Windows Analysis Report
Bijlage 2 Vragenlijst.xlsx

Overview

General Information

Sample name: Bijlage 2 Vragenlijst.xlsx
Analysis ID: 1417448
MD5: fd2cb6ad9501c1a33d41c48e6e0d29c7
SHA1: f97c475da86fc2a88211e5f4813ce19d0cadf54b
SHA256: 4d75da97852c7a36c17b8dabf791be20e03bfaeb3f47db1309ecef8507dd3f72
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Document misses a certain OLE stream usually present in this Microsoft Office document type
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections

Classification

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49737 version: TLS 1.2
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49736
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49733 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49733
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49737 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49737
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49734 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49734
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49735 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49735
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49738
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49739 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49739
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49740 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49740
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49741 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49741
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 192.168.2.5:49742 -> 13.107.246.40:443
Source: global traffic TCP traffic: 13.107.246.40:443 -> 192.168.2.5:49742
Source: excel.exe Memory has grown: Private usage: 2MB later: 75MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.40 13.107.246.40
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.5:49737 version: TLS 1.2
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 3BCF1243.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: clean4.winXLSX@3/5@0/1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$Bijlage 2 Vragenlijst.xlsx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{ABD93842-7609-4511-882A-C127CD4A44DC} - OProcSessId.dat Jump to behavior
Source: Bijlage 2 Vragenlijst.xlsx OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000303-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = docProps/custom.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/item2.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/item3.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/item4.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/itemProps4.xml
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE zip file path = customXml/_rels/item4.xml.rels
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: Bijlage 2 Vragenlijst.xlsx Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 835 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1417448 Sample: Bijlage 2 Vragenlijst.xlsx Startdate: 29/03/2024 Architecture: WINDOWS Score: 4 5 EXCEL.EXE 188 63 2->5         started        dnsIp3 10 part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49733, 49734 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 5->10 8 splwow64.exe 1 5->8         started        process4
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.40
 part-0012.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
part-0012.t-0009.t-msedge.net 13.107.246.40 true