| File name: | 7ccf88c0bbe3b29bf19d877c4596a8d4.zip |
| Full analysis: | https://app.any.run/tasks/8d2a79d9-f35c-4f33-a2c1-d94b8ab9b8f3 |
| Verdict: | Malicious activity |
| Analysis date: | June 21, 2025, 11:15:40 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | ADEE407A5D9F4425707FE5BD4C25AA14 |
| SHA1: | 5A99F6B3B106DAF23BA2C29F2FF94CB118703414 |
| SHA256: | A53DB45F1D4A2F36EBC0B0E268D2073BABA89CA6C1D05FE9A06EF395E8658A51 |
| SSDEEP: | 1536:jjaEudvK51sOagtBDPihqGGJRvbB8lmAqQap28rxmQ3wIUG7ChXtZlYGdf:jejdvK17JKhqNjv3p2oxzw67CVtZlYi |
MALICIOUS
Phishing document has been detected
- WinRAR.exe (PID: 1500)
- EXCEL.EXE (PID: 2856)
Equation Editor starts application (likely CVE-2017-11882)
- EQNEDT32.EXE (PID: 2444)
Gets TEMP folder path (SCRIPT)
- wscript.exe (PID: 2816)
Gets a file object corresponding to the file in a specified path (SCRIPT)
- wscript.exe (PID: 2816)
Accesses environment variables (SCRIPT)
- wscript.exe (PID: 2816)
Deletes a file (SCRIPT)
- wscript.exe (PID: 2816)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Uses base64 encoding (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Creates internet connection object (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Checks whether a specified folder exists (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Opens an HTTP connection (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Unusual execution from MS Office
- EXCEL.EXE (PID: 2856)
Sends HTTP request (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
SUSPICIOUS
Starts CMD.EXE for commands execution
- EQNEDT32.EXE (PID: 2444)
- wscript.exe (PID: 2816)
Reads the Internet Settings
- wscript.exe (PID: 2816)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Runs shell command (SCRIPT)
- wscript.exe (PID: 2816)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 2816)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
The process executes VB scripts
- cmd.exe (PID: 1276)
- EXCEL.EXE (PID: 2856)
Detected use of alternative data streams (AltDS)
- EXCEL.EXE (PID: 2856)
- cscript.exe (PID: 1380)
Reads data from a binary Stream object (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Creates XML DOM element (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Sets XML DOM element text (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Changes charset (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Writes binary data to a Stream object (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Checks whether a specific file exists (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Gets full path of the running script (SCRIPT)
- cscript.exe (PID: 2652)
Reads settings of System Certificates
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Saves data to a binary file (SCRIPT)
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Creates file in the systems drive root
- ntvdm.exe (PID: 1736)
INFO
Reads the computer name
- EQNEDT32.EXE (PID: 2444)
Reads Microsoft Office registry keys
- WinRAR.exe (PID: 1500)
Reads the machine GUID from the registry
- EQNEDT32.EXE (PID: 2444)
Checks supported languages
- EQNEDT32.EXE (PID: 2444)
Changes file name
- cmd.exe (PID: 3228)
Creates files in the program directory
- EXCEL.EXE (PID: 2856)
- cscript.exe (PID: 1380)
Reads security settings of Internet Explorer
- cscript.exe (PID: 2652)
- cscript.exe (PID: 1380)
Reads the software policy settings
- cscript.exe (PID: 1380)
- cscript.exe (PID: 2652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 788 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2021:03:14 21:04:16 |
| ZipCRC: | 0x2bf8580d |
| ZipCompressedSize: | 69232 |
| ZipUncompressedSize: | 2793487 |
| ZipFileName: | ORDER SHEET & SPEC.xlsm |
Total processes
55
Monitored processes
11
Malicious processes
8
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1276 | "C:\Windows\System32\cmd.exe" /c cscript C:\Users\admin\AppData\Local\Temp\xx.vbs | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1380 | "C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs | C:\Windows\System32\cscript.exe | EXCEL.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1500 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\7ccf88c0bbe3b29bf19d877c4596a8d4.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1736 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\System32\ntvdm.exe | cscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 2652 | cscript C:\Users\admin\AppData\Local\Temp\xx.vbs | C:\Windows\System32\cscript.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2816 | WSCrIpT C:\Users\admin\AppData\Local\Temp\v?..wsf C | C:\Windows\System32\wscript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2856 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | WinRAR.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3228 | cMD /c REN %tmp%\q v& WSCrIpT %tmp%\v?..wsf C | C:\Windows\System32\cmd.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
13 607
Read events
13 290
Write events
181
Delete events
136
Modification events
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (1080) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: D4DA6D2861EC | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1500) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
Executable files
0
Suspicious files
5
Text files
13
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2856 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR4F92.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2856 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso5242.tmp | — | |
MD5:— | SHA256:— | |||
| 1500 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb1500.36191\ORDER SHEET & SPEC.xlsm | document | |
MD5:7CCF88C0BBE3B29BF19D877C4596A8D4 | SHA256:7BCD31BD41686C32663C7CABF42B18C50399E3B3B4533FC2FF002D9F2E058813 | |||
| 2856 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6B2E81E5.emf | binary | |
MD5:1DA917FE3A7E876F3F711FE30E1F46DB | SHA256:4D4D1E7B04C99DCB8E885915068AD6F74CC2333E91580CDAE5CCAA00C427247F | |||
| 2856 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\56F05474.emf | binary | |
MD5:B59DD20DE3FDC50CD6B3C4BAF9C12DE8 | SHA256:979DDE2AED02F077C16AE53546C6DF9EED40E8386D6DB6FC36AEE9F966D2CB82 | |||
| 3228 | cmd.exe | C:\Users\admin\AppData\Local\Temp\v | html | |
MD5:EF556C44786A88CDF0F705AC03D9099A | SHA256:6CE8F2114ACAC0CE2EED32D302A6A40185D3388CAA722B0724DA2AEBDEABEB3C | |||
| 1380 | cscript.exe | C:\ProgramData\Podaliri4.exe | html | |
MD5:FA172C77ABD7B03605D83CD1AE373657 | SHA256:B0C7E6712ECBF97A1E3A14F19E3AED5DBD6553F21A2852565BFC5518925713DB | |||
| 2816 | wscript.exe | C:\Users\admin\AppData\Local\Temp\xx.vbs | text | |
MD5:03D7DF9993352270E6A5497B895E79A8 | SHA256:4779756453533076AEE716817D417968F4C462E1868D1A6196006EEA0C9B6E1B | |||
| 2856 | EXCEL.EXE | C:\ProgramData\asc.txt:script1.vbs | text | |
MD5:6196CE936B2131935E89615965438ED4 | SHA256:2EAA9D08D7E29C99D616AACCC4728F120E1E9A14816FECAB17F388665A89B6E4 | |||
| 1736 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs9EBD.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1380 | cscript.exe | 177.11.52.83:443 | multiwaretecnologia.com.br | Brasil Site Informatica LTDA | BR | malicious |
2652 | cscript.exe | 177.11.52.83:443 | multiwaretecnologia.com.br | Brasil Site Informatica LTDA | BR | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
multiwaretecnologia.com.br |
| malicious |