Loading ...

Play interactive tourEdit tour

Analysis Report Form_0015135479.xls

Overview

General Information

Sample Name:Form_0015135479.xls
Analysis ID:255273
MD5:2d28a4e03ec3c94fbaa1e3c1c333bd51
SHA1:c812e11daad5bc081159f5f80979686d08ce59c0
SHA256:7a7269271ab8c721df1f43ac853d4b71cef7e5015696d2bb46f89fcb3ce92160

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Found abnormal large hidden Excel 4.0 Macro sheet
Allocates a big amount of memory (probably used for heap spraying)
Document contains embedded VBA macros
Yara detected Xls With Macro 4.0
Yara signature match

Classification

Startup

  • System is w10x64
  • EXCEL.EXE (PID: 6820 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
Form_0015135479.xlsSUSP_EnableContent_String_GenDetects suspicious string that asks to enable active content in Office DocFlorian Roth
  • 0x3a76b:$e1: Enable Editing
  • 0x3a7dd:$e2: Enable Content
Form_0015135479.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x3aca2:$s1: Excel
  • 0x3bd02:$s1: Excel
  • 0x341a:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
Form_0015135479.xlsJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results
    Source: excel.exeMemory has grown: Private usage: 1MB later: 105MB
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.aadrm.com/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.onedrive.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://app.powerbi.com/taskpane.html
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://augloop.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cdn.entity.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://clients.config.office.net/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://config.edge.skype.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cortana.ai
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://cr.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://devnull.onenote.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://directory.services.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://graph.windows.net
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://graph.windows.net/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://lifecycle.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.microsoftonline.com/common
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.windows.local
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://management.azure.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://management.azure.com/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://messaging.office.com/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ncus-000.contentsync.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://officeapps.live.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://onedrive.live.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://settings.outlook.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://tasks.office.com
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://wus2-000.contentsync.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: 0ABCA72C-9AD3-4832-A673-D3EB1DA5E25F.0.drString found in binary or memory: https://www.odwebp.svc.ms

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 8Screenshot OCR: Enable Editing from the yellow bar above 3. Once you have enabled editing, please click Enable Co
    Source: Screenshot number: 8Screenshot OCR: Enable Content from the yellow This documents is protected Document CD i 'I Ready O Type here t
    Source: Document image extraction number: 0Screenshot OCR: Enable Editing from the yellow bar above 3. Once you have enabled editing, please click Enable Co
    Source: Document image extraction number: 0Screenshot OCR: Enable Content from the yellow This documents is protected
    Source: Document image extraction number: 4Screenshot OCR: Enable Editing from the yellow bar above 3. Once you have enabled editing, please click Enable Co
    Source: Document image extraction number: 4Screenshot OCR: Enable Content from the yellow This documents is protected
    Found abnormal large hidden Excel 4.0 Macro sheetShow sources
    Source: Form_0015135479.xlsInitial sample: Sheet size: 14904981
    Source: Form_0015135479.xlsOLE indicator, VBA macros: true
    Source: Form_0015135479.xls, type: SAMPLEMatched rule: SUSP_EnableContent_String_Gen date = 2019-02-12, hash1 = 525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de, author = Florian Roth, description = Detects suspicious string that asks to enable active content in Office Doc, reference = Internal Research
    Source: Form_0015135479.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
    Source: classification engineClassification label: mal52.evad.winXLS@1/7@0/0
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{4FEC4DC8-9F6E-4819-B83C-8020FF914F0B} - OProcSessId.datJump to behavior
    Source: Form_0015135479.xlsOLE indicator, Workbook stream: true
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: Yara matchFile source: Form_0015135479.xls, type: SAMPLE

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting11Path InterceptionExtra Window Memory Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Scripting11Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Extra Window Memory Injection1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 255273