analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Documentos_2700814.xls

Full analysis: https://app.any.run/tasks/b61a49ca-2942-45f8-997d-7381fba8718f
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:02:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: SRGHRSHSH, Last Saved By: RGSGK, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:19:34 2015, Last Saved Time/Date: Wed Jun 22 18:18:37 2022, Security: 0
MD5:

DBAA6D60D6723D0572B7037E23E624EE

SHA1:

ACDB12494F4AA1FBADDDDFC68EC024E205005C9D

SHA256:

61617195E6AC7097101F36AD2FFA54D64BA1876FB9C55F7D218157CB77FD9A67

SSDEEP:

1536:f+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/QvXCVQN:2Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 3652)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3652)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 3652)
      • regsvr32.exe (PID: 3076)
      • regsvr32.exe (PID: 2060)
      • regsvr32.exe (PID: 3036)
      • regsvr32.exe (PID: 496)

    • Reads the computer name

      • EXCEL.EXE (PID: 3652)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 3652)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3652)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 3652)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3652"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3076C:\Windows\System32\regsvr32.exe /S ..\udh1.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2060C:\Windows\System32\regsvr32.exe /S ..\udh2.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
496C:\Windows\System32\regsvr32.exe /S ..\udh3.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3036C:\Windows\System32\regsvr32.exe /S ..\udh4.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 051
Read events
6 974
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
3652EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRBE02.tmp.cvr —
MD5:—
SHA256:—
3652EXCEL.EXEC:\Users\admin\udh4.ocxhtml
MD5:3D682D799FB1CA3609F31AB72F81A22F
SHA256:152E95AB8299A5B30A21D547215EFA092B65A40C2888AF582C57B0609050A700
3652EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:E4F88D49BA1504BF7D0BB0798FD8422C
SHA256:A79747AB8BB52213DE8DCEE4B37EA656A6380C16181CA8FF08006A8952166AF8
3652EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Tar2A7A.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
3652EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3652EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\687WDT33.txttext
MD5:E212009C736B90192FA2F5B3FA758EAD
SHA256:01F62B13261DF60D8FC9E11137288D20DE66CB1E37BE12C5A6B5D860C6477FF1
3652EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F061B52A6BC0DCC1F1D6ED99159C5818
SHA256:33B73D6EADC8FD1EEE56A2B0EA894B4AA60D72298356908BA100E716AEDB0648
3652EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\session_timeout[1].htmhtml
MD5:3D682D799FB1CA3609F31AB72F81A22F
SHA256:152E95AB8299A5B30A21D547215EFA092B65A40C2888AF582C57B0609050A700
3652EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D3B230987CA70BBE931E0191A50CCA75
SHA256:44FCB52F1603C1A2488E3E4A8104434DD5BFA3CDDB0D191F902E57A56C0F9872
3652EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22DBCAF188C786DFCF2128AD4555E265binary
MD5:4008F19B4EF0A0427EC9F92C41C4E3AA
SHA256:36EB5647525494C0276834B94A94E0DFB3F9EC5D3ACF27C9FC6CEE60A15BF648
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
9
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3652
EXCEL.EXE
GET
301
103.83.192.58:80
http://www.eapro.in/wp-admin/cb/
US
—
—
suspicious
3652
EXCEL.EXE
GET
301
103.83.192.58:80
http://eapro.in/wp-admin/cb/
US
—
—
suspicious
3652
EXCEL.EXE
GET
406
93.191.156.5:80
http://dvinge.com/wp-includes/9wOquCr9TAANex6RJOX/
DK
html
551 b
malicious
3652
EXCEL.EXE
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
3652
EXCEL.EXE
GET
200
184.24.77.75:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTUQFzqR21Rq4KDyDAkxf4cPA%3D%3D
US
der
503 b
shared
3652
EXCEL.EXE
GET
200
8.247.185.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?18c81d0089a8b27a
US
compressed
60.9 Kb
whitelisted
3652
EXCEL.EXE
GET
200
8.247.185.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f32e63fd478901c5
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3652
EXCEL.EXE
45.122.220.108:80
dulichdichvu.net
Viet Solutions Services Trading Company Limited
VN
malicious
3652
EXCEL.EXE
103.83.192.58:443
eapro.in
LeapSwitch Networks Pvt Ltd
IN
suspicious
3652
EXCEL.EXE
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
—
—
103.83.192.58:80
eapro.in
LeapSwitch Networks Pvt Ltd
IN
suspicious
3652
EXCEL.EXE
93.191.156.5:80
dvinge.com
team.blue Denmark A/S
DK
malicious
3652
EXCEL.EXE
148.139.69.159:443
www.e-xim.pl
SNC
US
unknown
3652
EXCEL.EXE
8.247.185.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3652
EXCEL.EXE
184.24.77.75:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
dulichdichvu.net
  • 45.122.220.108
malicious
dvinge.com
  • 93.191.156.5
unknown
eapro.in
  • 103.83.192.58
suspicious
www.eapro.in
  • 103.83.192.58
suspicious
ctldl.windowsupdate.com
  • 8.247.185.126
  • 8.238.189.126
  • 8.248.3.254
  • 8.248.89.254
  • 8.247.185.254
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
www.e-xim.pl
  • 148.139.69.159
unknown
r3.o.lencr.org
  • 184.24.77.75
  • 184.24.77.45
  • 184.24.77.56
  • 184.24.77.46
  • 184.24.77.53
  • 184.24.77.52
  • 184.24.77.48
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Documentos_2700814.xls