analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

elenco 7503825.xls

Full analysis: https://app.any.run/tasks/a6fd6660-3fb1-4152-b744-4056eff1c8fd
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 20, 2022, 17:28:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
loader
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 08:48:01 2022, Security: 0
MD5:

8DD66F630A5C13D41ED8FE01604BFFF6

SHA1:

3A38DBB63444E63461312B93A30743B70444F09B

SHA256:

CEA8A4085A3551739DADCD60711D0C9CE5C3F4B570618D1917EF67A9859779AA

SSDEEP:

1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+y9s1a6YG2jzQ0viPvDNHhESq:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • EXCEL.EXE (PID: 3692)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3692)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 3692)

    • Registers / Runs the DLL via REGSVR32.EXE

      • EXCEL.EXE (PID: 3692)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • EXCEL.EXE (PID: 3692)

  • INFO

    • Checks supported languages

      • EXCEL.EXE (PID: 3692)
      • regsvr32.exe (PID: 3216)
      • regsvr32.exe (PID: 1012)
      • regsvr32.exe (PID: 2856)
      • regsvr32.exe (PID: 2804)

    • Reads the computer name

      • EXCEL.EXE (PID: 3692)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3692)

    • Checks Windows Trust Settings

      • EXCEL.EXE (PID: 3692)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 3692)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

HeadingPairs:
  • Листы
  • 4
  • Макросы Excel 4.0
  • 1
TitleOfParts:
  • Sheet
  • ESRSGB1
  • EGSHRHV2
  • ESHVGRER3
  • PKEKPPGEKKPGE
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
Company: -
CodePage: Windows Cyrillic
Security: None
ModifyDate: 2022:05:20 07:48:01
CreateDate: 2015:06:05 18:19:34
Software: Microsoft Excel
LastModifiedBy: TYHRETH
Author: Dream
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3692"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
3216C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1012C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2856C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2804C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocxC:\Windows\System32\regsvr32.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
Total events
5 849
Read events
5 761
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
4
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3692EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR966A.tmp.cvr —
MD5:—
SHA256:—
3692EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691binary
MD5:ACFEF05633280CD7BFF50BB44624D8B4
SHA256:75710EDC6557B8F147F6D0E594BBF5702DBADF7494583AD9360B31B6D47B1B97
3692EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\buFQdCVWW4P[1].dllexecutable
MD5:3AA6E54FA654A822112A0F0FBF36AE01
SHA256:A38BCBFA4A1ED9B2F0B52ACF286D115697FCB44051FAB72A967EB221761B0C72
3692EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\Hd8lg[1].dllexecutable
MD5:29148CCE5C355117867D000C34BE7939
SHA256:6C8FA1CFB6A0F9509CB13CB2A98BD119261C4C8624B70E6B0D5D772D8ED28014
3692EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAder
MD5:D5E270D74DBADE0F3350ED531128DC9A
SHA256:C242010C3AB0A663751A5F035A19D1A3A5FAB13ABD2E13D5AF97A49D63C09FB5
3692EXCEL.EXEC:\Users\admin\uxevr4.ocxexecutable
MD5:29148CCE5C355117867D000C34BE7939
SHA256:6C8FA1CFB6A0F9509CB13CB2A98BD119261C4C8624B70E6B0D5D772D8ED28014
3692EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\S0XFRSSR.txttext
MD5:4090A55E99BA3A0A26D64BADBA6FE3E1
SHA256:CFFEC34E0BA3BB58DC45BA7CB3A8901847C72DA9FD50281C6897FB5854BA5A59
3692EXCEL.EXEC:\Users\admin\uxevr3.ocxexecutable
MD5:3AA6E54FA654A822112A0F0FBF36AE01
SHA256:A38BCBFA4A1ED9B2F0B52ACF286D115697FCB44051FAB72A967EB221761B0C72
3692EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F7131E079D0272721309DE39C47BE72C
SHA256:F265DD13BABF6F7376B93596273D0AE5F938A82873590260B1628D0C72C6325E
3692EXCEL.EXEC:\Users\admin\uxevr1.ocxexecutable
MD5:0C833F3D3633F1239D5F7D27EC411B35
SHA256:47EFDEF5BA81EACC1F97698B52204AEAB8E3C2AF3505A50A979AA03262DC8CB2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
EXCEL.EXE
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
US
der
471 b
whitelisted
3692
EXCEL.EXE
GET
200
208.78.32.145:80
http://www.clasite.com/blogs/IEEsyn/
US
executable
373 Kb
suspicious
3692
EXCEL.EXE
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
US
der
728 b
whitelisted
3692
EXCEL.EXE
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d172467d2c1ea7eb
US
compressed
4.70 Kb
whitelisted
3692
EXCEL.EXE
GET
200
193.53.98.181:80
http://opencart-destek.com/catalog/OqHwQ8xlWa5Goyo/
unknown
executable
362 Kb
suspicious
3692
EXCEL.EXE
GET
200
178.238.236.240:80
http://www.pjesacac.com/components/O93XXhMN3tOtTlV/
DE
executable
362 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3692
EXCEL.EXE
172.64.155.188:80
ocsp.comodoca.com
—
US
suspicious
3692
EXCEL.EXE
208.78.32.145:80
www.clasite.com
Turnkey Internet Inc.
US
suspicious
3692
EXCEL.EXE
162.55.176.65:443
oncrete-egy.com
—
US
suspicious
3692
EXCEL.EXE
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3692
EXCEL.EXE
178.238.236.240:80
www.pjesacac.com
Contabo GmbH
DE
suspicious
3692
EXCEL.EXE
193.53.98.181:80
opencart-destek.com
—
—
suspicious

DNS requests

Domain
IP
Reputation
www.clasite.com
  • 208.78.32.145
suspicious
oncrete-egy.com
  • 162.55.176.65
  • 185.178.208.138
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
opencart-destek.com
  • 193.53.98.181
suspicious
www.pjesacac.com
  • 178.238.236.240
suspicious

Threats

PID
Process
Class
Message
3692
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3692
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3692
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
3692
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3692
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3692
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
3692
EXCEL.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3692
EXCEL.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3692
EXCEL.EXE
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
elenco 7503825.xls