File name:

ORDER SHEET & SPEC.xlsm

Full analysis: https://app.any.run/tasks/d534930e-80e8-4306-aa44-945ae672673a
Verdict: Malicious activity
Analysis date: February 06, 2024, 03:46:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
ole-embedded
macros-on-open
exploit
cve-2017-11882
Indicators:
MIME: application/octet-stream
File info: Microsoft OOXML
MD5:

7CCF88C0BBE3B29BF19D877C4596A8D4

SHA1:

23F0506D857D38C3CD5354B80AFC725B5F034744

SHA256:

7BCD31BD41686C32663C7CABF42B18C50399E3B3B4533FC2FF002D9F2E058813

SSDEEP:

1536:Hhh3S1cLkPROxXYvoYIZCMMV2ZX0nIcjELcE3E:0cCOxtYIEbsX0n98E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1172)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 2088)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 2088)
      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 2088)

    • Uses base64 encoding (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Unusual execution from MS Office

      • EXCEL.EXE (PID: 268)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 2088)

    • Checks whether a specified folder exists (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Opens an HTTP connection (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Creates internet connection object (SCRIPT)

      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

    • Sends HTTP request (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Unusual connection from system programs

      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2088)
      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Reads the Internet Settings

      • wscript.exe (PID: 2088)
      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2088)
      • EQNEDT32.EXE (PID: 1172)

    • Detected use of alternative data streams (AltDS)

      • cscript.exe (PID: 3600)
      • EXCEL.EXE (PID: 268)

    • Creates XML DOM element (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Sets XML DOM element text (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • The process executes VB scripts

      • EXCEL.EXE (PID: 268)
      • cmd.exe (PID: 3416)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2088)
      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Changes charset (SCRIPT)

      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 2508)

    • Saves data to a binary file (SCRIPT)

      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

    • Reads settings of System Certificates

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

    • Adds/modifies Windows certificates

      • cscript.exe (PID: 3600)
      • cscript.exe (PID: 2508)

  • INFO

    • Reads the computer name

      • EQNEDT32.EXE (PID: 1172)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 1172)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 1172)

    • The process uses the downloaded file

      • EXCEL.EXE (PID: 268)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2508)
      • cscript.exe (PID: 3600)

    • Creates files in the program directory

      • EXCEL.EXE (PID: 268)
      • cscript.exe (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (45.9)
.xlsx | Excel Microsoft Office Open XML Format document (27.1)
.zip | Open Packaging Conventions container (13.9)
.ubox | Universe Sandbox simulation (9.6)
.zip | ZIP compressed archive (3.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:01:28 11:55:34
ZipCRC: 0xcdc0e5bf
ZipCompressedSize: 427
ZipUncompressedSize: 1789
ZipFileName: [Content_Types].xml

XML

Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • Worksheets
  • 3
TitlesOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
LastModifiedBy: Windows
CreateDate: 2020:02:01 18:28:07Z
ModifyDate: 2020:02:01 18:32:27Z

XMP

Creator: Windows
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
9
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs eqnedt32.exe cmd.exe no specs wscript.exe no specs cmd.exe no specs cscript.exe cscript.exe ntvdm.exe no specs ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1172"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2088WSCrIpT C:\Users\admin\AppData\Local\Temp\v?..wsf  CC:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448cMD /c REN %tmp%\q v& WSCrIpT %tmp%\v?..wsf  CC:\Windows\System32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2508cscript C:\Users\admin\AppData\Local\Temp\xx.vbsC:\Windows\System32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3416"C:\Windows\System32\cmd.exe" /c cscript C:\Users\admin\AppData\Local\Temp\xx.vbsC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3600"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbsC:\Windows\System32\cscript.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3828"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3924"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\System32\ntvdm.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
7 833
Read events
7 696
Write events
112
Delete events
25

Modification events

(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
0
Suspicious files
2
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
268EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR380C.tmp.cvr —
MD5:—
SHA256:—
268EXCEL.EXEC:\Users\admin\AppData\Local\Temp\qhtml
MD5:EF556C44786A88CDF0F705AC03D9099A
SHA256:6CE8F2114ACAC0CE2EED32D302A6A40185D3388CAA722B0724DA2AEBDEABEB3C
268EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5D59E2D7.emfbinary
MD5:1DA917FE3A7E876F3F711FE30E1F46DB
SHA256:4D4D1E7B04C99DCB8E885915068AD6F74CC2333E91580CDAE5CCAA00C427247F
3828ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs87A3.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
2088wscript.exeC:\Users\admin\AppData\Local\Temp\xx.vbstext
MD5:03D7DF9993352270E6A5497B895E79A8
SHA256:4779756453533076AEE716817D417968F4C462E1868D1A6196006EEA0C9B6E1B
268EXCEL.EXEC:\programdata\asc.txt:script1.vbstext
MD5:6196CE936B2131935E89615965438ED4
SHA256:2EAA9D08D7E29C99D616AACCC4728F120E1E9A14816FECAB17F388665A89B6E4
3828ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs87B4.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
3924ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs8BBB.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
268EXCEL.EXEC:\Users\admin\AppData\Local\Temp\xx:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
268EXCEL.EXEC:\Users\admin\AppData\Local\Temp\xxtext
MD5:03D7DF9993352270E6A5497B895E79A8
SHA256:4779756453533076AEE716817D417968F4C462E1868D1A6196006EEA0C9B6E1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3600
cscript.exe
177.53.143.89:443
multiwaretecnologia.com.br
Brasil Site Informatica LTDA
BR
unknown
2508
cscript.exe
177.53.143.89:443
multiwaretecnologia.com.br
Brasil Site Informatica LTDA
BR
unknown

DNS requests

Domain
IP
Reputation
multiwaretecnologia.com.br
  • 177.53.143.89
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ORDER SHEET & SPEC.xlsm