File name:

Quotation.xls

Full analysis: https://app.any.run/tasks/535b3abf-9570-41ab-b0da-6bbf4d1b287f
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 09, 2023, 07:00:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
phishing
phishing-pdf
phishing-xls
opendir
exploit
cve-2017-11882
loader
formbook
xloader
stealer
spyware
trojan
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Nov 8 17:04:50 2023, Security: 1
MD5:

4A6C8B75271DFB2968FB511984FCDF56

SHA1:

607A5D42B94AA5362857F893F5FF12D8FE6B7DCB

SHA256:

CD1C9FAD93FDC00B3D2B34BB65D84029C5A8529B7EBA10B4922B503DCA449C74

SSDEEP:

49152:2TKsa0m3R5sAT1vNyUOF+4u3075/vKHI+cGQga0m3D5sAT1vNyUOF+4u3a75/vKj:173TsAq5/vKGL33VsA85/vKGLtriQaN3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2004)

    • Drops the executable file immediately after the start

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2004)

    • Uses Task Scheduler to run other applications

      • audiodgse.exe (PID: 980)

    • Actions looks like stealing of personal data

      • wlanext.exe (PID: 2660)

    • FORMBOOK has been detected (YARA)

      • wlanext.exe (PID: 2660)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • wlanext.exe (PID: 2660)

    • Process drops legitimate windows executable

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)

    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 2004)

    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 2004)

    • Application launched itself

      • audiodgse.exe (PID: 980)

  • INFO

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • audiodgse.exe (PID: 2220)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • audiodgse.exe (PID: 2220)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 2004)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • wlanext.exe (PID: 2660)

    • Create files in a temporary directory

      • audiodgse.exe (PID: 980)

    • Manual execution by a user

      • autofmt.exe (PID: 2120)
      • autofmt.exe (PID: 2728)
      • autofmt.exe (PID: 2676)
      • autofmt.exe (PID: 2820)
      • autofmt.exe (PID: 1584)
      • wlanext.exe (PID: 2660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2660) wlanext.exe
C2www.kilid102.cloud/bp31/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)hp68b.top
rajawali99pkv.com
cisseoriginals.com
pedchain.com
affibook.com
nudtnrg.com
lems.cloud
tipozaa.store
theamalliance.com
massalit.com
houysdegsesag.top
eseventplanning.com
wxt82.xyz
supportonlineinfo.online
genee.store
nohu247.pro
cartx.store
acomunicacaorestaura.store
249b871ab7d2.info
surantools.com
funlazio.info
lynktag.com
turdfi.xyz
libgeninfo.com
smartagriafrica.info
nikkisellshouses2.com
natsellsatl.com
pg607.fun
kathinationindia.com
chonggonzalez.com
civitai.zone
unlimitednews.online
originswinery.com
byspektra.com
holisticstar.net
5vwl4z8.xyz
mx004.com
annuaire-brocante.com
getmangarock.com
my-chemicals.online
httpsaquexis.com
mavisnakliye.xyz
hemayah.live
lajtuf.com
soulguardgaming.com
hateyaocoeur.com
zloomux.com
haglove.stream
buybom.store
freeamateurzone.com
extremetechnology.shop
rabbitmobiles.com
myfertilitycoachuk.com
ledbrightled.com
blurwing.com
iptv-store.store
creditevangelists.com
zuwiz.com
gcgds.com
jumperspoods.com
lovletterstolife.store
socialpraises.net
bronessbros.com
souqshopper.com
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Title: -
Subject: -
Keywords: -
Comments: -
Template: -
RevisionNumber: 1
Pages: -
Words: -
Characters: -
ThumbnailClip: (Binary data 22858 bytes, use -b option to extract)
Category: -
PresentationTarget: -
Manager: -
Company: -
Bytes: -
Lines: -
Paragraphs: -
Slides: -
Notes: -
HiddenSlides: -
MMClips: -
CharCountWithSpaces: -
KSOProductBuildVer: 2052-11.1.0.13703
ICV: C30860BF318046A5BA3C67275852A6D2
Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2023:11:08 17:04:50
Security: Password protected
CodePage: Windows Latin 1 (Western European)
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs eqnedt32.exe audiodgse.exe no specs schtasks.exe no specs audiodgse.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs #FORMBOOK wlanext.exe firefox.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\AppData\Roaming\audiodgse.exe" C:\Users\admin\AppData\Roaming\audiodgse.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Share Wizard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\audiodgse.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
1584"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1628"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—wlanext.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2004"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2120"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2220"C:\Users\admin\AppData\Roaming\audiodgse.exe"C:\Users\admin\AppData\Roaming\audiodgse.exe—audiodgse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Share Wizard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\audiodgse.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2292"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NKApKNeU" /XML "C:\Users\admin\AppData\Local\Temp\tmp8108.tmp"C:\Windows\SysWOW64\schtasks.exe—audiodgse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2660"C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wireless LAN 802.11 Extensibility Framework
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wlanext.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(2660) wlanext.exe
C2www.kilid102.cloud/bp31/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)hp68b.top
rajawali99pkv.com
cisseoriginals.com
pedchain.com
affibook.com
nudtnrg.com
lems.cloud
tipozaa.store
theamalliance.com
massalit.com
houysdegsesag.top
eseventplanning.com
wxt82.xyz
supportonlineinfo.online
genee.store
nohu247.pro
cartx.store
acomunicacaorestaura.store
249b871ab7d2.info
surantools.com
funlazio.info
lynktag.com
turdfi.xyz
libgeninfo.com
smartagriafrica.info
nikkisellshouses2.com
natsellsatl.com
pg607.fun
kathinationindia.com
chonggonzalez.com
civitai.zone
unlimitednews.online
originswinery.com
byspektra.com
holisticstar.net
5vwl4z8.xyz
mx004.com
annuaire-brocante.com
getmangarock.com
my-chemicals.online
httpsaquexis.com
mavisnakliye.xyz
hemayah.live
lajtuf.com
soulguardgaming.com
hateyaocoeur.com
zloomux.com
haglove.stream
buybom.store
freeamateurzone.com
extremetechnology.shop
rabbitmobiles.com
myfertilitycoachuk.com
ledbrightled.com
blurwing.com
iptv-store.store
creditevangelists.com
zuwiz.com
gcgds.com
jumperspoods.com
lovletterstolife.store
socialpraises.net
bronessbros.com
souqshopper.com
2676"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
3 846
Read events
3 781
Write events
58
Delete events
7

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
Executable files
3
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3020EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA5EB.tmp.cvr —
MD5:—
SHA256:—
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\723AEABF.emfbinary
MD5:A01B9617553432807B9B58025B338D97
SHA256:7A0426ED2E2349916969FF7087C0F76089FB8CE7F4627F3D11CCBC1AAEFCEDCE
2004EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\wininit[1].exeexecutable
MD5:1F061E24E82B471E201B57B67F446B7B
SHA256:F26EF2DC3870B6EE2F05973FCD97B1E55F817524EAC8BDBE6863E584C6CF2821
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\332D05B4.emfbinary
MD5:1FCB3F34B5588F6A647A06DFF1811BF9
SHA256:A99E8172248DAC0B2A6243D06A862901989857B0C2ECBED5F25DDB0D1A95154E
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\623ED9E2.emfbinary
MD5:46307C89F61B6689D0DA0B5EA8753B9D
SHA256:DEB2CC64C1503F7C5BE21DD389AD9F15D09AD8462410C057DBA42B767F820863
2004EQNEDT32.EXEC:\Users\admin\AppData\Roaming\audiodgse.exeexecutable
MD5:1F061E24E82B471E201B57B67F446B7B
SHA256:F26EF2DC3870B6EE2F05973FCD97B1E55F817524EAC8BDBE6863E584C6CF2821
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4F131C7B.emfbinary
MD5:1D52E5E624BB040CBEF676CDE84F3E72
SHA256:60F5A80466A2048FCAF489BCE42EF0E9E157152A9D3449434871DFCC883F3B14
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\69547440.emfbinary
MD5:9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA256:EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\18230225.emfbinary
MD5:AD03AC039A1AB54658759726658CFBA0
SHA256:4FD07BA503DEA95572856D53E1C99BD0CC5DBA2DFDE3C14CAB1EAB4AC78800B5
980audiodgse.exeC:\Users\admin\AppData\Local\Temp\tmp8108.tmpxml
MD5:22061EB8AE4A7F814DF786DB3F16751D
SHA256:DD6755CBD9872E1D0F346C38E737A82FF81958E98A851F5AAD3B2FB5A4E4A3B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
11
DNS requests
1
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2004
EQNEDT32.EXE
GET
200
103.29.3.200:80
http://103.29.3.200/W0811T/wininit.exe
unknown
executable
631 Kb
unknown
1944
explorer.exe
GET
403
23.227.38.74:80
http://www.cartx.store/bp31/?IR9D54=YY3hkksSpmZNVrvpWToIhkuRhCa/E2fI635LdZXTW2SMXfVd8QNIJleAP22QG9m1CzzRCQ==&4h=NTxxQJ9&sql=1
unknown
html
4.41 Kb
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2004
EQNEDT32.EXE
103.29.3.200:80
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1944
explorer.exe
23.227.38.74:80
www.cartx.store
CLOUDFLARENET
CA
unknown

DNS requests

Domain
IP
Reputation
www.cartx.store
  • 23.227.38.74
unknown

Threats

PID
Process
Class
Message
2004
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2004
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2004
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2004
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2004
EQNEDT32.EXE
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1944
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Quotation.xls