Windows Analysis Report
Aztec UP&GO to we 14 April 2024.xlsx

Overview

General Information

Sample name:	Aztec UP&GO to we 14 April 2024.xlsx
Analysis ID:	1430697
MD5:	c76dd19102a9d3a23ab7f1c8310e67ce
SHA1:	298059c88ad8b3e43a684399dd4a4046967a629e
SHA256:	89e32b796c07a5558b9923db4cd2df7f63284c209a7898d97be92e92d458700b
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Classification

Signatures

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49732 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 192.168.2.12:49732 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49732
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 192.168.2.12:49734 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49734
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 192.168.2.12:49733 -> 13.107.213.69:443
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733
Source: global traffic	TCP traffic: 13.107.213.69:443 -> 192.168.2.12:49733

Source: excel.exe

Memory has grown: Private usage: 2MB later: 92MB

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.213.69 13.107.213.69

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.0.dr

String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.69:443 -> 192.168.2.12:49732 version: TLS 1.2

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: A19C2E78.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean4.winXLSX@3/5@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Aztec UP&GO to we 14 April 2024.xlsx

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{D5E9CE68-76DD-4DEF-AE78-4B9792620451} - OProcSessId.dat

Jump to behavior

Source: Aztec UP&GO to we 14 April 2024.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000303-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Aztec UP&GO to we 14 April 2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Aztec UP&GO to we 14 April 2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: Aztec UP&GO to we 14 April 2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Aztec UP&GO to we 14 April 2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Aztec UP&GO to we 14 April 2024.xlsx	Initial sample: OLE zip file path = xl/comments1.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Aztec UP&GO to we 14 April 2024.xlsx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 751

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.213.69	part-0041.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
part-0041.t-0009.t-msedge.net	13.107.213.69	true
windowsupdatebg.s.llnwi.net	68.142.107.4	true

ID:	1430697
Product:	CloudBasic
Start time:	03:01:19
Start date:	24.04.2024
Sample:	Aztec UP&GO to we 14 April 2024.xlsx
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c76dd19102a9d3a23ab7f1c8310e67ce
SHA1:	298059c88ad8b3e43a684399dd4a4046967a629e
SHA256:	89e32b796c07a5558b9923db4cd2df7f63284c209a7898d97be92e92d458700b
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression	1BFE591A4FE3D91B03CDF26EAACD8F89	719C37C320F518AC168C86723724891950911CEA	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	data	1C79DCB4AAE4AAD60D7EEEFE38C105F1	32110F99C53DFD9D297C93FC697AE2640DA866EA	6227C33EC7405FECB176C2A0A3D720AF215D41483280E9F16AE807ED7FED70AA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A19C2E78.tmp	Composite Document File V2 Document, Cannot read section info	72F5C05B7EA8DD6059BF59F50B22DF33	D5AF52E129E15E3A34772806F6C5FBF132E7408E	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
C:\Users\user\AppData\Local\Temp\~DFFA236DBD6C9D60E3.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\Desktop\~$Aztec UP&GO to we 14 April 2024.xlsx	data	037948E5945313159DC8146EB7973386	4CEF8EE5AF61A21ADB398F6C296F48242158A1AA	E63CBDD61699DD98D41777B269B57916B6E67F51E457D71BF62E8BD56D1362E4

Windows Analysis Report
Aztec UP&GO to we 14 April 2024.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Aztec UP&GO to we 14 April 2024.xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Aztec UP&GO to we 14 April 2024.xlsx