Loading ...

Play interactive tourEdit tour

Analysis Report Receipt5477.xls

Overview

General Information

Sample Name:Receipt5477.xls
Analysis ID:253921
MD5:6237590b08d1b9bf65763b59d6cbaa2f
SHA1:f43da2fb67b456b97e1fd95cc6a39bfc9abed9fe
SHA256:5babfbe49ea18589ff2649407c0de8aeb2da059b819a0c1be5404ca84dde2e51

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document exploit detected (creates forbidden files)
Found malicious Excel 4.0 Macro
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Execute DLL with spoofed extension
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Found malicious URLs in unpacked macro 4.0 sheet
Injects code into the Windows Explorer (explorer.exe)
Microsoft Office drops suspicious files
Sigma detected: Microsoft Office Product Spawning Windows Shell
Contains capabilities to detect virtual machines
Document contains embedded VBA macros
Found WSH timer for Javascript or VBS script (likely evasive script)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Tries to load missing DLLs
Unable to load, office file is protected or invalid

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 6828 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • explorer.exe (PID: 4708 cmdline: explorer.exe C:\Users\Public\j0kC1gF.vbs MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)
    • rundll32.exe (PID: 3692 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • explorer.exe (PID: 6324 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: AD5296B280E8F522A8A897C96BAB0E1D)
    • wscript.exe (PID: 6224 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\Public\j0kC1gF.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Execute DLL with spoofed extensionShow sources
Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, CommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6828, ProcessCommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, ProcessId: 3692
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis: Data: Command: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, CommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6828, ProcessCommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer, ProcessId: 3692

Signature Overview

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\Public\j0kC1gF.vbsJump to behavior
Document exploit detected (UrlDownloadToFile)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
Source: global trafficDNS query: name: g.msn.com

Networking:

barindex
Found malicious URLs in unpacked macro 4.0 sheetShow sources
Source: xlsm.sheet.csv_unpackMacro 4.0 Deobfuscator: https://magic-place.fr/wp-crunch.php
Source: xlsm.sheet.csv_unpackMacro 4.0 Deobfuscator: https://esoseraz.cf/wp-crunch.php
Source: xlsm.sheet.csv_unpackMacro 4.0 Deobfuscator: https://hongsamlinhchi.vn/wp-crunch.php
Source: xlsm.sheet.csv_unpackMacro 4.0 Deobfuscator: https://velocitii.com/wp-crunch.php
Source: unknownDNS traffic detected: queries for: g.msn.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.aadrm.com/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.onedrive.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://app.powerbi.com/taskpane.html
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://augloop.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cdn.entity.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://clients.config.office.net/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://config.edge.skype.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cortana.ai
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://cr.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://devnull.onenote.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://directory.services.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: xlsm.sheet.csv_unpackString found in binary or memory: https://esoseraz.cf/wp-crunch.php
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://graph.windows.net
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://graph.windows.net/
Source: xlsm.sheet.csv_unpackString found in binary or memory: https://hongsamlinhchi.vn/wp-crunch.php
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://lifecycle.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.microsoftonline.com/common
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.windows.local
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: xlsm.sheet.csv_unpackString found in binary or memory: https://magic-place.fr/wp-crunch.php
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://management.azure.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://management.azure.com/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://messaging.office.com/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://officeapps.live.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://onedrive.live.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://powerlift.acompli.net
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://settings.outlook.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://tasks.office.com
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: xlsm.sheet.csv_unpackString found in binary or memory: https://velocitii.com/wp-crunch.php
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: B34A5D9D-1821-4364-9C0B-DB26D0A942D7.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Found malicious Excel 4.0 MacroShow sources
Source: Receipt5477.xlsInitial sample: URLDownloadToFileA
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable Editing" button from the yellow bar above. Once You have enabled editing, please click "Enab
Source: Screenshot number: 4Screenshot OCR: Protected document Click "Enable Editing" button from the yellow bar above. Once You have enabled
Source: Screenshot number: 4Screenshot OCR: Enable Content" button from Sheet1 Ready O Type here to search 'I FI a a g xg EQ q"' ::::,::,
Found Excel 4.0 Macro with suspicious formulasShow sources
Source: Receipt5477.xlsInitial sample: EXEC
Found abnormal large hidden Excel 4.0 Macro sheetShow sources
Source: Receipt5477.xlsInitial sample: Sheet size: 4801
Source: Receipt5477.xlsInitial sample: Sheet size: 14592758
Microsoft Office drops suspicious filesShow sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\Public\j0kC1gF.vbsJump to behavior
Source: Receipt5477.xlsOLE indicator, VBA macros: true
Source: C:\Windows\SysWOW64\rundll32.exeSection loaded: sfc.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEWindow title found: microsoft excel okthe workbook cannot be opened or repaired by microsoft excel because it's corrupt.
Source: classification engineClassification label: mal100.expl.evad.winXLS@8/8@2/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{8D002508-87F9-4C93-98A9-ED851AB7610B} - OProcSessId.datJump to behavior
Source: Receipt5477.xlsOLE indicator, Workbook stream: true
Source: unknownProcess created: C:\Windows\SysWOW64\explorer.exe explorer.exe C:\Users\Public\j0kC1gF.vbs
Source: unknownProcess created: C:\Windows\SysWOW64\explorer.exe
Source: unknownProcess created: C:\Windows\explorer.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknownProcess created: C:\Windows\SysWOW64\explorer.exe explorer.exe C:\Users\Public\j0kC1gF.vbs
Source: unknownProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\Public\j0kC1gF.vbs'
Source: unknownProcess created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServer
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\explorer.exe explorer.exe C:\Users\Public\j0kC1gF.vbsJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\Public\fgXesD.html,DllRegisterServerJump to behavior
Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\Public\j0kC1gF.vbs' Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Windows\explorer.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Jump to behavior
Source: C:\Windows\explorer.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: rundll32.exe, 0000000A.00000002.331409162.00000000044E0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: rundll32.exe, 0000000A.00000002.331409162.00000000044E0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: rundll32.exe, 0000000A.00000002.331409162.00000000044E0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000007.00000002.560880113.0000000000569000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 0000000A.00000002.331409162.00000000044E0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects code into the Windows Explorer (explorer.exe)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEMemory written: PID: 4708 base: 850000 value: B8Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEMemory written: PID: 4708 base: 6122D8 value: 00Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEMemory written: PID: 4708 base: 6131E8 value: 00Jump to behavior
Source: explorer.exe, 00000007.00000002.561446360.0000000000BC0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000002.561446360.0000000000BC0000.00000002.00000001.sdmpBinary or memory string: Progman
Source: explorer.exe, 00000007.00000002.561446360.0000000000BC0000.00000002.00000001.sdmpBinary or memory string: Program ManagerNd[\
Source: explorer.exe, 00000007.00000002.561446360.0000000000BC0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting321DLL Side-Loading1Process Injection12Masquerading1OS Credential DumpingQuery Registry1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution31Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemorySecurity Software Discovery11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion1Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting321LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonRundll321Cached Domain CredentialsSystem Information Discovery3VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsDLL Side-Loading1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet