analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ac153b46b840b4ab3aeb24fcad17af50dde14219.xls

Full analysis: https://app.any.run/tasks/c262c967-f396-40a6-8983-80136cc19ab7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 08:32:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: DELL, Last Saved By: DELL, Create Time/Date: Tue Sep 29 23:55:16 2020, Last Saved Time/Date: Tue Sep 29 23:55:16 2020, Security: 0
MD5:

92D5A9DF9D57FB24A494D650B38D6744

SHA1:

AC153B46B840B4AB3AEB24FCAD17AF50DDE14219

SHA256:

8A016A0664275EB475617CF629570DA3A41CDE89F18C4E05D83088BCD5656A7E

SSDEEP:

6144:tk3hOdsylKlgryzc4bNhZF+E+W2knwyNyMd4B7t0K8JSHIe6cJBDZKcHpH9szWEo:EyMd4ltuJqbDZKcJdszkSwkT62q5n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 1132)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 1132)

    • Application was dropped or rewritten from another process

      • svchost32.exe (PID: 3200)
      • dmgy.exe (PID: 1976)
      • InstallUtil.exe (PID: 2632)

    • Downloads executable files from IP

      • EXCEL.EXE (PID: 1132)

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 1132)

    • Loads dropped or rewritten executable

      • svchost32.exe (PID: 3200)
      • dmgy.exe (PID: 1976)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3808)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 2632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • svchost32.exe (PID: 3200)

    • Starts CMD.EXE for commands execution

      • svchost32.exe (PID: 3200)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3820)

    • Starts itself from another location

      • svchost32.exe (PID: 3200)

    • Reads Environment values

      • InstallUtil.exe (PID: 2632)

  • INFO

    • Creates files in the user directory

      • EXCEL.EXE (PID: 1132)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1132)

    • Reads Internet Cache Settings

      • EXCEL.EXE (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: DELL
LastModifiedBy: DELL
CreateDate: 2020:09:29 22:55:16
ModifyDate: 2020:09:29 22:55:16
Security: None
CodePage: Windows Latin 1 (Western European)
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet 1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start excel.exe svchost32.exe cmd.exe no specs reg.exe dmgy.exe no specs installutil.exe

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3200"C:\Users\Public\svchost32.exe" C:\Users\Public\svchost32.exe
EXCEL.EXE
User:
admin
Company:
z&82b[m@16y+]5q7g_,9
Integrity Level:
MEDIUM
Description:
6o~d{4?8i1z@p%37a;h
Exit code:
0
Version:
9.13.18.22
3820"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nore /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\admin\dmgy.exe"C:\Windows\system32\cmd.exe—svchost32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3808REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v nore /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\admin\dmgy.exe"C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1976"C:\Users\admin\dmgy.exe" C:\Users\admin\dmgy.exe—svchost32.exe
User:
admin
Company:
z&82b[m@16y+]5q7g_,9
Integrity Level:
MEDIUM
Description:
6o~d{4?8i1z@p%37a;h
Exit code:
0
Version:
9.13.18.22
2632"C:\Users\admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\admin\AppData\Local\Temp\InstallUtil.exe
dmgy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
942
Read events
867
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
1132EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRC6DB.tmp.cvr —
MD5:—
SHA256:—
1132EXCEL.EXEC:\Users\Public\svchost32.exeexecutable
MD5:380D86112C2807B5E1AAD32BAF8E832F
SHA256:11BDF1B9E83AA6E95B3F8DC0B4F2F949C6F21958F11B006FD35316671EB047AA
1132EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:947975EF545AA81E07698B5324984BB0
SHA256:5C1BF004434D389E4AFCCE1A47905C8A3CB99FC55070E43EF968FDE43D4669F8
1132EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PSO-1105[1].jpgexecutable
MD5:380D86112C2807B5E1AAD32BAF8E832F
SHA256:11BDF1B9E83AA6E95B3F8DC0B4F2F949C6F21958F11B006FD35316671EB047AA
3200svchost32.exeC:\Users\admin\dmgy.exeexecutable
MD5:380D86112C2807B5E1AAD32BAF8E832F
SHA256:11BDF1B9E83AA6E95B3F8DC0B4F2F949C6F21958F11B006FD35316671EB047AA
1132EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ac153b46b840b4ab3aeb24fcad17af50dde14219.xls.LNKlnk
MD5:757F3D137B91EC321A38EAFD37A85853
SHA256:85E6A4D40E51BE61C4DA145F4D5B73D77E21599CBB0391599998EAA87298145B
3200svchost32.exeC:\Users\admin\AppData\Local\Temp\InstallUtil.exeexecutable
MD5:91C9AE9C9A17A9DB5E08B120E668C74C
SHA256:E56A7E5D3AB9675555E2897FC3FAA2DD9265008A4967A7D54030AB8184D2D38F
3200svchost32.exeC:\Users\admin\AppData\Local\Temp\a6a0b8a6-4761-4357-9a31-0eca6ad70093\f.dllexecutable
MD5:14FF402962AD21B78AE0B4C43CD1F194
SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1132
EXCEL.EXE
GET
200
185.33.85.52:80
http://185.33.85.52/FR/PSO-1105.jpg
GB
executable
404 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2632
InstallUtil.exe
174.129.214.20:443
api.ipify.org
Amazon.com, Inc.
US
suspicious
2632
InstallUtil.exe
77.88.21.158:587
smtp.yandex.ru
YANDEX LLC
RU
whitelisted
1132
EXCEL.EXE
185.33.85.52:80
—
—
GB
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 174.129.214.20
shared
smtp.yandex.ru
  • 77.88.21.158
shared

Threats

PID
Process
Class
Message
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2632
InstallUtil.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ac153b46b840b4ab3aeb24fcad17af50dde14219.xls