
CMD
Path
Indicators
Parent process
3324"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Total events
552
Read events
523
Write events
22
Delete events
7

Modification events

(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:<m>
Value:
3C6D3E00FC0C0000010000000000000000000000
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
FC0C00001EBF1CCFC620D50100000000
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:<m>
Value:
3C6D3E00FC0C0000010000000000000000000000
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3324) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\11F3E3
Operation:writeName:11F3E3
Value:
04000000FC0C00006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0036003000310039003300370036003100380035006600640061006300380039003000650064003000350030006600610039003500300030003300320062003600320036006200320036006400650063003500320039006600390033003100370039006600660065006600340065003300660030003600310036006100370039002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000A04DD3D0C620D501E3F31100E3F3110000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3324EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRED0C.tmp.cvr
MD5:
SHA256:
3324EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@adcommunication[1].txttext
MD5:E1F4C4E9A2E0702B7FF39A6A9E277459
SHA256:C7E96613D9732612032B034D691814EDC06A9A2148731D958E5FB4B0FDD80780
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3324
EXCEL.EXE
GET
303
94.46.13.110:80
http://adcommunication.pt/jpgs.exe
PT
malicious
3324
EXCEL.EXE
GET
404
94.46.13.110:80
http://adcommunication.pt/index.php/pt/jpgs.exe
PT
html
1.49 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3324
EXCEL.EXE
94.46.13.110:80
adcommunication.pt
Almouroltec Servicos De Informatica E Internet Lda
PT
suspicious

DNS requests

Domain
IP
Reputation
adcommunication.pt
  • 94.46.13.110
malicious

Threats

No threats detected
No debug info