analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ad8bbe23815aa1b805d78d3dc414ccfbd0b827909926e0b180185013cfe7dbea

Full analysis: https://app.any.run/tasks/51fae48b-a256-4579-bb58-b268cde2cf53
Verdict: Malicious activity
Analysis date: July 18, 2019, 07:09:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
maldoc-17
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: op, Last Saved By: op, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jun 27 22:08:42 2018, Last Saved Time/Date: Wed Jun 27 22:08:43 2018, Security: 0
MD5:

0934FF998B2A9D3B7C17EE28FA533606

SHA1:

4A2441CABE39396600F50852C9F5C6FC45A97D79

SHA256:

AD8BBE23815AA1B805D78D3DC414CCFBD0B827909926E0B180185013CFE7DBEA

SSDEEP:

768:Mck3hOdsylKlgryzc4bNhZFGzE+cL2knAJphFYEFuPvNOiCPKLTumuLSzHKdXPWf:rk3hOdsylKlgryzc4bNhZFGzE+cL2knz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • P7Q8A4J3.exe (PID: 3396)
    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 3520)
    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3520)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3520)
    • Creates files in the user directory

      • EXCEL.EXE (PID: 3520)
    • Application was crashed

      • P7Q8A4J3.exe (PID: 3396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: op
LastModifiedBy: op
Software: Microsoft Excel
CreateDate: 2018:06:27 21:08:42
ModifyDate: 2018:06:27 21:08:43
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start excel.exe p7q8a4j3.exe

Process information

PID
CMD
Path
Indicators
Parent process
3520"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3396C:\Users\admin\AppData\Roaming\Microsoft\AddIns\P7Q8A4J3.exeC:\Users\admin\AppData\Roaming\Microsoft\AddIns\P7Q8A4J3.exe
EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Total events
450
Read events
421
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3520EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRD05F.tmp.cvr
MD5:
SHA256:
3520EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:4F21E001AA2F157403BDC13723B17102
SHA256:17B1D42CFC4A73416542C10814402F0FD97099B9A967EBBB1FF3239ACA2056AC
3520EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ad8bbe23815aa1b805d78d3dc414ccfbd0b827909926e0b180185013cfe7dbea.xls.LNKlnk
MD5:DBE40D48295F55770239070DE4029602
SHA256:D24F139EC2F0AF5325408A01DEFE44A401EAFB8A82A647723122EC1437A1A03D
3520EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\AddIns\P7Q8A4J3.exeexecutable
MD5:41A909472D887C9225BE558D75E61470
SHA256:A98AA9DF7DCCD71BB1DE63026FE9CEC5FA83796358AEC8DA4E219FC934E5E643
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info