File name:

xls

Full analysis: https://app.any.run/tasks/2bb0c4cf-4946-4635-92e8-eab78b608ce0
Verdict: Malicious activity
Analysis date: August 28, 2024, 16:30:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
macros
macros-on-open
macros-on-close
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Windows User, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Apr 2 07:57:44 2024, Last Saved Time/Date: Tue Apr 2 07:58:03 2024, Security: 0
MD5:

7B5646374BE4AA1252CADFE59A37A900

SHA1:

33DE5A0F75142E99165DF146643E3E5ADF49673B

SHA256:

BA0CCD90AB208C591033A10806A81244047458A68856093687E0D5B739BC28A7

SSDEEP:

12288:U/fCiCqVTSsu1AU3/i4Ia2YZzb3RdZblNPO5StYJaKBsMm9:0fC3K/uOxy/pddZqXMks

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Detects the decoding of a binary file from Base64 (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Uses sleep, probably for evasion (MACROS)

      • EXCEL.EXE (PID: 6836)

    • Checks whether a specified folder exists (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 6836)

    • Microsoft Office executes commands via PowerShell or Cmd

      • EXCEL.EXE (PID: 6836)

    • Unusual execution from MS Office

      • EXCEL.EXE (PID: 6836)

    • Changes the autorun value in the registry

      • gpresult.exe (PID: 4100)

  • SUSPICIOUS

    • Sets XML DOM element text (SCRIPT)

      • splwow64.exe (PID: 2028)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Writes binary data to a Stream object (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Runs shell command (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Checks whether a specific file exists (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 7100)
      • ftp.exe (PID: 4576)
      • cmd.exe (PID: 1840)
      • findstr.exe (PID: 5172)
      • cmd.exe (PID: 4708)
      • expand.exe (PID: 4084)
      • cmd.exe (PID: 2492)
      • gpresult.exe (PID: 4100)
      • notepad++.exe (PID: 892)
      • notepad++.exe (PID: 7084)
      • WinRAR.exe (PID: 3104)
      • EXCEL.EXE (PID: 6412)
      • notepad++.exe (PID: 304)
      • certutil.exe (PID: 2576)

    • Accesses current user name via WMI (SCRIPT)

      • EXCEL.EXE (PID: 6836)

    • Detected use of alternative data streams (AltDS)

      • EXCEL.EXE (PID: 6836)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1840)

    • Starts CMD.EXE for commands execution

      • ftp.exe (PID: 4576)

    • Executable content was dropped or overwritten

      • expand.exe (PID: 4084)

    • Decoding a file from Base64 using CertUtil

      • cmd.exe (PID: 4708)

    • Unpacks CAB file

      • expand.exe (PID: 4084)

    • Drops the executable file immediately after the start

      • expand.exe (PID: 4084)

    • Reads security settings of Internet Explorer

      • gpresult.exe (PID: 4100)

    • Checks Windows Trust Settings

      • gpresult.exe (PID: 4100)

  • INFO

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 2028)

    • Checks supported languages

      • expand.exe (PID: 4084)
      • gpresult.exe (PID: 4100)

    • Reads the machine GUID from the registry

      • expand.exe (PID: 4084)
      • gpresult.exe (PID: 4100)

    • Reads the computer name

      • gpresult.exe (PID: 4100)

    • Reads the software policy settings

      • gpresult.exe (PID: 4100)
      • slui.exe (PID: 1640)
      • slui.exe (PID: 2720)

    • Checks proxy server information

      • gpresult.exe (PID: 4100)
      • slui.exe (PID: 1640)

    • Manual execution by a user

      • notepad++.exe (PID: 892)
      • notepad++.exe (PID: 7084)
      • WinRAR.exe (PID: 3104)
      • EXCEL.EXE (PID: 6412)
      • notepad++.exe (PID: 304)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 1044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: Windows User
LastModifiedBy: Windows User
Software: Microsoft Excel
CreateDate: 2024:04:02 07:57:44
ModifyDate: 2024:04:02 07:58:03
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
  • Chart6
  • Chart5
  • Chart4
  • Chart3
  • Chart2
  • Chart1
HeadingPairs:
  • Worksheets
  • 3
  • Charts
  • 6
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
22
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start excel.exe splwow64.exe no specs cmd.exe no specs conhost.exe no specs ftp.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs certutil.exe no specs cmd.exe no specs expand.exe gpresult.exe sppextcomobj.exe no specs slui.exe slui.exe rundll32.exe no specs notepad++.exe notepad++.exe openwith.exe no specs winrar.exe no specs excel.exe notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
304C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
304"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\xqdkjYbo"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
892"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\aLTWvNMR"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1044C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1640C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1840C:\WINDOWS\system32\cmd.exe /C findstr /B TVNDRgAAAAAfqgU C:\Users\public\aLTWvNMR > C:\Users\public\xqdkjYboC:\Windows\System32\cmd.exe—ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2028C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2492C:\WINDOWS\system32\cmd.exe /C expand -R -F:* C:\Users\public\ApQSTpsm C:\Users\public\ & C:\Users\public\gpresult.exeC:\Windows\System32\cmd.exe—ftp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2576certutil -f -decode C:\Users\public\xqdkjYbo C:\Users\public\ApQSTpsmC:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2720"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
23 347
Read events
22 977
Write events
335
Delete events
35

Modification events

(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\6836
Operation:writeName:0
Value:
0B0E10831229BEEE2AE04FAE8A39CD19573652230046CB9E9DAAFAACBEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511B435D2120965007800630065006C002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(6836) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
4
Suspicious files
28
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6836EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:E3D6EDDE2A55818149026FE2BDEB8A2F
SHA256:652BD662D7944B4177CA4F8496D4A196CDA9B0C6C6FA7989B1BF972F42B898B6
6836EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:1298689D566F727EBE32EED73A8ADB3F
SHA256:71E0A3E979BCE581420FE19C40A325AD0B93BE56C0989D7C57A6D8861ED17221
6836EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:C0D146BA3B93175D1B731C475BBBCCCF
SHA256:1638B0A5DB681F052940D52D307D764838887F6ED8D22F3EBA7BFC0BC96DB653
4084expand.exeC:\Users\Public\~$BD_QPAN_2024.xlsdocument
MD5:33371718EBD26129BD1C7CD954A89559
SHA256:03EFBACB95491460DE7FFA9A9BD661A5C73D6C26EF7B2BD2CCC864A43B43104D
1840cmd.exeC:\Users\Public\xqdkjYbotext
MD5:4233F7A2112D0D9DC8E3F8C46A719118
SHA256:64660E1559290FE3A60CEC4EC9ACE61180B679520991515AE6607FE8789D687B
6836EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHENMESALVEWK140QJKP.tempbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
6836EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64Abinary
MD5:A22B3DB7B93D12DDAE7D3EF974C3F689
SHA256:B8EA220A8862802137F85807FF38DF15D07984E67D1E1778D12B5D11363BCC24
892notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:FE22EC5755BC98988F9656F73B2E6FB8
SHA256:F972C425CE176E960F6347F1CA2F64A8CE2B95A375C33A03E57538052BA0624D
6836EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:6E06927D27158231305384E17292005E
SHA256:474204BBC77F54B1D0CAC5F15165B73EFBEDD78A7AC9DB3B804864958070390C
4084expand.exeC:\Users\Public\TabTips32.dll.muibinary
MD5:D9B7163C6E90F89881F08830F0B3C5CB
SHA256:CF19EF7547419EE3BDB41465C0D73534A26C14D79C3979C8962D1C5FEB33BEC9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
66
DNS requests
31
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1828
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6836
EXCEL.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7088
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
812
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7088
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6052
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6428
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6052
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6836
EXCEL.EXE
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
6836
EXCEL.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6836
EXCEL.EXE
52.111.231.13:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2120
MoUsoCoreWorker.exe
52.167.249.196:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 52.167.249.196
  • 52.140.118.28
whitelisted
google.com
  • 142.250.186.78
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.13
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
self.events.data.microsoft.com
  • 20.42.65.94
  • 52.182.143.215
whitelisted
office-update.iaahnpmqyu.workers.dev
  • 104.21.65.116
  • 172.67.190.22
shared

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2256
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare workers.dev Domain
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
4100
gpresult.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll