File name:

test

Full analysis: https://app.any.run/tasks/bf63d828-5857-4ecc-9e02-2ff8d2bbb959
Verdict: Malicious activity
Analysis date: May 24, 2019, 06:25:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: fuwotawvlaw, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed May 22 19:15:00 2019, Last Saved Time/Date: Wed May 22 19:15:03 2019, Security: 1
MD5:

DCFA396E3F500D67AFA7157ADB639819

SHA1:

75644FF60C808363A7AC369359FF689537559C96

SHA256:

B51FA7678B7B6EFE4B9D999AF0BE30FDF1D0CF21E8D35522AB9E2F216E409150

SSDEEP:

6144:RxEtjPOtioVjDGUU1qfDlavx+W2QnA57jE3O4E4e4444R4444dPD468invV+rtyx:Lg3GzmVKPeyeazDqmaMdNT1FTJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2828)

    • Application was dropped or rewritten from another process

      • defupdate70.exe (PID: 3216)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2828)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2828)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: fuwotawvlaw
LastModifiedBy: Windows User
Software: Microsoft Excel
CreateDate: 2019:05:22 18:15:00
ModifyDate: 2019:05:22 18:15:03
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Company: tisvrekavafi
AppVersion: 14
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start excel.exe defupdate70.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2828"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3216C:\Users\admin\Contacts\defupdate70.exe //E:jscript C:\Users\admin\AppData\Local\Temp\icasbetv.txtC:\Users\admin\Contacts\defupdate70.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
3221226540
Version:
5.8.7600.16385
Modules
Images
c:\users\admin\contacts\defupdate70.exe
c:\systemroot\system32\ntdll.dll
Total events
565
Read events
471
Write events
87
Delete events
7

Modification events

(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:vv?
Value:
76763F000C0B0000010000000000000000000000
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
0C0B0000AEB59A79F911D50100000000
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:vv?
Value:
76763F000C0B0000010000000000000000000000
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2828) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\14EA40
Operation:writeName:14EA40
Value:
040000000C0B00002A00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0074006500730074002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00010000000000000080186A7AF911D50140EA140040EA140000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
0
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2828EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRE667.tmp.cvr —
MD5:—
SHA256:—
2828EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:—
SHA256:—
2828EXCEL.EXEC:\Users\admin\AppData\Local\Temp\icasbetv.txttext
MD5:—
SHA256:—
2828EXCEL.EXEC:\Users\admin\Contacts\defupdate70.exeexecutable
MD5:F36B7461FECDCF763FDEFA3A3352CD45
SHA256:BD7B57A9303F0156E0737E9768A70F841B222A3E07E1426ECCCFFFDF2737BFE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info