Analysis Report case (166).xls

Overview

General Information

Sample Name: case (166).xls
Analysis ID: 344660
MD5: 44b43922e08e0e8e1ec65300b3b1aa74
SHA1: ec1a847009295036381af1b0a4383a61c3dcbb75
SHA256: 9b8516fcbe183de0a53ac47ea7f4289176e23fc82da1fe67c70cedc823f5dba6
Tags: xls

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malicious Excel 4.0 Macro
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Contains functionality to inject code into remote processes
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Found malicious URLs in unpacked macro 4.0 sheet
Found obfuscated Excel 4.0 Macro
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the product ID of Windows
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: case (166).xls Virustotal: Detection: 22% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.msiexec.exe.90000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 4.2.rundll32.exe.840000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.44.135:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.158.184:443 -> 192.168.2.22:49168 version: TLS 1.2
Binary contains paths to debug symbols
Source: Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000005.00000003.2161177103.0000000002990000.00000004.00000001.sdmp, scfrd[1].dll.0.dr

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: scfrd[1].dll.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then push 0000000Ah 4_2_0084D830
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then mov eax, dword ptr [edi-08h] 4_2_00858830
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then add esi, 02h 4_2_0085CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then push 00000000h 4_2_0085DA70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then push 0000000Ah 5_2_0009D830
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then mov eax, dword ptr [edi-08h] 5_2_000A8830
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then add esi, 02h 5_2_000ACE40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then push 00000000h 5_2_000ADA70
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: rnollg.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Networking:

barindex
Found malicious URLs in unpacked macro 4.0 sheet
Source: before.1.0.0.sheet.csv_unpack Macro 4.0 Deobfuscator: https://rnollg.com/kev/scfrd.dll
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_00091AF0 InternetReadFile, 5_2_00091AF0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ Jump to behavior
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: rnollg.com
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: Https://homesoapmolds.com/post.phpZ
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroo4
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot202n
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0K
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2156891016.0000000001C87000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156420198.0000000002307000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2156891016.0000000001C87000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156420198.0000000002307000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000005.00000002.2354613249.0000000001F80000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2156891016.0000000001C87000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156420198.0000000002307000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2156891016.0000000001C87000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156420198.0000000002307000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: A1EE0000.0.dr String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
Source: case (166).xls String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
Source: msiexec.exe, 00000005.00000002.2354613249.0000000001F80000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: http://www.digicert.com/CPS0v
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2156891016.0000000001C87000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156420198.0000000002307000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/A
Source: msiexec.exe, 00000005.00000003.2165360506.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://gadgetswolf.com/post.php
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/post.phpr
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/post.phpx
Source: msiexec.exe, 00000005.00000002.2354459439.0000000000420000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/y
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: https://govemedico.tk/
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: https://govemedico.tk/O
Source: msiexec.exe, 00000005.00000002.2354494113.000000000047D000.00000004.00000020.sdmp String found in binary or memory: https://govemedico.tk/post.php
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://homesoapmolds.com/
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://homesoapmolds.com/=
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://homesoapmolds.com/post.php
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://homesoapmolds.com/post.phpv
Source: msiexec.exe, 00000005.00000002.2354487031.0000000000468000.00000004.00000020.sdmp String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: before.1.0.0.sheet.csv_unpack String found in binary or memory: https://rnollg.com/kev/scfrd.dll
Source: case (166).xls, A1EE0000.0.dr String found in binary or memory: https://rnollg.com/kev/scfrd.dll$8
Source: msiexec.exe, 00000005.00000003.2166786522.000000000047D000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000005.00000002.2354437908.00000000003FF000.00000004.00000020.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.44.135:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.158.184:443 -> 192.168.2.22:49168 version: TLS 1.2

System Summary:

barindex
Found malicious Excel 4.0 Macro
Source: case (166).xls Initial sample: URLDownloadToFileA
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Content X E14 - "" jR V \ A B C D E F G H I J K L M N O P Q R S T 1 ' Cjdigicert' 3
Found Excel 4.0 Macro with suspicious formulas
Source: case (166).xls Initial sample: CALL
Source: case (166).xls Initial sample: CALL
Found abnormal large hidden Excel 4.0 Macro sheet
Source: case (166).xls Initial sample: Sheet size: 503434
Found obfuscated Excel 4.0 Macro
Source: case (166).xls Initial sample: High usage of CHAR() function: 147
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00849C60 4_2_00849C60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00843A30 4_2_00843A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00849A60 4_2_00849A60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0085DA70 4_2_0085DA70
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00855BF0 4_2_00855BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090F8FD 4_2_0090F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090D806 4_2_0090D806
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090D2C4 4_2_0090D2C4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090BB6E 4_2_0090BB6E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090DD48 4_2_0090DD48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_00099C60 5_2_00099C60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_00093A30 5_2_00093A30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_00099A60 5_2_00099A60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_000ADA70 5_2_000ADA70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_000A5BF0 5_2_000A5BF0
Source: egwih.dll.5.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: rundll32.exe, 00000003.00000002.2156724187.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2156276281.0000000002120000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.expl.evad.winXLS@7/12@4/4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_000A9C90 AdjustTokenPrivileges, 5_2_000A9C90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_008569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 4_2_008569A0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\A1EE0000 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{6564EBFF-51EC-A92E-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{451CDBFF-61EC-8956-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{F5F5D963-6370-39BF-3E66-73D0C2BEFC46}
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD4BC.tmp Jump to behavior
Source: case (166).xls OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: case (166).xls Virustotal: Detection: 22%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000005.00000003.2161177103.0000000002990000.00000004.00000001.sdmp, scfrd[1].dll.0.dr
Source: case (166).xls Initial sample: OLE summary lastprinted = 2021-01-26 16:17:13
Source: case (166).xls Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0084D830 LoadLibraryA,GetProcAddress, 4_2_0084D830
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0086D1F2 push dword ptr [ecx]; iretd 4_2_0086D1F9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0086E9FA push esi; retf 4_2_0086EABE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_008682EB push eax; ret 4_2_0086834A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0086EA51 push esi; retf 4_2_0086EABE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00869A5D push ebp; iretd 4_2_00869AEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_009093ED push ecx; ret 4_2_00909400
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0086B56F push esp; ret 4_2_0086B581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0086B700 push ss; ret 4_2_0086B735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00922B73 push esi; ret 4_2_00922B75

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Roaming\Ywmiu\egwih.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_008569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 4_2_008569A0
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Ywmiu\egwih.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\ProgramData\formnet.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2840 Thread sleep time: -300000s >= -30000s Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0090A0CC
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_008569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 4_2_008569A0
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0084D830 LoadLibraryA,GetProcAddress, 4_2_0084D830
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00852EF0 mov eax, dword ptr fs:[00000030h] 4_2_00852EF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00920D28 mov eax, dword ptr fs:[00000030h] 4_2_00920D28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00920C5E mov eax, dword ptr fs:[00000030h] 4_2_00920C5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00920865 push dword ptr fs:[00000030h] 4_2_00920865
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_000A2EF0 mov eax, dword ptr fs:[00000030h] 5_2_000A2EF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0090A0CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090ABA4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_0090ABA4

HIPS / PFW / Operating System Protection Evasion:

barindex
Contains functionality to inject code into remote processes
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0084AE40 CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,SetThreadContext,VirtualProtectEx,ResumeThread,ExitProcess, 4_2_0084AE40
Yara detected hidden Macro 4.0 in Excel
Source: Yara match File source: case (166).xls, type: SAMPLE
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe Jump to behavior
Source: msiexec.exe, 00000005.00000002.2354558666.0000000000A80000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: msiexec.exe, 00000005.00000002.2354558666.0000000000A80000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000005.00000002.2354558666.0000000000A80000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_0090968A cpuid 4_2_0090968A
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 4_2_0090F6BB
Queries the product ID of Windows
Source: C:\Windows\SysWOW64\msiexec.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_009095A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 4_2_009095A6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4_2_00841A00 CreateDialogParamW,GetVersion, 4_2_00841A00
Source: C:\Windows\SysWOW64\msiexec.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 344660 Sample: case (166).xls Startdate: 26/01/2021 Architecture: WINDOWS Score: 100 36 Multi AV Scanner detection for submitted file 2->36 38 Found malicious Excel 4.0 Macro 2->38 40 Document exploit detected (drops PE files) 2->40 42 8 other signatures 2->42 8 EXCEL.EXE 89 42 2->8         started        process3 dnsIp4 34 rnollg.com 172.67.150.228, 443, 49165 CLOUDFLARENETUS United States 8->34 24 C:\Users\user\AppData\Local\...\scfrd[1].dll, PE32 8->24 dropped 26 C:\ProgramData\formnet.dll, PE32 8->26 dropped 44 Document exploit detected (creates forbidden files) 8->44 46 Document exploit detected (process start blacklist hit) 8->46 48 Document exploit detected (UrlDownloadToFile) 8->48 13 rundll32.exe 8->13         started        file5 signatures6 process7 process8 15 rundll32.exe 13->15         started        signatures9 50 Contains functionality to inject code into remote processes 15->50 18 msiexec.exe 2 33 15->18         started        process10 dnsIp11 28 gadgetswolf.com 104.21.44.135, 443, 49166 CLOUDFLARENETUS United States 18->28 30 govemedico.tk 172.67.158.184, 443, 49168 CLOUDFLARENETUS United States 18->30 32 homesoapmolds.com 172.67.198.109, 443, 49167 CLOUDFLARENETUS United States 18->32 22 C:\Users\user\AppData\Roaming\...\egwih.dll, PE32 18->22 dropped file12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.158.184
 unknown United States
13335 CLOUDFLARENETUS false
172.67.150.228
 unknown United States
13335 CLOUDFLARENETUS false
104.21.44.135
 unknown United States
13335 CLOUDFLARENETUS false
172.67.198.109
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
homesoapmolds.com 172.67.198.109 true
rnollg.com 172.67.150.228 true
gadgetswolf.com 104.21.44.135 true
govemedico.tk 172.67.158.184 true