File name:

faktura577.xls

Full analysis: https://app.any.run/tasks/2c2816fd-021b-4298-8dd2-de50023e642e
Verdict: Malicious activity
Analysis date: June 19, 2025, 12:25:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
macros40
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: openpyxl, Last Saved By: MalfindLabs, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jul 18 15:55:39 2022, Last Saved Time/Date: Mon Jul 18 15:58:22 2022, Security: 0
MD5:

4B0719D1907F7C4B5E599F2B5696329A

SHA1:

CA58CB833331AF0F6E5783460B589FF60B0D7685

SHA256:

A77E9B7E7130BF95EAD698825DC9500C11F08B156F4D1AA552DA920CEAAEFC6B

SSDEEP:

6144:aMHCpAjCaLf+5FTXb0VaHNJ8qi+SOkSEl8kaWOrPZ1ogL4I:aMHCgbLcJZb8qitR8rWOrPZ5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Calls Win API functions (MACROS)

      • EXCEL.EXE (PID: 3752)

    • Unusual execution from MS Office

      • EXCEL.EXE (PID: 3752)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • updater.exe (PID: 5628)

    • Application launched itself

      • updater.exe (PID: 5628)

  • INFO

    • Creates files in the program directory

      • DWWIN.EXE (PID: 6636)

    • Creates files or folders in the user directory

      • DWWIN.EXE (PID: 6636)

    • Reads the software policy settings

      • DWWIN.EXE (PID: 6636)

    • Checks proxy server information

      • DWWIN.EXE (PID: 6636)

    • Checks supported languages

      • updater.exe (PID: 5628)
      • updater.exe (PID: 6776)

    • Reads Microsoft Office registry keys

      • DWWIN.EXE (PID: 6636)

    • Reads the computer name

      • updater.exe (PID: 5628)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 5628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: openpyxl
LastModifiedBy: MalfindLabs
Software: Microsoft Excel
CreateDate: 2022:07:18 15:55:39
ModifyDate: 2022:07:18 15:58:22
Security: None
CodePage: Windows Latin 1 (Western European)
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet
  • Macro1
HeadingPairs:
  • Worksheets
  • 1
  • Excel 4.0 Macros
  • 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe dwwin.exe updater.exe no specs updater.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3752"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" C:\Users\admin\AppData\Local\Temp\faktura577.xlsC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\combase.dll
5628"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6492C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6636C:\WINDOWS\system32\dwwin.exe -x -s 4608C:\Windows\System32\DWWIN.EXE
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Error Reporting
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dwwin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
6776"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
8 768
Read events
8 536
Write events
217
Delete events
15

Modification events

(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\StartupItems
Operation:writeName:7z2
Value:
377A3200A80E000001000000000000003BA1AC4415E1DB0100000000
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
Operation:writeName:ImmersiveWorkbookDirtySentinel
Value:
0
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Excel
Operation:writeName:ExcelPreviousSessionId
Value:
{A5607F09-F473-4EF9-B80D-98AD68EC97D2}
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:FilePath
Value:
officeclient.microsoft.com\3E8EB904-C946-4E9D-A475-59EA8830A7E0
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:StartDate
Value:
102EEF4415E1DB01
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:EndDate
Value:
10EE586FDEE1DB01
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\3752
Operation:writeName:0
Value:
0B0E10097F60A573F4F94EB80D98AD68EC97D2230046DDE995A5D4A2F8ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511A81DD2120965007800630065006C002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(3752) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
Executable files
0
Suspicious files
6
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
6636DWWIN.EXEC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_EXCEL.EXE_1d36ef4729d5ee8385674ece8dff4b8acaf9b67d_00000000_e5217641-5d4f-4895-8f79-0600d5f165b8\Report.wer —
MD5:—
SHA256:—
3752EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3E8EB904-C946-4E9D-A475-59EA8830A7E0xml
MD5:032F6ABF4D65E7E719B0E3A469708ABF
SHA256:74EB36423D0C22C3697CBACFC79B30175E37F089B12A4EEB9558DCDD6CE98FFC
3752EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:74DE7B80E0BAF3A7D06A539C1C0C58DD
SHA256:B77E5D500BE0E0ACAEC51A242E6870A04F6B92410952824664DFFCEB332F881C
6636DWWIN.EXEC:\ProgramData\Microsoft\Windows\WER\Temp\WER8202.tmp.xmlxml
MD5:858A9655091277745FB94548B1C80E88
SHA256:4629D75B3CCF149FDCC6317BD50C5F8994F46635DA8ECE7C1536F13118C9B2F3
6636DWWIN.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:3BCDE3BCA04C8061FAD8EE9D5D69871D
SHA256:F3F8322643C031F7D4253783236666419D9D3275FA28BB6815ABE747777B1E16
3752EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFF6183CEBC40F24A1.TMPgmc
MD5:97F171955C5B264B547DE3FF5EC91877
SHA256:BBE1256C0BD5A24A5A59A057884565987584AE2EAF659689FF994D7877E280DE
3752EXCEL.EXEC:\Users\admin\AppData\Local\Temp\faktura577.xlsdocument
MD5:60EC8856FF482895A0DD4150C9A817BD
SHA256:62467C7943085707A634AD869618A12F4E0666DF25C2917C014C66F797CFC8D2
6636DWWIN.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:5B63C0144C61100C949E65C9B4C7B790
SHA256:51E7A9D4403161514027724D012C19E4717FD92CC87B31049944A37B40228B8E
6776updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:E16DA8A3A452644A63D25DD0164609EF
SHA256:FDC7C04DCB5B6A37C9651707A784199533FB289DFA28DA393EE3C020471309CF
3752EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Excel\~ar6F78.xardocument
MD5:B0E4195BBA0E2AE7EC6CBC45A7D39714
SHA256:69B2C3FD985C7ECA658ABC1F4AB03D899574602A71A209CE9E8A21B901ADDCCF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3944
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6636
DWWIN.EXE
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6636
DWWIN.EXE
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5124
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5124
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2792
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3752
EXCEL.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
3752
EXCEL.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3944
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3944
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.14
  • 20.190.160.132
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
faktura577.xls