File name:

invoice.vb

Full analysis: https://app.any.run/tasks/05a8c248-8056-4f39-beea-105dc609af40
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 19, 2025, 21:50:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
reflection
loader
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

36545FACF925FFA371FEC7578993DE79

SHA1:

5B3E6C6CBDD2E2E82DA43A3FB312516D7ECE2B2C

SHA256:

A9E02A6C316B3D7659B48621015D504820337F1F88DD588B75597DB95750D16E

SSDEEP:

96:bjV3g7zxBiT2eJg2eVpgrfJIOppkwsSAzFtelIxpF+I6p:bj4FBK7DJwKwm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • The DLL Hijacking

      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

  • SUSPICIOUS

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3016)

    • Reads the Internet Settings

      • powershell.exe (PID: 3016)
      • OIS.EXE (PID: 1992)

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 3016)

    • Reads settings of System Certificates

      • OIS.EXE (PID: 1992)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 1920)
      • wmpnscfg.exe (PID: 3380)
      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1920)
      • powershell.exe (PID: 3016)
      • wmpnscfg.exe (PID: 3380)
      • rundll32.exe (PID: 3116)
      • rundll32.exe (PID: 3072)
      • notepad++.exe (PID: 948)
      • OIS.EXE (PID: 3372)

    • The process uses the downloaded file

      • powershell.exe (PID: 3016)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1920)
      • OIS.EXE (PID: 1992)
      • wmpnscfg.exe (PID: 3380)
      • OIS.EXE (PID: 3372)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 3016)

    • Reads Microsoft Office registry keys

      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

    • Reads the machine GUID from the registry

      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

    • Creates files or folders in the user directory

      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

    • Reads Environment values

      • OIS.EXE (PID: 1992)
      • OIS.EXE (PID: 3372)

    • Checks proxy server information

      • OIS.EXE (PID: 1992)

    • Reads the software policy settings

      • OIS.EXE (PID: 1992)

    • Process checks computer location settings

      • OIS.EXE (PID: 3372)

    • Sends debugging messages

      • notepad++.exe (PID: 948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs wmpnscfg.exe no specs powershell.exe no specs cscript.exe no specs rundll32.exe no specs ois.exe wmpnscfg.exe no specs ois.exe no specs rundll32.exe no specs notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\invoice.vb.vba"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1920"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1936"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\invoice.vb.vbaC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1992"C:\PROGRA~1\MICROS~1\Office14\OIS.EXE" /shellOpen "C:\Users\admin\Desktop\invoice.vb.vba"C:\Program Files\Microsoft Office\Office14\OIS.EXE
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office 2010
Version:
14.0.6015.1000
Modules
Images
c:\program files\microsoft office\office14\ois.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2840"C:\Windows\system32\cscript.exe" .\invoice.vb.vbaC:\Windows\System32\cscript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3016"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3072"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\invoice.vb.vbaC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3116"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\invoice.vb.vbaC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3372"C:\PROGRA~1\MICROS~1\Office14\OIS.EXE" /shellOpen "C:\Users\admin\Desktop\invoice.vb.vba"C:\Program Files\Microsoft Office\Office14\OIS.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office 2010
Exit code:
0
Version:
14.0.6015.1000
Modules
Images
c:\program files\microsoft office\office14\ois.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3380"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
15 748
Read events
15 406
Write events
326
Delete events
16

Modification events

(PID) Process:(3016) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3016) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3016) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3016) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3016) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(3116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(3116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
Value:
WordPad
(PID) Process:(3116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(3116) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Internet Explorer\iexplore.exe
Value:
Internet Explorer
Executable files
0
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1992OIS.EXEC:\Users\admin\AppData\Local\Temp\CVRCA3D.tmp.cvr —
MD5:—
SHA256:—
3372OIS.EXEC:\Users\admin\AppData\Local\Temp\CVRFF48.tmp.cvr —
MD5:—
SHA256:—
3016powershell.exeC:\Users\admin\AppData\Local\Temp\esjp5hzj.r1h.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1992OIS.EXEC:\Users\admin\AppData\Local\Microsoft\OIS\OIScatalog.cagtext
MD5:4233258E1B34737ED1FDDDA0F7EF5EB6
SHA256:FFC0081914CBD6CF0C81FED3C307F9087D1F457134035A97999AFA2A3D140657
3016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10b0e3.TMPbinary
MD5:5A00623556D6BC6C84F566966F620FE8
SHA256:B20E4B798FAF1FA57FEB8684829452115A5440F66BF6148B61E4FC8AC8E45366
3016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:9AF2E46B32ED1028032C0C22831E2010
SHA256:B46A630FE1263896280B4C954F025FFFF126D84517C42E330812CDFB572DBA8E
3016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CRQV5XHU58WGS85M0S4I.tempbinary
MD5:9AF2E46B32ED1028032C0C22831E2010
SHA256:B46A630FE1263896280B4C954F025FFFF126D84517C42E330812CDFB572DBA8E
3372OIS.EXEC:\Users\admin\AppData\Local\Microsoft\OIS\thumbnails\76F63954-1.jpgbinary
MD5:EAF8FE98B7B4FFE136FCE674DC28A97C
SHA256:6F8F63BEA64051B4EDE869C0AAA68D874D94CF0D70E349DA978DDFACAF1B0196
3016powershell.exeC:\Users\admin\AppData\Local\Temp\zlrkr5se.3ai.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3016powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:E00D512A872AE898F505BA313D6C9E20
SHA256:679CF7328C716151CA4CBAFD44E0082CFDE2EB03B5E7CDCAFCE428AE956CBE71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1992
OIS.EXE
POST
302
184.30.18.9:80
http://go.microsoft.com/fwlink/?LinkID=120750
unknown
—
—
whitelisted
1992
OIS.EXE
POST
302
184.30.18.9:80
http://go.microsoft.com/fwlink/?LinkID=120751
unknown
—
—
whitelisted
1992
OIS.EXE
POST
302
184.30.18.9:80
http://go.microsoft.com/fwlink/?LinkID=120752
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1992
OIS.EXE
184.30.18.9:80
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1992
OIS.EXE
40.91.76.224:443
activation.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 184.30.18.9
whitelisted
activation.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
invoice.vb