File name:

Quotation.xls

Full analysis: https://app.any.run/tasks/535b3abf-9570-41ab-b0da-6bbf4d1b287f
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 09, 2023, 07:00:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
phishing
phishing-pdf
phishing-xls
opendir
exploit
cve-2017-11882
loader
formbook
xloader
stealer
spyware
trojan
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Nov 8 17:04:50 2023, Security: 1
MD5:

4A6C8B75271DFB2968FB511984FCDF56

SHA1:

607A5D42B94AA5362857F893F5FF12D8FE6B7DCB

SHA256:

CD1C9FAD93FDC00B3D2B34BB65D84029C5A8529B7EBA10B4922B503DCA449C74

SSDEEP:

49152:2TKsa0m3R5sAT1vNyUOF+4u3075/vKHI+cGQga0m3D5sAT1vNyUOF+4u3a75/vKj:173TsAq5/vKGL33VsA85/vKGLtriQaN3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2004)

    • Uses Task Scheduler to run other applications

      • audiodgse.exe (PID: 980)

    • FORMBOOK has been detected (YARA)

      • wlanext.exe (PID: 2660)

    • FORMBOOK has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Connects to the CnC server

      • explorer.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • wlanext.exe (PID: 2660)

    • Drops the executable file immediately after the start

      • audiodgse.exe (PID: 980)
      • EQNEDT32.EXE (PID: 2004)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2004)

  • SUSPICIOUS

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • wlanext.exe (PID: 2660)

    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 2004)

    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 2004)

    • Process drops legitimate windows executable

      • audiodgse.exe (PID: 980)
      • EQNEDT32.EXE (PID: 2004)

    • Application launched itself

      • audiodgse.exe (PID: 980)

  • INFO

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 2220)
      • audiodgse.exe (PID: 980)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • audiodgse.exe (PID: 2220)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 2004)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 2004)
      • audiodgse.exe (PID: 980)
      • wlanext.exe (PID: 2660)

    • Create files in a temporary directory

      • audiodgse.exe (PID: 980)

    • Manual execution by a user

      • autofmt.exe (PID: 2676)
      • autofmt.exe (PID: 2728)
      • autofmt.exe (PID: 2820)
      • autofmt.exe (PID: 2120)
      • wlanext.exe (PID: 2660)
      • autofmt.exe (PID: 1584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2660) wlanext.exe
C2www.kilid102.cloud/bp31/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)hp68b.top
rajawali99pkv.com
cisseoriginals.com
pedchain.com
affibook.com
nudtnrg.com
lems.cloud
tipozaa.store
theamalliance.com
massalit.com
houysdegsesag.top
eseventplanning.com
wxt82.xyz
supportonlineinfo.online
genee.store
nohu247.pro
cartx.store
acomunicacaorestaura.store
249b871ab7d2.info
surantools.com
funlazio.info
lynktag.com
turdfi.xyz
libgeninfo.com
smartagriafrica.info
nikkisellshouses2.com
natsellsatl.com
pg607.fun
kathinationindia.com
chonggonzalez.com
civitai.zone
unlimitednews.online
originswinery.com
byspektra.com
holisticstar.net
5vwl4z8.xyz
mx004.com
annuaire-brocante.com
getmangarock.com
my-chemicals.online
httpsaquexis.com
mavisnakliye.xyz
hemayah.live
lajtuf.com
soulguardgaming.com
hateyaocoeur.com
zloomux.com
haglove.stream
buybom.store
freeamateurzone.com
extremetechnology.shop
rabbitmobiles.com
myfertilitycoachuk.com
ledbrightled.com
blurwing.com
iptv-store.store
creditevangelists.com
zuwiz.com
gcgds.com
jumperspoods.com
lovletterstolife.store
socialpraises.net
bronessbros.com
souqshopper.com
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Title: -
Subject: -
Keywords: -
Comments: -
Template: -
RevisionNumber: 1
Pages: -
Words: -
Characters: -
ThumbnailClip: (Binary data 22858 bytes, use -b option to extract)
Category: -
PresentationTarget: -
Manager: -
Company: -
Bytes: -
Lines: -
Paragraphs: -
Slides: -
Notes: -
HiddenSlides: -
MMClips: -
CharCountWithSpaces: -
KSOProductBuildVer: 2052-11.1.0.13703
ICV: C30860BF318046A5BA3C67275852A6D2
Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2006:09:16 00:00:00
ModifyDate: 2023:11:08 17:04:50
Security: Password protected
CodePage: Windows Latin 1 (Western European)
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HeadingPairs:
  • Worksheets
  • 3
CompObjUserTypeLen: 38
CompObjUserType: Microsoft Office Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs eqnedt32.exe audiodgse.exe no specs schtasks.exe no specs audiodgse.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs autofmt.exe no specs #FORMBOOK wlanext.exe firefox.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
980"C:\Users\admin\AppData\Roaming\audiodgse.exe" C:\Users\admin\AppData\Roaming\audiodgse.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Share Wizard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\audiodgse.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
1584"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1628"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—wlanext.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2004"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2120"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2220"C:\Users\admin\AppData\Roaming\audiodgse.exe"C:\Users\admin\AppData\Roaming\audiodgse.exe—audiodgse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Share Wizard
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\audiodgse.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2292"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NKApKNeU" /XML "C:\Users\admin\AppData\Local\Temp\tmp8108.tmp"C:\Windows\SysWOW64\schtasks.exe—audiodgse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2660"C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wireless LAN 802.11 Extensibility Framework
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\wlanext.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(2660) wlanext.exe
C2www.kilid102.cloud/bp31/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)hp68b.top
rajawali99pkv.com
cisseoriginals.com
pedchain.com
affibook.com
nudtnrg.com
lems.cloud
tipozaa.store
theamalliance.com
massalit.com
houysdegsesag.top
eseventplanning.com
wxt82.xyz
supportonlineinfo.online
genee.store
nohu247.pro
cartx.store
acomunicacaorestaura.store
249b871ab7d2.info
surantools.com
funlazio.info
lynktag.com
turdfi.xyz
libgeninfo.com
smartagriafrica.info
nikkisellshouses2.com
natsellsatl.com
pg607.fun
kathinationindia.com
chonggonzalez.com
civitai.zone
unlimitednews.online
originswinery.com
byspektra.com
holisticstar.net
5vwl4z8.xyz
mx004.com
annuaire-brocante.com
getmangarock.com
my-chemicals.online
httpsaquexis.com
mavisnakliye.xyz
hemayah.live
lajtuf.com
soulguardgaming.com
hateyaocoeur.com
zloomux.com
haglove.stream
buybom.store
freeamateurzone.com
extremetechnology.shop
rabbitmobiles.com
myfertilitycoachuk.com
ledbrightled.com
blurwing.com
iptv-store.store
creditevangelists.com
zuwiz.com
gcgds.com
jumperspoods.com
lovletterstolife.store
socialpraises.net
bronessbros.com
souqshopper.com
2676"C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\autofmt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
3 846
Read events
3 781
Write events
58
Delete events
7

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3020) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
Executable files
3
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3020EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA5EB.tmp.cvr —
MD5:—
SHA256:—
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\723AEABF.emfbinary
MD5:A01B9617553432807B9B58025B338D97
SHA256:7A0426ED2E2349916969FF7087C0F76089FB8CE7F4627F3D11CCBC1AAEFCEDCE
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\69547440.emfbinary
MD5:9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA256:EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
2004EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\wininit[1].exeexecutable
MD5:1F061E24E82B471E201B57B67F446B7B
SHA256:F26EF2DC3870B6EE2F05973FCD97B1E55F817524EAC8BDBE6863E584C6CF2821
2660wlanext.exeC:\Users\admin\AppData\Roaming\87R83SQR\87Rlogrc.inibinary
MD5:E03F207A7B9CFC4D877ED2EC64BE028E
SHA256:B17183098B6E349844A3151456EDF62C8E41B2348D2445A610C0FF1E29963067
2660wlanext.exeC:\Users\admin\AppData\Roaming\87R83SQR\87Rlogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
2660wlanext.exeC:\Users\admin\AppData\Roaming\87R83SQR\87Rlogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
980audiodgse.exeC:\Users\admin\AppData\Local\Temp\tmp8108.tmpxml
MD5:22061EB8AE4A7F814DF786DB3F16751D
SHA256:DD6755CBD9872E1D0F346C38E737A82FF81958E98A851F5AAD3B2FB5A4E4A3B9
1628firefox.exeC:\Users\admin\AppData\Roaming\87R83SQR\87Rlogrf.inibinary
MD5:2F245469795B865BDD1B956C23D7893D
SHA256:1662D01A2D47B875A34FC7A8CD92E78CB2BA7F34023C7FD2639CBB10B8D94361
3020EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\332D05B4.emfbinary
MD5:1FCB3F34B5588F6A647A06DFF1811BF9
SHA256:A99E8172248DAC0B2A6243D06A862901989857B0C2ECBED5F25DDB0D1A95154E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
11
DNS requests
1
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2004
EQNEDT32.EXE
GET
200
103.29.3.200:80
http://103.29.3.200/W0811T/wininit.exe
unknown
executable
631 Kb
unknown
1944
explorer.exe
GET
403
23.227.38.74:80
http://www.cartx.store/bp31/?IR9D54=YY3hkksSpmZNVrvpWToIhkuRhCa/E2fI635LdZXTW2SMXfVd8QNIJleAP22QG9m1CzzRCQ==&4h=NTxxQJ9&sql=1
unknown
html
4.41 Kb
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
1944
explorer.exe
POST
—
23.227.38.74:80
http://www.cartx.store/bp31/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2004
EQNEDT32.EXE
103.29.3.200:80
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1944
explorer.exe
23.227.38.74:80
www.cartx.store
CLOUDFLARENET
CA
unknown

DNS requests

Domain
IP
Reputation
www.cartx.store
  • 23.227.38.74
unknown

Threats

PID
Process
Class
Message
2004
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2004
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2004
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2004
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2004
EQNEDT32.EXE
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1944
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Quotation.xls