analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

EC BU Jun'22 Contract Rev_FC_V2.pptx

Full analysis: https://app.any.run/tasks/fd7e8cd9-8842-439b-91b6-51932189475c
Verdict: Malicious activity
Analysis date: June 27, 2022, 09:17:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

0A105F8BB9D20EE945D358699461390F

SHA1:

C6AF5235DC97B078EA154E33B1C1B9B4145F41E0

SHA256:

D53B7B870ECA49D8C3B9346EAD5680EBDEBBF503824C757C2A44CA4E3DD00465

SSDEEP:

49152:BbkXdEsrwLBUid/B81gfQ1TtQV2zPDedcz/NsnG:Bbkt36Ui8H1G2mwsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • POWERPNT.EXE (PID: 2444)

  • SUSPICIOUS

    • Starts Internet Explorer

      • POWERPNT.EXE (PID: 2444)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2192)

  • INFO

    • Reads the computer name

      • POWERPNT.EXE (PID: 2444)
      • iexplore.exe (PID: 888)
      • iexplore.exe (PID: 2192)

    • Checks supported languages

      • iexplore.exe (PID: 888)
      • POWERPNT.EXE (PID: 2444)
      • iexplore.exe (PID: 2192)

    • Changes internet zones settings

      • iexplore.exe (PID: 888)

    • Application launched itself

      • iexplore.exe (PID: 888)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2192)
      • iexplore.exe (PID: 888)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2192)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 888)

    • Creates files in the user directory

      • iexplore.exe (PID: 2192)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2192)
      • iexplore.exe (PID: 888)

    • Reads Microsoft Office registry keys

      • POWERPNT.EXE (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powerpnt.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2444"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\AppData\Local\Temp\EC BU Jun'22 Contract Rev_FC_V2.pptx"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft PowerPoint
Version:
14.0.6009.1000
Modules
Images
c:\program files\microsoft office\office14\powerpnt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\ppcore.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
888"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkID=290821C:\Program Files\Internet Explorer\iexplore.exe
POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2192"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:888 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\rpcrt4.dll
Total events
12 844
Read events
12 666
Write events
175
Delete events
3

Modification events

(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems
Operation:writeName:cn8
Value:
636E38008C090000010000000000000000000000
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2444) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
0
Suspicious files
11
Text files
47
Unknown types
11

Dropped files

PID
Process
Filename
Type
2444POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\CVR5ED0.tmp.cvr —
MD5:—
SHA256:—
2192iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\210AXXCG.txttext
MD5:8911F738022E098C4CCE6BA8E0D33B03
SHA256:110B04776E43623248BE9D2419ABADCB2914B3D8A4E7F4BAF8337C62F69B2B0F
888iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:E8C49471C426CD6B784801477F87728E
SHA256:5B73439F11EEE191BDF32E77C0E7915AEF07A7E9C4F178F8D522CFADA64FC084
2192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\details[1].htmhtml
MD5:1DD401626E4A4BB87F0B4B10CE648FEF
SHA256:E079A1FC9A979A77F53BB28B8933AA3E65E5DD30BB04697567260EE03B7BBE34
2192iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
2192iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:370F7CB2879A4AC36EDABAA79B3AFD41
SHA256:50FCADED0CF435C9767FC3FB4F3CFA26E20FCFE40988BC13CBF0850B430ABC13
2192iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:790E40386A5478B54787C28956E029D7
SHA256:2A14CA44FA89C53F53111C7CAAE9155A460FA162BD822CCEAF7B7F74B8390557
2192iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:20C7565286C94469525C6657E7C15595
SHA256:45565FE76142F2D500452B40A3D43B4494E97601187784319C407AF7B8B7776A
2192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ef-a24652[1].csstext
MD5:501A61540F1AD706F32DC3B22FFA92C3
SHA256:F5E98E2373C741C7A3D6F1C3A4B114E3F0F022C41E24EE6BA022DE985EAC773B
2192iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\37-8473b9[1].jstext
MD5:9D2B7A78DF530616E24BED302BB3139D
SHA256:5D227626D692432E26155B3E4A12ED650EC88D0D761924C01A9AF1843A4BBBD6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
63
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
2192
iexplore.exe
GET
200
8.250.169.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?883db1bd8b530c7f
US
compressed
4.70 Kb
whitelisted
888
iexplore.exe
GET
200
8.250.161.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2a953191e0ade7d7
US
compressed
4.70 Kb
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2192
iexplore.exe
23.35.229.160:443
www.microsoft.com
Zayo Bandwidth Inc
US
whitelisted
888
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2192
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2192
iexplore.exe
104.90.162.125:443
go.microsoft.com
Akamai Technologies, Inc.
NL
suspicious
888
iexplore.exe
8.250.169.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2192
iexplore.exe
2.21.20.153:443
statics-marketingsites-wcus-ms-com.akamaized.net
NTT America, Inc.
DE
suspicious
2192
iexplore.exe
8.250.169.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
—
—
192.168.100.2:53
—
—
—
whitelisted
2192
iexplore.exe
23.35.237.160:443
c.s-microsoft.com
Zayo Bandwidth Inc
US
unknown
2192
iexplore.exe
152.199.19.160:443
ajax.aspnetcdn.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.35.229.160
whitelisted
go.microsoft.com
  • 104.90.162.125
whitelisted
ctldl.windowsupdate.com
  • 8.250.169.254
  • 8.250.161.254
  • 8.252.188.126
  • 8.247.116.126
  • 8.253.129.204
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
assets.onestore.ms
  • 96.16.141.249
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 2.21.20.153
  • 2.21.20.132
whitelisted
c.s-microsoft.com
  • 23.35.237.160
whitelisted
ajax.aspnetcdn.com
  • 152.199.19.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
EC BU Jun'22 Contract Rev_FC_V2.pptx