analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

xxx.xlsm

Full analysis: https://app.any.run/tasks/db9b06a1-ff03-4e2a-9376-bb7cc90b89cb
Verdict: Malicious activity
Analysis date: October 14, 2019, 00:52:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
macros
macros-on-open
macros-on-close
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

B89D81BC00770B89953F31CBCAFC0AC9

SHA1:

6E2AB04493B0D3F1E2072B9047F40CC5C7AF1084

SHA256:

7A8B9596458074F70AACDB4CB83157F51E52C568535E8DB6C7BDD441758C47F5

SSDEEP:

98304:PtLUzR93yCUmmIi9X98edVHGOUDGjzSFrRMTAxyMU/zQmcFUH2+lHnCdui1G0wqs:G/3j9i96w9KGvOriLR/kPv1bvwqlo+er

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2260)

  • SUSPICIOUS

    • Starts Internet Explorer

      • EXCEL.EXE (PID: 2260)

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 2260)

  • INFO

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 2260)
      • iexplore.exe (PID: 1216)
      • iexplore.exe (PID: 1956)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2260)
      • iexplore.exe (PID: 1956)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2260)

    • Changes internet zones settings

      • iexplore.exe (PID: 1216)
      • iexplore.exe (PID: 1956)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2144)
      • iexplore.exe (PID: 2992)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2144)
      • iexplore.exe (PID: 2992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlam | Excel Macro-enabled Open XML add-in (42.4)
.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (29.2)
.xlsx | Excel Microsoft Office Open XML Format document (17.3)
.zip | Open Packaging Conventions container (8.9)
.zip | ZIP compressed archive (2)

EXIF

XML

CDP_QUERY_LOG: -
SV_HIDDEN_GRID_QUERY_LIST_4F35BF76-6C0D-4D9B-82B2-816C12CF3733: empty_477D106A-C0D6-4607-AEBD-E2C9D60EA279
SV_QUERY_LIST_4F35BF76-6C0D-4D9B-82B2-816C12CF3733: empty_477D106A-C0D6-4607-AEBD-E2C9D60EA279
CDP_ALLOW_POPUPS: -
DW_UseColumnHeaders:
DW_LastUsedQuerySet: Attachment_PW
DW_LastUsedQueryParamaters: -
DW_WizardColumnsRow: 9
DW_ColumnsRow: 9
AppVersion: 16.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: More4Apps
TitlesOfParts:
  • Setup
  • New task upload
  • Sheet1
  • UDA Sample
  • Rules
HeadingPairs:
  • Worksheets
  • 5
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
TotalEditTime: -
ModifyDate: 2019:09:25 03:08:43Z
CreateDate: 2004:12:07 20:20:53Z
LastPrinted: 2018:08:02 21:24:59Z
LastModifiedBy: Chatura Perera (DEDJTR)

XMP

Creator: More4Apps
Subject: Loads Projects and Assets into Oracle Projects module
Title: More4Apps Project Wizard

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 11540
ZipCompressedSize: 808
ZipCRC: 0xfa32d355
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2260"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
1216"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2144"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1216 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1956"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2992"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1956 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 401
Read events
2 052
Write events
334
Delete events
15

Modification events

(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:):b
Value:
293A6200D4080000010000000000000000000000
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2260) EXCEL.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:EXCELFiles
Value:
1330511897
Executable files
0
Suspicious files
7
Text files
108
Unknown types
36

Dropped files

PID
Process
Filename
Type
2260EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRB689.tmp.cvr —
MD5:—
SHA256:—
1216iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico —
MD5:—
SHA256:—
1216iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:B992603080B5585D24227ACA208CA118
SHA256:42454FAEF75EFECA81E5F50CF568032D5AF21F7021AE9198F8608E72FE2376B8
2260EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:90EF5FA0F3A851AE2668C06B2FC65773
SHA256:80954A56BD6C0D00824C63EBF1FC59465A2FC2BD1796891F4403080C3FB5F3B4
2144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:1BA94F3C4E975D5CF0294DFBCE3D39DE
SHA256:BDC45D5B4FE7B3109BF9DBDBF0D1F5D4D0FFBB9E0DB7E28A39B3320DF02E0BF1
2144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\81MLLGBA\de_style[1].csstext
MD5:229805C4EA1BFECEBC6348958853DF2C
SHA256:84905374C5EAB257E4A8A0796C8A4EC058D2F1CF2F3F9D8302FCD4045044CC57
2144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\81MLLGBA\drexplain.data.index[1].jstext
MD5:0E9EC68BDBEB87F1A0FEBA8A55B0AECD
SHA256:BA9D19508440A1838257ADD634C61604AAD8C81F7E3C46AEFD5DDFDC4CFF7C3E
2144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\81MLLGBA\all[1].jshtml
MD5:D93489F54A1D18A999B4FCB2A487CCDC
SHA256:ED68FC3CD1DE1113F2A3964F98BDFA9B6E7DED5E11A8EBD41711A60F081F5536
2260EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\getting_started[1].htmhtml
MD5:9706EF7E7A0F5E478DE9CF5F5E7B8C36
SHA256:2B8CA9C63E672B2EA129486145260082E848633AD7ABD469DAF45BA6B972A605
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
82
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2260
EXCEL.EXE
GET
302
114.134.14.106:80
http://horizon.more4apps.com/doco/PWRelease/output/index.htm?sync&page=html/GettingStarted.html
NZ
html
284 b
unknown
2260
EXCEL.EXE
GET
301
74.50.54.164:80
http://www.more4apps.com/products/GeneralDocs/InstallationSetup/output/index.htm?sync&page=html/Steps-InstallationandConfiguration.html
US
html
348 b
unknown
2260
EXCEL.EXE
GET
301
74.50.54.164:80
http://www.more4apps.com/products/GeneralDocs/InstallationSetup/output/index.htm?sync&page=html/Steps-InstallationandConfiguration.html
US
html
348 b
unknown
1216
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1216
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2260
EXCEL.EXE
114.134.14.106:443
horizon.more4apps.com
Lightwire LTD
NZ
unknown
2144
iexplore.exe
114.134.14.106:443
horizon.more4apps.com
Lightwire LTD
NZ
unknown
2144
iexplore.exe
74.50.54.164:443
more4apps.com
Colo4, LLC
US
unknown
2260
EXCEL.EXE
114.134.14.106:80
horizon.more4apps.com
Lightwire LTD
NZ
unknown
1216
iexplore.exe
114.134.14.106:443
horizon.more4apps.com
Lightwire LTD
NZ
unknown
2260
EXCEL.EXE
74.50.54.164:80
more4apps.com
Colo4, LLC
US
unknown
2992
iexplore.exe
114.134.14.106:443
horizon.more4apps.com
Lightwire LTD
NZ
unknown
2260
EXCEL.EXE
74.50.54.164:443
more4apps.com
Colo4, LLC
US
unknown
2992
iexplore.exe
74.50.54.164:443
more4apps.com
Colo4, LLC
US
unknown

DNS requests

Domain
IP
Reputation
horizon.more4apps.com
  • 114.134.14.106
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
more4apps.com
  • 74.50.54.164
unknown
www.more4apps.com
  • 74.50.54.164
unknown
html5shiv.googlecode.com
  • 74.125.133.82
whitelisted
fonts.googleapis.com
  • 172.217.22.74
whitelisted
fonts.gstatic.com
  • 172.217.22.35
whitelisted
www.googletagmanager.com
  • 172.217.22.40
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
xxx.xlsm