Malware analysis N°26-MRC-1880-PREVISION-EMBARQUEMENT.xlsx Malicious activity

Add for printing

File name:	N°26-MRC-1880-PREVISION-EMBARQUEMENT.xlsx
Full analysis:	https://app.any.run/tasks/cda7636c-f115-41a6-a848-077cb7342c17
Verdict:	Malicious activity
Analysis date:	April 15, 2019, 12:29:23
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	exploit CVE-2017-11882
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info:	Microsoft Excel 2007+
MD5:	02D4DACF50B68FE32EF3DE5E258B5982
SHA1:	22D3BFCC1D0C0157BB83E8E48C49D2FAC025E7ED
SHA256:	9A7635636CEE43E428858BAF76304152384150FC8A7D005A757E1276FF045EE5
SSDEEP:	96:RcBk/+91dd+kJfjF0fkP3YlEoQXBKQmmXzbU6lEvCkfLSQhxyZxPAL+5CcglH4ZA:OqVhUMqXdXzriCkTLnyZWC5C3krllVu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Equation Editor starts application (CVE-2017-11882)
  - EQNEDT32.EXE (PID: 676)
SUSPICIOUS
- Creates files in the user directory
  - EQNEDT32.EXE (PID: 676)
- Executes application which crashes
  - EQNEDT32.EXE (PID: 676)
INFO
- Reads Microsoft Office registry keys
  - EXCEL.EXE (PID: 3044)
- Creates files in the user directory
  - EXCEL.EXE (PID: 3044)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.xlsx	\|	Excel Microsoft Office Open XML Format document (61.2)
.zip	\|	Open Packaging Conventions container (31.5)
.zip	\|	ZIP compressed archive (7.2)

EXIF

XML

AppVersion:	16.03
HyperlinksChanged:	No
SharedDoc:	No
LinksUpToDate:	No
Company:	-
TitlesOfParts:	Sheet1
HeadingPairs:	Worksheets 1
ScaleCrop:	No
DocSecurity:	None
Application:	Microsoft Excel
ModifyDate:	2018:09:17 07:54:54Z
CreateDate:	2018:09:17 07:54:41Z
LastModifiedBy:	APPLE PC

XMP

Creator:	APPLE PC

ZIP

ZipFileName:	[Content_Types].xml
ZipUncompressedSize:	1369
ZipCompressedSize:	372
ZipCRC:	0xd5d69ee5
ZipModifyDate:	2019:02:04 22:27:24
ZipCompression:	Deflated
ZipBitFlag:	0x0002
ZipRequiredVersion:	20

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3044	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000
676	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE		svchost.exe
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900
456	"C:\Windows\system32\ntvdm.exe" -i1	C:\Windows\system32\ntvdm.exe	—	EQNEDT32.EXE
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

410

Read events

382

Write events

Delete events

Modification events


(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	write	Name:	!c<
Value: 21633C00E40B0000010000000000000000000000
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:	write	Name:	MTTT
Value: E40B000078C91AE486F3D40100000000
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	delete value	Name:	!c<
Value: 21633C00E40B0000010000000000000000000000
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	delete key	Name:
Value:
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:	delete key	Name:
Value:
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(3044) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\106A55
Operation:	write	Name:	106A55
Value: 04000000E40B00004000000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C004E00B000320036002D004D00520043002D0031003800380030002D0050005200450056004900530049004F004E002D0045004D004200410052005100550045004D0045004E0054002E0078006C0073007800000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C00010000000000000050B88EE586F3D401556A1000556A100000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3044	EXCEL.EXE	C:\Users\admin\AppData\Local\Temp\CVR62F2.tmp.cvr		—
		MD5:—	SHA256:—
456	ntvdm.exe	C:\Users\admin\AppData\Local\Temp\scs71E6.tmp		—
		MD5:—	SHA256:—
456	ntvdm.exe	C:\Users\admin\AppData\Local\Temp\scs71E7.tmp		—
		MD5:—	SHA256:—
3044	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\N°26-MRC-1880-PREVISION-EMBARQUEMENT.xlsx.LNK		lnk
		MD5:FD4362B1D2FBEE466F609C67C8AC6769	SHA256:0DEDD80361AC6176145685675019AC5AC5060B136A8BCEEB551CC428DA349712
3044	EXCEL.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat		text
		MD5:D66E400B76C6F55C711D673F967946CD	SHA256:5664FC65CDCF0E1F5C4AF9900E46771453AE7B155649CD5A3E0346792286FF48
676	EQNEDT32.EXE	C:\Users\admin\AppData\Roaming\Ms_Office.exe		html
		MD5:2C6F0ACB22C00EB765FC3E40878FF7FD	SHA256:60BAB2EB90D144C6C7CD2AE4D88E642E9457C3DCC28ADED40A82855E45CF4B7B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
676	EQNEDT32.EXE	GET	200	185.224.138.107:80	http://olga-pharma.ru/avast/west/ago4.exe	unknown	html	2.37 Kb	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
676	EQNEDT32.EXE	185.224.138.107:80	olga-pharma.ru	—	—	suspicious

DNS requests

Domain	IP	Reputation
olga-pharma.ru	185.224.138.107	malicious

Threats

PID	Process	Class	Message
676	EQNEDT32.EXE	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile

Add for printing

No debug info

General Info

N°26-MRC-1880-PREVISION-EMBARQUEMENT.xlsx

02D4DACF50B68FE32EF3DE5E258B5982

22D3BFCC1D0C0157BB83E8E48C49D2FAC025E7ED

9A7635636CEE43E428858BAF76304152384150FC8A7D005A757E1276FF045EE5

96:RcBk/+91dd+kJfjF0fkP3YlEoQXBKQmmXzbU6lEvCkfLSQhxyZxPAL+5CcglH4ZA:OqVhUMqXdXzriCkTLnyZWC5C3krllVu

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Equation Editor starts application (CVE-2017-11882)

SUSPICIOUS

Creates files in the user directory

Executes application which crashes

INFO

Reads Microsoft Office registry keys

Creates files in the user directory

Malware configuration

Static information

TRiD

EXIF

XML

XMP

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings