analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Doc-11722.xls

Full analysis: https://app.any.run/tasks/af193555-d624-4077-b225-8014fbb81a9b
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 10:17:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
ta505
opendir
trojan
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Windows User, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Jun 22 13:23:57 2019, Last Saved Time/Date: Mon Jan 6 11:38:30 2020, Security: 0
MD5:

AF715B8A907364542573A6DD7A5F18EB

SHA1:

5818AD784254E19B93C8470FE2899BA8DFF63B84

SHA256:

65DD73A855E28D6CE4AE9EFEA1BFB616856B47E83D906D5AA43F0900A5D77B08

SSDEEP:

6144:dk3hOdsylKlgryzc4bNhZF+E+W2knA8Vr1nQ133RWQGYEBm:gVZQ133RRGxBm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WScript.exe (PID: 3680)
      • WScript.exe (PID: 3964)
      • WScript.exe (PID: 940)
      • WScript.exe (PID: 292)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 1292)

    • Changes the autorun value in the registry

      • EXCEL.EXE (PID: 1292)

    • Connects to CnC server

      • EXCEL.EXE (PID: 1292)

  • SUSPICIOUS

    • Creates files in the user directory

      • notepad++.exe (PID: 2416)

    • Creates files in the Windows directory

      • EXCEL.EXE (PID: 1292)

  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 1292)

    • Manual execution by user

      • WScript.exe (PID: 940)
      • notepad++.exe (PID: 2416)
      • WScript.exe (PID: 3680)
      • explorer.exe (PID: 2412)
      • WScript.exe (PID: 292)
      • WScript.exe (PID: 3964)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

CompObjUserType: Microsoft Excel 2003 Worksheet
CompObjUserTypeLen: 31
HeadingPairs:
  • Worksheets
  • 1
TitleOfParts: Sheet1
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 15
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
ModifyDate: 2020:01:06 11:38:30
CreateDate: 2019:06:22 12:23:57
Software: Microsoft Excel
LastModifiedBy: Windows User
Author: Windows User
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start excel.exe explorer.exe no specs notepad++.exe gup.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1292"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2412"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2416"C:\Program Files\Notepad++\notepad++.exe" "C:\Windows\System32\spool\drivers\color\zldgfavz"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
1992"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
3680"C:\Windows\System32\WScript.exe" "C:\Windows\System32\spool\drivers\color\a.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
3964"C:\Windows\System32\WScript.exe" "C:\Windows\System32\spool\drivers\color\a.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
940"C:\Windows\System32\WScript.exe" "C:\Windows\System32\spool\drivers\color\a.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
292"C:\Windows\System32\WScript.exe" "C:\Windows\System32\spool\drivers\color\a.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
885
Read events
731
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
1292EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRAA63.tmp.cvr —
MD5:—
SHA256:—
1292EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Excel8.0\MSForms.exdtlb
MD5:E07B92FED9231B03A95B9B48BEA80045
SHA256:27D5468D74B6C677B67E34104E172E77E597BA1CB1AB7806C5FCD965FD3B9EAF
1292EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CB724691.emfemf
MD5:59C45B1D5037D93024F67C8034057300
SHA256:8406824D64CA5F8D01D520E100953892535F8214446347B6EB4CEC8E2F584B52
2416notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:32034BBC99AC4549AA9B39C63975811F
SHA256:764076AC50F9E815F7234371390FE18D8AFF26F390DF426E4E97DC4C33ED13BF
1292EXCEL.EXEC:\Windows\System32\spool\drivers\color\zldgfavztext
MD5:7B6025A8C007FE3268C095B07CC3625F
SHA256:950F2DF4B3AA3CAB48DEFBF6A8416B9CF8C16EBC8C10551FEDF605D5766E8C14
2416notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:6D01C44F66C15CAC6CBEB7681EE89F00
SHA256:6B9C9AF50F3AB883812A0922FE412BE911D27BECE519EBB6161982CDEDF12D2A
1292EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C1145B5E.emfemf
MD5:F5838C10301603C67F6E04BCB21A8A14
SHA256:9FB7EDCDD747988CCAA78C1A26D3BDC632B68606029215B535542A68623A23A0
2416notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\plugins\Config\converter.initext
MD5:F70F579156C93B097E656CABA577A5C9
SHA256:B926498A19CA95DC28964B7336E5847107DD3C0F52C85195C135D9DD6CA402D4
2416notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:E792264BEC29005B9044A435FBA185AB
SHA256:5298FD2F119C43D04F6CF831F379EC25B4156192278E40E458EC356F9B49D624
2416notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:44982E1D48434C0AB3E8277E322DD1E4
SHA256:3E661D3F1FF3977B022A0ACC26B840B5E57D600BC03DCFC6BEFDB408C665904C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEAxHWpoyfQpCuYL7zNoKQA4%3D
US
der
280 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
1292
EXCEL.EXE
GET
200
95.215.225.28:80
http://foura.biz/js/elevatezoom-master/editor.php?ac=1&n=admin:USER-PC:USER-PC:Windows%20(32-bit)%20NT%206.01
GB
image
95 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1992
gup.exe
104.31.88.28:443
notepad-plus-plus.org
Cloudflare Inc
US
shared
1292
EXCEL.EXE
95.215.225.28:80
foura.biz
M247 Ltd
GB
malicious

DNS requests

Domain
IP
Reputation
foura.biz
  • 95.215.225.28
whitelisted
notepad-plus-plus.org
  • 104.31.88.28
  • 104.31.89.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1292
EXCEL.EXE
A Network Trojan was detected
ET TROJAN MuddyWater Payload - CnC Checkin
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Doc-11722.xls