Malware analysis Api.xlsx Malicious activity | ANY.RUN

Add for printing

File name:	Api.xlsx
Full analysis:	https://app.any.run/tasks/0b3f5d30-488d-4643-9a10-defcb3967049
Verdict:	Malicious activity
Analysis date:	September 18, 2019, 17:46:50
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	exploit cve-2017-11882 autoit
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info:	Microsoft Excel 2007+
MD5:	D663BADCAA2ED66E46FE2C40070DFB6A
SHA1:	34066DC32E1BD8EC5685FBDD53C675E25AB61B33
SHA256:	9BD3DB55472AA810ED1D87DC72ED5BCBDA9267FE52C61C63D624041D10E62305
SSDEEP:	1536:d8t/oP5QYMMscvJSvn3hhb2mnGh7zMC56Px3DeKpzOamN:d8G1MMVvJSf3hhbA5ACWx3DhpS1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Equation Editor starts application (CVE-2017-11882)
  - EQNEDT32.EXE (PID: 3500)
- Application was dropped or rewritten from another process
  - intel.exe (PID: 2556)
  - gfj.exe (PID: 3360)
- Changes the autorun value in the registry
  - gfj.exe (PID: 3360)
- Writes to a start menu file
  - gfj.exe (PID: 3360)
SUSPICIOUS
- Creates files in the program directory
  - EQNEDT32.EXE (PID: 3500)
- Executed via COM
  - EQNEDT32.EXE (PID: 3500)
- Executable content was dropped or overwritten
  - EQNEDT32.EXE (PID: 3500)
  - intel.exe (PID: 2556)
- Drop AutoIt3 executable file
  - intel.exe (PID: 2556)
- Creates files in the user directory
  - gfj.exe (PID: 3360)
INFO
- Reads Microsoft Office registry keys
  - EXCEL.EXE (PID: 3408)
- Dropped object may contain Bitcoin addresses
  - intel.exe (PID: 2556)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.xlsx	\|	Excel Microsoft Office Open XML Format document (61.2)
.zip	\|	Open Packaging Conventions container (31.5)
.zip	\|	ZIP compressed archive (7.2)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	0x0002
ZipCompression:	Deflated
ZipModifyDate:	2019:09:17 11:20:14
ZipCRC:	0xa97f1e42
ZipCompressedSize:	386
ZipUncompressedSize:	1505
ZipFileName:	[Content_Types].xml

XMP

Creator:	Windows User

XML

LastModifiedBy:	Windows User
CreateDate:	2019:09:11 23:33:40Z
ModifyDate:	2019:09:14 05:13:44Z
Application:	Microsoft Excel
DocSecurity:	None
ScaleCrop:	No
HeadingPairs:	Worksheets 1
TitlesOfParts:	Sheet1
Company:	-
LinksUpToDate:	No
SharedDoc:	No
HyperlinksChanged:	No
AppVersion:	15.03

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2556

"C:\ProgramData\intel.exe"

C:\ProgramData\intel.exe

EQNEDT32.EXE

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\programdata\intel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3360

"C:\Users\admin\AppData\Local\Temp\09141351\gfj.exe" mkkkqe

C:\Users\admin\AppData\Local\Temp\09141351\gfj.exe

intel.exe

User:

admin

Company:

AutoIt Team

Integrity Level:

MEDIUM

Description:

AutoIt v3 Script

Exit code:

Version:

3, 3, 8, 1

Modules

Images
c:\users\admin\appdata\local\temp\09141351\gfj.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll

3408

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Excel

Exit code:

Version:

14.0.6024.1000

Modules

Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll

3500

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

svchost.exe

User:

admin

Company:

Design Science, Inc.

Integrity Level:

MEDIUM

Description:

Microsoft Equation Editor

Exit code:

Version:

00110900

Modules

Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

3908

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

gfj.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft .NET Services Installation Utility

Exit code:

Version:

4.7.3062.0 built by: NET472REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll

Add for printing

Total events

1 710

Read events

1 330

Write events

367

Delete events

Modification events


(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	write	Name:	tp#
Value: 74702300500D0000010000000000000000000000
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:	write	Name:	MTTT
Value: 500D00000AA25E16496ED50100000000
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	delete value	Name:	tp#
Value: 74702300500D0000010000000000000000000000
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:	delete key	Name:
Value:
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:	delete key	Name:
Value:
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(3408) EXCEL.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\16A35A
Operation:	write	Name:	16A35A
Value: 04000000500D00002A00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C004100700069002E0078006C0073007800000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000A0CFF317496ED5015AA316005AA3160000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3408	EXCEL.EXE	C:\Users\admin\AppData\Local\Temp\CVR9C44.tmp.cvr		—
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\mkkkqe		—
		MD5:—	SHA256:—
3500	EQNEDT32.EXE	C:\ProgramData\intel.exe		executable
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\gut.docx		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\hjx.docx		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\sji.icm		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\pui.pdf		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\dmq.xls		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\efh.msc		text
		MD5:—	SHA256:—
2556	intel.exe	C:\Users\admin\AppData\Local\Temp\09141351\krf.txt		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3500	EQNEDT32.EXE	207.174.215.236:80	indulfastag.com	PDR	US	malicious
3908	RegSvcs.exe	79.134.225.61:5552	info1.nowddns.com	Andreas Fink trading as Fink Telecom Services	CH	malicious

DNS requests

Domain	IP	Reputation
indulfastag.com	207.174.215.236	malicious
info1.nowddns.com	79.134.225.61	malicious

Threats

PID	Process	Class	Message
3500	EQNEDT32.EXE	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3500	EQNEDT32.EXE	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP

Add for printing

No debug info

General Info

Api.xlsx

D663BADCAA2ED66E46FE2C40070DFB6A

34066DC32E1BD8EC5685FBDD53C675E25AB61B33

9BD3DB55472AA810ED1D87DC72ED5BCBDA9267FE52C61C63D624041D10E62305

1536:d8t/oP5QYMMscvJSvn3hhb2mnGh7zMC56Px3DeKpzOamN:d8G1MMVvJSf3hhbA5ACWx3DhpS1

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Equation Editor starts application (CVE-2017-11882)

Application was dropped or rewritten from another process

Changes the autorun value in the registry

Writes to a start menu file

SUSPICIOUS

Creates files in the program directory

Executed via COM

Executable content was dropped or overwritten

Drop AutoIt3 executable file

Creates files in the user directory

INFO

Reads Microsoft Office registry keys

Dropped object may contain Bitcoin addresses

Malware configuration

Static information

TRiD

EXIF

ZIP

XMP

XML

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings