File name:

4MAY_177.xls

Full analysis: https://app.any.run/tasks/a27db4c2-c83e-4d51-9417-b5ee244ae53d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 04, 2020, 20:28:26
OS: Windows 10 Professional (build: 16299, 64 bit)
Tags:
macros
loader
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Mon May 4 17:32:23 2020, Last Saved Time/Date: Mon May 4 17:53:35 2020, Security: 1
MD5:

5C6853F5433112583BD663B5D52CF2C8

SHA1:

5009F541779E260BE8B4AD87AC998413CEAEE525

SHA256:

FB47082C64D66D09312CC0E8336F49369AFE502B466FD13A1224E0E065D19917

SSDEEP:

12288:0d1WfADU3UREm0q5e2yR0G6GINp2OSo9aa0ej1PgiLlg+k:0NDUEdvPymGsTSob0eJPVC+k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 5780)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 5780)

    • Known privilege escalation attack

      • DllHost.exe (PID: 860)

    • Application was dropped or rewritten from another process

      • bWLfWNa.exe (PID: 5872)
      • bWLfWNa.exe (PID: 552)

    • Requests a remote executable file from MS Office

      • EXCEL.EXE (PID: 5780)

    • Loads the Task Scheduler COM API

      • wermgr.exe (PID: 1724)

    • Loads the Task Scheduler DLL interface

      • wermgr.exe (PID: 1724)

    • Connects to CnC server

      • wermgr.exe (PID: 1724)

    • Actions looks like stealing of personal data

      • wermgr.exe (PID: 1724)

  • SUSPICIOUS

    • Creates files in the program directory

      • EXCEL.EXE (PID: 5780)

    • Creates files in the user directory

      • wermgr.exe (PID: 1724)
      • SystemSettings.exe (PID: 4952)

    • Executable content was dropped or overwritten

      • wermgr.exe (PID: 1724)

    • Executed via COM

      • DllHost.exe (PID: 860)
      • ApplicationFrameHost.exe (PID: 724)
      • RuntimeBroker.exe (PID: 5836)
      • backgroundTaskHost.exe (PID: 4612)
      • SpeechRuntime.exe (PID: 4452)
      • SystemSettings.exe (PID: 4952)

    • Reads the machine GUID from the registry

      • backgroundTaskHost.exe (PID: 4612)
      • SpeechRuntime.exe (PID: 4452)
      • wermgr.exe (PID: 1724)

    • Checks supported languages

      • SystemSettings.exe (PID: 4952)
      • backgroundTaskHost.exe (PID: 4612)

  • INFO

    • Reads the machine GUID from the registry

      • EXCEL.EXE (PID: 5780)

    • Scans artifacts that could help determine the target

      • EXCEL.EXE (PID: 5780)

    • Reads the software policy settings

      • EXCEL.EXE (PID: 5780)
      • wermgr.exe (PID: 1724)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 5780)
      • wermgr.exe (PID: 1724)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 5780)

    • Reads Environment values

      • EXCEL.EXE (PID: 5780)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 5780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: -
LastModifiedBy: -
Software: Microsoft Excel
CreateDate: 2020:05:04 16:32:23
ModifyDate: 2020:05:04 16:53:35
Security: Password protected
CodePage: Windows Cyrillic
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Sheet2
  • Sheet1
  • okZtjaoyhhUHiFR
  • ipUggwzDuTib
  • Macro2
  • Macro3
  • Macro4
  • Macro5
  • Macro6
  • Macro7
  • Macro8
HeadingPairs:
  • Worksheets
  • 2
  • Excel 4.0 Macros
  • 9
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
10
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start excel.exe bwlfwna.exe no specs CMSTPLUA no specs bwlfwna.exe no specs wermgr.exe applicationframehost.exe no specs systemsettings.exe no specs runtimebroker.exe no specs backgroundtaskhost.exe no specs speechruntime.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\ProgramData\bWLfWNa.exe" C:\ProgramData\bWLfWNa.exe—DllHost.exe
User:
admin
Company:
DragonQuest
Integrity Level:
HIGH
Description:
I hope someone learns something from this
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\bwlfwna.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
724C:\WINDOWS\system32\ApplicationFrameHost.exe -EmbeddingC:\WINDOWS\system32\ApplicationFrameHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\applicationframehost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\kernel.appcore.dll
860C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\WINDOWS\SysWOW64\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1724C:\WINDOWS\system32\wermgr.exeC:\WINDOWS\system32\wermgr.exe
bWLfWNa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wermgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\oleaut32.dll
4452C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -EmbeddingC:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Speech Runtime Executable
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\speech_onecore\common\speechruntime.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msvcp110_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
4612"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mcaC:\WINDOWS\system32\backgroundTaskHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Exit code:
1
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
4952"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanelC:\Windows\ImmersiveControlPanel\SystemSettings.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Settings
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\immersivecontrolpanel\systemsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
5780"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\admin\Desktop\4MAY_177.xls"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\program files\microsoft office\root\office16\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\combase.dll
c:\windows\system32\user32.dll
c:\windows\system32\ucrtbase.dll
5836C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\sechost.dll
5872"C:\ProgramData\bWLfWNa.exe" C:\ProgramData\bWLfWNa.exe—EXCEL.EXE
User:
admin
Company:
DragonQuest
Integrity Level:
MEDIUM
Description:
I hope someone learns something from this
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\bwlfwna.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
Total events
5 567
Read events
5 247
Write events
277
Delete events
43

Modification events

(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000284FFA2E02000000000000000500000000000000
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\5780
Operation:writeName:0
Value:
0B0E10433974A18C06164888343EC2A118CC70230046A89DE4D7A9CA88EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E226D2B484F4D616659574A5464337373702B3165327141506A326C775347586F6C4A7635624B6E337449506B3D2200
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(5780) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
3
Suspicious files
0
Text files
197
Unknown types
3

Dropped files

PID
Process
Filename
Type
5780EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4OPB0R2NL2DNQF1BX7D3.temp —
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E24NA3BGUG3C9KS5D34W.temp —
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Local\Temp\.sestext
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFAECBBEABDBA52F34.TMP —
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-shm —
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal —
MD5:—
SHA256:—
4952SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YFMTKU18IH40499UF7AS.temp —
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\4MAY_177.xls.LNKlnk
MD5:—
SHA256:—
5780EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLQBH2R9\278EYJSFYHMS[1].exeexecutable
MD5:—
SHA256:—
5872bWLfWNa.exeC:\Users\admin\AppData\Local\Temp\logC0C7.tmptext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
18
DNS requests
6
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5780
EXCEL.EXE
GET
200
149.255.58.66:443
https://toulousa.com/omg/rockspa.php
GB
executable
748 Kb
whitelisted
5780
EXCEL.EXE
POST
200
52.114.158.91:443
https://self.events.data.microsoft.com/OneCollector/1.0/
US
text
60 b
whitelisted
5780
EXCEL.EXE
GET
200
13.107.3.128:443
https://config.edge.skype.com/config/v2/Office/excel/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=excel&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7bA1743943-068C-4816-8834-3EC2A118CC70%7d&LabMachine=false
US
text
84.2 Kb
malicious
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.29 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.98 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
10.6 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
1724
wermgr.exe
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.98 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5780
EXCEL.EXE
13.107.3.128:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
5780
EXCEL.EXE
149.255.58.66:443
toulousa.com
Awareness Software Limited
GB
suspicious
5780
EXCEL.EXE
52.114.158.91:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown
1724
wermgr.exe
121.100.19.18:449
—
PT Indonesia Comnets Plus
ID
malicious
3296
svchost.exe
20.191.48.196:443
settings-win-ppe.data.microsoft.com
Microsoft Corporation
US
unknown
4572
svchost.exe
40.90.137.124:443
login.live.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.3.128
malicious
toulousa.com
  • 149.255.58.66
whitelisted
self.events.data.microsoft.com
  • 52.114.158.91
  • 52.114.76.34
whitelisted
settings-win-ppe.data.microsoft.com
  • 20.191.48.196
whitelisted
login.live.com
  • 40.90.137.124
  • 40.90.23.154
  • 40.90.137.127
whitelisted

Threats

PID
Process
Class
Message
1724
wermgr.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 3
1724
wermgr.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
1724
wermgr.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4MAY_177.xls