File name:

SecuriteInfo.com.Exploit.Siggen3.44196.10663.31208

Full analysis: https://app.any.run/tasks/d4f456cd-282c-43ad-80ae-d977366b32e3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 20, 2023, 07:38:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
rat
remcos
remote
loader
exploit
cve-2017-11882
stealer
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Dec 19 06:53:05 2023, Security: 1
MD5:

B827538F569CC59EBB00FD2AA6847C92

SHA1:

C89080DEBFC2B17D614A148B61DF22CEF919365F

SHA256:

7B6963634E8575ACFDE4AE2B6AE7E94D4C3236FDC82C703BABD5859E83E9B38E

SSDEEP:

6144:vzM75/FZKHIMZ6RXQ8njyQeIT+yRpIajni4/ZtMpXV:bM75/vKHILRgcjyQeIiipIaji4BYXV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connection from MS Office application

      • EXCEL.EXE (PID: 2040)
      • WINWORD.EXE (PID: 1504)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2296)

    • Drops the executable file immediately after the start

      • EQNEDT32.EXE (PID: 2296)
      • wlanext.exe (PID: 2632)
      • stacmgtbb.exe (PID: 2736)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2296)

    • REMCOS has been detected (SURICATA)

      • stacmgtbb.exe (PID: 2580)

    • Steals credentials from Web Browsers

      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 2836)

    • Actions looks like stealing of personal data

      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 884)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 2836)

    • Uses NirSoft utilities to collect credentials

      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 2836)

    • Steals credentials

      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 2836)

    • REMCOS has been detected (YARA)

      • stacmgtbb.exe (PID: 2580)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 2296)
      • stacmgtbb.exe (PID: 2580)

    • Application launched itself

      • stacmgtbb.exe (PID: 2736)
      • stacmgtbb.exe (PID: 2580)

    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 2296)

    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 2296)

    • Connects to unusual port

      • stacmgtbb.exe (PID: 2580)

    • Loads DLL from Mozilla Firefox

      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 884)

    • Accesses Microsoft Outlook profiles

      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 900)

  • INFO

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2296)
      • wlanext.exe (PID: 2632)
      • stacmgtbb.exe (PID: 2736)
      • stacmgtbb.exe (PID: 2580)
      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 2836)
      • stacmgtbb.exe (PID: 884)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2296)
      • stacmgtbb.exe (PID: 2580)
      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 884)
      • stacmgtbb.exe (PID: 2836)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2296)
      • wlanext.exe (PID: 2632)
      • stacmgtbb.exe (PID: 2580)
      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 884)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 2836)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 2296)
      • stacmgtbb.exe (PID: 2580)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 2296)
      • stacmgtbb.exe (PID: 2736)
      • stacmgtbb.exe (PID: 2580)

    • Create files in a temporary directory

      • wlanext.exe (PID: 2632)
      • stacmgtbb.exe (PID: 680)
      • stacmgtbb.exe (PID: 2828)
      • stacmgtbb.exe (PID: 876)
      • stacmgtbb.exe (PID: 900)
      • stacmgtbb.exe (PID: 2836)
      • stacmgtbb.exe (PID: 884)

    • Reads product name

      • stacmgtbb.exe (PID: 2580)

    • Reads Environment values

      • stacmgtbb.exe (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2580) stacmgtbb.exe
C2 (1)unllin.com:3211
BotnetChi'm
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-GVMDL4
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Title: -
Subject: -
Keywords: -
Comments: -
Template: -
RevisionNumber: 1
Pages: -
Words: -
Characters: -
ThumbnailClip: (Binary data 22858 bytes, use -b option to extract)
Category: -
PresentationTarget: -
Manager: -
Company: -
Bytes: -
Lines: -
Paragraphs: -
Slides: -
Notes: -
HiddenSlides: -
MMClips: -
CharCountWithSpaces: -
KSOProductBuildVer: 2052-11.1.0.13703
ICV: C30860BF318046A5BA3C67275852A6D2
Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2023:12:19 06:53:05
Security: Password protected
CodePage: Windows Latin 1 (Western European)
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
12
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe winword.exe eqnedt32.exe wlanext.exe no specs stacmgtbb.exe no specs #REMCOS stacmgtbb.exe stacmgtbb.exe stacmgtbb.exe stacmgtbb.exe stacmgtbb.exe stacmgtbb.exe stacmgtbb.exe

Process information

PID
CMD
Path
Indicators
Parent process
680C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe /stext "C:\Users\admin\AppData\Local\Temp\davnkzcsijdjg"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe
stacmgtbb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
876C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe /stext "C:\Users\admin\AppData\Local\Temp\odaylrvmvrvwirvi"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe
stacmgtbb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
884C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe /stext "C:\Users\admin\AppData\Local\Temp\advcqohbrf"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe
stacmgtbb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
900C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe /stext "C:\Users\admin\AppData\Local\Temp\qjqjpwx"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe
stacmgtbb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1504"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2040"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2296"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2580"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe
stacmgtbb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Remcos
(PID) Process(2580) stacmgtbb.exe
C2 (1)unllin.com:3211
BotnetChi'm
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-GVMDL4
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
2632"C:\Users\admin\AppData\Roaming\wlanext.exe" C:\Users\admin\AppData\Roaming\wlanext.exe—EQNEDT32.EXE
User:
admin
Company:
session
Integrity Level:
MEDIUM
Description:
budge
Exit code:
0
Version:
22.0.0.1
Modules
Images
c:\users\admin\appdata\roaming\wlanext.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2736"C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe" C:\Users\admin\AppData\Local\Temp\stacmgtbb.exe—wlanext.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stacmgtbb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
5 109
Read events
4 628
Write events
444
Delete events
37

Modification events

(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(2040) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
5
Suspicious files
16
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRF79F.tmp.cvr —
MD5:—
SHA256:—
1504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFCB0.tmp.cvr —
MD5:—
SHA256:—
2040EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\13BF8667.emfbinary
MD5:74F0C32D533F97416209356E1C728BFF
SHA256:4D33E34C667FE1F31C55E405C364497A05E36F568573658F65242CDF5103800C
2040EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7055DD3C.emfbinary
MD5:1F849B6E9FF724628F0224109752E5E1
SHA256:8F3EECEC666B49D66BA52BC574FC1A0E41C5B7C7B71DE48957E67816EA6D304E
1504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Microsoftencryptedentirepcfileforprotectfilefromthesecuritybreachfromtheoutsideconnectons.Doc.urltext
MD5:1C22C505089AB6E47BAA5C2253BF44EB
SHA256:DF4489D2FB03C30EB148E971C212C9AB97503AE3430AC1378B53D94CF8DC41E4
2632wlanext.exeC:\Users\admin\AppData\Local\Temp\wuxdijhcdd.hzbinary
MD5:FC274BAA9EDBBCCE1933E65D85AB75E9
SHA256:0B78425C65EF550F5465A021A988F7D66F4A78D6172D3CC26326636B6A10F14B
1504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{599C990D-AE83-431C-86C3-C27945141FCB}binary
MD5:42276C5377400D897B71C90E848EA16C
SHA256:F8A123C6AE0707A7358547961EBA80F3E1A437BA6AE1C765390050FC4D2DB18A
680stacmgtbb.exeC:\Users\admin\AppData\Local\Temp\bhv2537.tmp —
MD5:—
SHA256:—
2040EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Microsoftencryptedentirepcfileforprotectfilefromthesecuritybreachfromtheoutsideconnectons[1].doctext
MD5:700ADE07F6E8306DB7F601F7841A47AC
SHA256:046ADC0B42D803C79C4CD7CEA789D553A5B9F0BAC6EB9C03C126731C3BCAF7C0
1504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:D471A0BB5F0B8A9AC834E0172491B7F9
SHA256:418B6AE0A39787583DCD77DA0ED040F8C3DDA03410E71D04C235EE6E736F298F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
21
DNS requests
5
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1504
WINWORD.EXE
OPTIONS
200
85.195.105.118:80
http://85.195.105.118/mjg/
unknown
—
—
unknown
2040
EXCEL.EXE
GET
200
85.195.105.118:80
http://85.195.105.118/mjg/Microsoftencryptedentirepcfileforprotectfilefromthesecuritybreachfromtheoutsideconnectons.Doc
unknown
text
56.7 Kb
unknown
1504
WINWORD.EXE
HEAD
200
85.195.105.118:80
http://85.195.105.118/mjg/Microsoftencryptedentirepcfileforprotectfilefromthesecuritybreachfromtheoutsideconnectons.Doc
unknown
—
—
unknown
828
svchost.exe
OPTIONS
200
85.195.105.118:80
http://85.195.105.118/mjg/
unknown
html
339 b
unknown
828
svchost.exe
OPTIONS
301
85.195.105.118:80
http://85.195.105.118/mjg
unknown
html
339 b
unknown
828
svchost.exe
PROPFIND
301
85.195.105.118:80
http://85.195.105.118/mjg
unknown
html
339 b
unknown
828
svchost.exe
PROPFIND
405
85.195.105.118:80
http://85.195.105.118/mjg/
unknown
html
330 b
unknown
1504
WINWORD.EXE
HEAD
200
85.195.105.118:80
http://85.195.105.118/mjg/Microsoftencryptedentirepcfileforprotectfilefromthesecuritybreachfromtheoutsideconnectons.Doc
unknown
—
—
unknown
—
—
PROPFIND
405
85.195.105.118:80
http://85.195.105.118/mjg/
unknown
html
330 b
unknown
—
—
PROPFIND
301
85.195.105.118:80
http://85.195.105.118/mjg
unknown
html
339 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2040
EXCEL.EXE
85.195.105.118:80
—
Host Europe GmbH
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1504
WINWORD.EXE
85.195.105.118:80
—
Host Europe GmbH
DE
unknown
828
svchost.exe
85.195.105.118:80
—
Host Europe GmbH
DE
unknown
2296
EQNEDT32.EXE
85.195.105.118:80
—
Host Europe GmbH
DE
unknown
2580
stacmgtbb.exe
91.92.252.51:3211
unllin.com
—
BG
unknown
2580
stacmgtbb.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
unllin.com
  • 91.92.252.51
malicious
geoplugin.net
  • 178.237.33.50
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2040
EXCEL.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
2040
EXCEL.EXE
Potentially Bad Traffic
ET HUNTING Suspicious Request for Doc to IP Address with Terse Headers
1504
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
1504
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
2040
EXCEL.EXE
Potentially Bad Traffic
ET INFO Possible RTF File With Obfuscated Version Header
1504
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
2296
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2296
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2296
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2296
EQNEDT32.EXE
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Exploit.Siggen3.44196.10663.31208