Windows Analysis Report
Fiche_d#U00e9coupe_Dispano_2022.xlsm

Overview

General Information

Sample name: Fiche_d#U00e9coupe_Dispano_2022.xlsm
renamed because original name is a hash value
Original sample name: Fiche_dcoupe_Dispano_2022.xlsm
Analysis ID: 1432111
MD5: 554cf4663aab00c7d33c95dbb7e0a834
SHA1: 8781f9e8a425c5dd75e5ce1a28d81c490f93ddb7
SHA256: 75a967f29c4e4c7423fe942c2f829c4e303ed1af0c609a2acbf133ed55da10a5
Infos:

Detection

Score: 27
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Document contains an embedded VBA with many string operations indicating source code obfuscation
Abnormal high CPU Usage
Contains long sleeps (>= 3 min)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains an embedded VBA which might only executes on specific systems (country or language check)
Document contains embedded VBA macros
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections

Classification

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49757 version: TLS 1.2
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49757 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49758 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49758
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49757
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49754 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49754
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49755 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49755
Source: global traffic TCP traffic: 192.168.2.4:49756 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49756
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49763 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49763
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49760 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49760
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 192.168.2.4:49759 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49759
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 192.168.2.4:49762 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49762
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: global traffic TCP traffic: 192.168.2.4:49761 -> 13.107.246.41:443
Source: global traffic TCP traffic: 13.107.246.41:443 -> 192.168.2.4:49761
Source: excel.exe Memory has grown: Private usage: 2MB later: 92MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View IP Address: 13.107.246.41 13.107.246.41
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global traffic HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324007v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.41:443 -> 192.168.2.4:49757 version: TLS 1.2
Abnormal high CPU Usage
Source: C:\Windows\splwow64.exe Process Stats: CPU usage > 49%
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm OLE, VBA macro line: 'Private Sub Workbook_Open()
Document contains embedded VBA macros
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm OLE indicator, VBA macros: true
Source: classification engine Classification label: sus27.evad.winXLSM@3/31@0/1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$Fiche_d#U00e9coupe_Dispano_2022.xlsm Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{59808287-BEEA-439A-B03E-C352268C9E01} - OProcSessId.dat Jump to behavior
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AC9F2F90-E877-11CE-9F68-00AA00574A4F}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/drawings/drawing3.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/drawings/vmlDrawing2.vml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet7.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image3.png
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image4.png
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image9.jpeg
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image10.jpeg
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image11.png
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image12.jpeg
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image13.jpeg
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet4.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = docProps/custom.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/externalLinks/externalLink1.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp1.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp2.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/tables/table1.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/comments1.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/tables/table2.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp3.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp4.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings7.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/item2.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/item4.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/itemProps4.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/item3.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink1.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = customXml/_rels/item4.xml.rels
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/activeX/activeX7.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image5.emf
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image4.emf
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/activeX/activeX6.xml
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/media/image3.emf
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/activeX/activeX6.bin
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Initial sample: OLE zip file path = xl/activeX/_rels/activeX6.xml.rels
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior

Data Obfuscation
barindex
Document contains an embedded VBA with many string operations indicating source code obfuscation
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Stream path 'VBA/Module1' : High number of string operations
Source: VBA code instrumentation OLE, VBA macro, High number of string operations: Module Module1 Name: Module1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Thread delayed: delay time: 922337203685477 Jump to behavior
Document contains an embedded VBA which might only executes on specific systems (country or language check)
Source: Fiche_d#U00e9coupe_Dispano_2022.xlsm Stream path 'VBA/Module1' : te), 2) & Format(Date, "mm") & Format(Date, "dd") & " "
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 1828 Jump to behavior
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 8114 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432111 Sample: Fiche_d#U00e9coupe_Dispano_... Startdate: 26/04/2024 Architecture: WINDOWS Score: 27 13 Document contains an embedded VBA with many string operations indicating source code obfuscation 2->13 6 EXCEL.EXE 212 121 2->6         started        process3 dnsIp4 11 part-0013.t-0009.t-msedge.net 13.107.246.41, 443, 49754, 49755 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 6->11 9 splwow64.exe 6->9         started        process5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.41
 part-0013.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
part-0013.t-0009.t-msedge.net 13.107.246.41 true