File name:

bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd.xls

Full analysis: https://app.any.run/tasks/dad15e15-67fc-48c7-93ee-bb6b37d7246f
Verdict: Malicious activity
Analysis date: May 30, 2020, 03:00:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

41190583BBBB2FD7F355C2E42B2D70A3

SHA1:

9C9EBEF0DC57E363DD3CE03BF2F29D2E6146A2D5

SHA256:

BED925D7C0AF493C9CCD2828D6FDEFE6F4255BADA51F645A8FFFDD67E24B87FD

SSDEEP:

24576:5VcOqrTHvgNZphcpxs/yjiJffdEvRQldBSbWF0tPppyUqD:5V+INDhGK/JMpgUqD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • adb.exe (PID: 3804)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2916)

    • Writes to a start menu file

      • adb.exe (PID: 3804)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2916)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • adb.exe (PID: 3804)

    • Creates files in the program directory

      • adb.exe (PID: 3804)
      • EXCEL.EXE (PID: 2916)

    • Creates files in the user directory

      • adb.exe (PID: 3804)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlam | Excel Macro-enabled Open XML add-in (42.4)
.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (29.2)
.xlsx | Excel Microsoft Office Open XML Format document (17.3)
.zip | Open Packaging Conventions container (8.9)
.zip | ZIP compressed archive (2)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x51e8ac15
ZipCompressedSize: 433
ZipUncompressedSize: 1524
ZipFileName: [Content_Types].xml

XML

Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • Worksheets
  • 1
TitlesOfParts: Sheet protected
Company: -
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16.03
LastModifiedBy: Administrator
CreateDate: 2020:05:22 12:31:46Z
ModifyDate: 2020:05:29 15:55:47Z

XMP

Creator: Developer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start excel.exe adb.exe

Process information

PID
CMD
Path
Indicators
Parent process
2916"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3804C:\ProgramData\adb.exeC:\ProgramData\adb.exe
EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Unicode 32-bit
Exit code:
0
Version:
1.1.32.00
Modules
Images
c:\programdata\adb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
Total events
748
Read events
687
Write events
50
Delete events
11

Modification events

(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:y33
Value:
79333300640B0000010000000000000000000000
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2916) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
1
Suspicious files
0
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2916EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRCBD9.tmp.cvr —
MD5:—
SHA256:—
3804adb.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GraphicsPerfSvc.lnklnk
MD5:—
SHA256:—
2916EXCEL.EXEC:\ProgramData\adb.ahktext
MD5:—
SHA256:—
2916EXCEL.EXEC:\ProgramData\adb.exeexecutable
MD5:0D0D4BCD65381208F55825B2C4247287
SHA256:7D978A454F0F0B60B33069ABDADD324D6A7C1A2BF6A1F97390C6DE3D11BD9BDA
3804adb.exeC:\ProgramData\adb.exe~text
MD5:5820854F62A6EB3D38BA7BA0D1B3EA75
SHA256:912D0C07DA7BDB22CDAE025B96DA26D01523AAAB7362EDB28544E3949DEB369D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
10
DNS requests
0
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
—
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
text
20 b
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3804
adb.exe
199.192.29.202:80
—
—
US
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3804
adb.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
3804
adb.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd.xls