analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd.xls

Full analysis: https://app.any.run/tasks/dad15e15-67fc-48c7-93ee-bb6b37d7246f
Verdict: Malicious activity
Analysis date: May 30, 2020, 03:00:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

41190583BBBB2FD7F355C2E42B2D70A3

SHA1:

9C9EBEF0DC57E363DD3CE03BF2F29D2E6146A2D5

SHA256:

BED925D7C0AF493C9CCD2828D6FDEFE6F4255BADA51F645A8FFFDD67E24B87FD

SSDEEP:

24576:5VcOqrTHvgNZphcpxs/yjiJffdEvRQldBSbWF0tPppyUqD:5V+INDhGK/JMpgUqD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2916)

    • Writes to a start menu file

      • adb.exe (PID: 3804)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2916)

    • Application was dropped or rewritten from another process

      • adb.exe (PID: 3804)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • adb.exe (PID: 3804)

    • Creates files in the program directory

      • EXCEL.EXE (PID: 2916)
      • adb.exe (PID: 3804)

    • Creates files in the user directory

      • adb.exe (PID: 3804)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlam | Excel Macro-enabled Open XML add-in (42.4)
.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (29.2)
.xlsx | Excel Microsoft Office Open XML Format document (17.3)
.zip | Open Packaging Conventions container (8.9)
.zip | ZIP compressed archive (2)

EXIF

XMP

Creator: Developer

XML

ModifyDate: 2020:05:29 15:55:47Z
CreateDate: 2020:05:22 12:31:46Z
LastModifiedBy: Administrator
AppVersion: 16.03
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts: Sheet protected
HeadingPairs:
  • Worksheets
  • 1
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1524
ZipCompressedSize: 433
ZipCRC: 0x51e8ac15
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start excel.exe adb.exe

Process information

PID
CMD
Path
Indicators
Parent process
2916"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
3804C:\ProgramData\adb.exeC:\ProgramData\adb.exe
EXCEL.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey Unicode 32-bit
Version:
1.1.32.00
Total events
748
Read events
687
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2916EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRCBD9.tmp.cvr —
MD5:—
SHA256:—
3804adb.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GraphicsPerfSvc.lnklnk
MD5:84F5B190A7C3157274A20B7AF1C18A85
SHA256:0F20B5A6BE02DD7A4BC2BDAB9A06F9EDE54E9F166A850B665CB63694494EB788
2916EXCEL.EXEC:\ProgramData\adb.ahktext
MD5:698B6578914939C2AABA3B4E01C08447
SHA256:498F5C91F3DE478495BF1FDE84FAE32EC0044F150AA6BA060083D1B54C385940
2916EXCEL.EXEC:\ProgramData\adb.exeexecutable
MD5:0D0D4BCD65381208F55825B2C4247287
SHA256:7D978A454F0F0B60B33069ABDADD324D6A7C1A2BF6A1F97390C6DE3D11BD9BDA
3804adb.exeC:\ProgramData\adb.exe~text
MD5:5820854F62A6EB3D38BA7BA0D1B3EA75
SHA256:912D0C07DA7BDB22CDAE025B96DA26D01523AAAB7362EDB28544E3949DEB369D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
10
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
—
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
3804
adb.exe
GET
200
199.192.29.202:80
http://199.192.29.202/3300537927-xl2
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3804
adb.exe
199.192.29.202:80
—
—
US
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3804
adb.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
3804
adb.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd.xls