Analysis Report case (1057).xls

ID:	344667
Product:	CloudBasic
Start time:	21:37:14
Start date:	26.01.2021
Sample:	case (1057).xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	cbc37bc9a7ec9836c033708d090db81c
SHA1:	a1fbde54662fb5cdb677f5841a3603df30345108
SHA256:	95e0295b15b7c624febe347f44747dada5cb1fc79b73561b3153af81b351a8de
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\formnet.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\AppData\Local\Temp\0CEE0000	data	96506B88A8B4897447C2DA1F9D7FFD71	5957A5F62CBD61CA5B251D8C600AFD1F3200305C	6C2ACB7F16D49250E36727ED7407CB5222AB8B2861C545098D8EBBB088CCF5EF
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jan 27 04:37:45 2021, atime=Wed Jan 27 04:37:45 2021, length=12288, window=hide	D17536E1426C67D544B2D72DC5DE3799	09550A083E191631D657C94E2795FB4DECE5AF4C	E6043CC648368E153ACF3D55A766F13A3BBF15A4208A4A1C33A9AD9607BFC082
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\case (1057).LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Jan 27 04:37:45 2021, atime=Wed Jan 27 04:37:46 2021, length=99328, window=hide	FB04A916D694DF3124E42A15E0CB6443	8BB0642C12F2B68059C66127D5554CCA241443BF	55A3325CA98295F7B2CBE5C6DAC96F26F5A39738DC1F41A9094EC29A8A20CA9C
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	46B3042494EAFEC48753A085FA3C43F2	0CB9D82BF8EC6B434F39762F6E77590381D64E85	5073BC52701AB83F1BBF99326644E3EA91FF8004CF7550C9C6BFF3F9EBF6D828
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6E2XX33J.txt	ASCII text	BC51AD6D86E70DA86A624A9592B84320	7D8820A967C16C776B636E0347ADD6F69C4F8550	8F1F517526828293A6F6FD66074E3AE2B81AD50E10C07940779761A63D75A204
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\A8FFZF1B.txt	ASCII text	F671FBD2FBEFEF1791AE27109DA50175	9D79D13F382529E9F67701CB32941304BB8DF934	AE489FE22A9E565AA940052E520676CEDA20E889C5CD6921C511219B377B35B8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\HPDR9FYI.txt	ASCII text	46BA3B0F9B7E8A14827348496984EB5B	6D039D97D25D5FEFC013C243615DCAADA337B573	AD9C20F5E0CA87876C650764373C1A50C9101D18B90AB6433B6C33916A5A4105
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\TXFJIAR6.txt	ASCII text	070B9681D06F299E6E66C79320D22753	8F5C298E04698FB570C12B1CCADA589D5BF35B5A	D3364AC7B57548F74E6611033AA5B308470B8BEEEF734E21A157EF333C68A4A1
C:\Users\user\AppData\Roaming\Yzub\doa.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B0F3FA047F6AE39A145FD364F693638E	1951696D8ACA4A31614BB68F9DA392402785E14E	0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
C:\Users\user\Desktop\0DEE0000	Applesoft BASIC program data, first line number 16	8C8D7D84B2CB8F595EE3FC5738CAE230	336EF5E051F17307FCCD0824165816592FE59D94	339FECDBAC760952F2BE49CD806FC08F983053F2BFCBC921FB0677F57DE99D52

AV Detection:

Antivirus or Machine Learning detection for unpacked file

Source: 4.2.rundll32.exe.440000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 5.2.msiexec.exe.d0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.44.135:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49170 version: TLS 1.2

Binary contains paths to debug symbols

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000005.00000003.2174110786.0000000002AF0000.00000004.00000001.sdmp, doa.dll.5.dr

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: scfrd[1].dll.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 0000000Ah		4_2_0044D830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]		4_2_00458830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then add esi, 02h		4_2_0045CE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push 00000000h		4_2_0045DA70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 0000000Ah		5_2_000DD830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then mov eax, dword ptr [edi-08h]		5_2_000E8830
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then add esi, 02h		5_2_000ECE40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then push 00000000h		5_2_000EDA70

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: rnollg.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 172.67.150.228:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 172.67.150.228:443

Networking:

Found malicious URLs in unpacked macro 4.0 sheet

Source: before.1.0.0.sheet.csv_unpack

Macro 4.0 Deobfuscator: https://rnollg.com/kev/scfrd.dll

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Contains functionality to download additional files from the internet

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000D1AF0 InternetReadFile,

5_2_000D1AF0

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Found strings which match to known social media urls

Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: rnollg.com

Urls found in memory or binary data

Source: msiexec.exe, 00000005.00000003.2180098839.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: Https://homesoapmolds.com/post.php
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: http://cacerts.digicert.com/C
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Cl
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: http://crl4.digice
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0K
Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2169819479.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169401108.0000000002097000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2169819479.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169401108.0000000002097000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicer
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000005.00000002.2363950897.0000000000970000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2169819479.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169401108.0000000002097000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2169819479.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169401108.0000000002097000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: 0DEE0000.0.dr	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
Source: case (1057).xls	String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
Source: msiexec.exe, 00000005.00000002.2363950897.0000000000970000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2169819479.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169401108.0000000002097000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: https://gadgetswolf.com/post.php
Source: msiexec.exe, 00000005.00000002.2364998565.0000000002DD0000.00000004.00000001.sdmp	String found in binary or memory: https://govemedico.tk/
Source: msiexec.exe, 00000005.00000002.2364998565.0000000002DD0000.00000004.00000001.sdmp	String found in binary or memory: https://govemedico.tk/_u
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://govemedico.tk/post.php
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://govemedico.tk/post.php.u
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://govemedico.tk/post.phpc
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://homesoapmolds.com/
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://homesoapmolds.com/?p
Source: msiexec.exe, 00000005.00000003.2181370772.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://homesoapmolds.com/post.php
Source: msiexec.exe, 00000005.00000003.2180098839.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.clou
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: before.1.0.0.sheet.csv_unpack	String found in binary or memory: https://rnollg.com/kev/scfrd.dll
Source: case (1057).xls, 0DEE0000.0.dr	String found in binary or memory: https://rnollg.com/kev/scfrd.dll$8
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000005.00000002.2363894570.00000000005B8000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/C
Source: msiexec.exe, 00000005.00000003.2177601344.0000000000606000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.44.135:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.73.69:443 -> 192.168.2.22:49170 version: TLS 1.2

System Summary:

Found malicious Excel 4.0 Macro

Source: case (1057).xls

Initial sample: URLDownloadToFileA

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: Enable Content X J5 - "- jR V \ A B C D E F G H I K L M N O P Q R S T 1 ' Cjdigicert' 3 ,

Found Excel 4.0 Macro with suspicious formulas

Source: case (1057).xls	Initial sample: CALL
Source: case (1057).xls	Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Source: case (1057).xls

Initial sample: Sheet size: 503434

Found obfuscated Excel 4.0 Macro

Source: case (1057).xls

Initial sample: High usage of CHAR() function: 147

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to dropped file

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00449C60		4_2_00449C60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00449A60		4_2_00449A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0045DA70		4_2_0045DA70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00443A30		4_2_00443A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00455BF0		4_2_00455BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050D806		4_2_0050D806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050F8FD		4_2_0050F8FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050D2C4		4_2_0050D2C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050BB6E		4_2_0050BB6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050DD48		4_2_0050DD48
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9C60		5_2_000D9C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D3A30		5_2_000D3A30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000D9A60		5_2_000D9A60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000EDA70		5_2_000EDA70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E5BF0		5_2_000E5BF0

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\formnet.dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: doa.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Binary contains paths to development resources

Source: rundll32.exe, 00000003.00000002.2169682622.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2169237640.0000000001EB0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal100.expl.evad.winXLS@7/12@4/4

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 5_2_000E9C90 AdjustTokenPrivileges,

5_2_000E9C90

Contains functionality to enum processes or threads

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_004569A0

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\0DEE0000

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{6564EBFF-51EC-A92E-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{451CDBFF-61EC-8956-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{F5F5D963-6370-39BF-3E66-73D0C2BEFC46}

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRDDB1.tmp

Jump to behavior

Document contains an OLE Workbook stream indicating a Microsoft Excel file

Source: case (1057).xls

OLE indicator, Workbook stream: true

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:

Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000005.00000003.2174110786.0000000002AF0000.00000004.00000001.sdmp, doa.dll.5.dr

Document has a 'lastprinted' value indicative of goodware

Source: case (1057).xls

Initial sample: OLE summary lastprinted = 2021-01-26 16:17:13

Document has a 'vbamacros' value indicative of goodware

Source: case (1057).xls

Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0044D830 LoadLibraryA,GetProcAddress,

4_2_0044D830

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046D1F2 push dword ptr [ecx]; iretd		4_2_0046D1F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046E9FA push esi; retf		4_2_0046EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046EA51 push esi; retf		4_2_0046EABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00469A5D push ebp; iretd		4_2_00469AEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004682EB push eax; ret		4_2_0046834A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_005093ED push ecx; ret		4_2_00509400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046B56F push esp; ret		4_2_0046B581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046B700 push ss; ret		4_2_0046B735
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00522B73 push esi; ret		4_2_00522B75

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Yzub\doa.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\ProgramData\formnet.dll			Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\ProgramData\formnet.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_004569A0

Found dropped PE file which has not been started or loaded

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Yzub\doa.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\ProgramData\formnet.dll			Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\msiexec.exe TID: 2760

Thread sleep time: -300000s >= -30000s

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0050A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_0050A0CC

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004569A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next,

4_2_004569A0

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0044D830 LoadLibraryA,GetProcAddress,

4_2_0044D830

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00452EF0 mov eax, dword ptr fs:[00000030h]		4_2_00452EF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00520D28 mov eax, dword ptr fs:[00000030h]		4_2_00520D28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00520C5E mov eax, dword ptr fs:[00000030h]		4_2_00520C5E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00520865 push dword ptr fs:[00000030h]		4_2_00520865
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_000E2EF0 mov eax, dword ptr fs:[00000030h]		5_2_000E2EF0

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0050A0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050ABA4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_0050ABA4

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0044AE40 CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,SetThreadContext,VirtualProtectEx,ResumeThread,ExitProcess,

4_2_0044AE40

Yara detected hidden Macro 4.0 in Excel

Source: Yara match

File source: case (1057).xls, type: SAMPLE

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: msiexec.exe, 00000005.00000002.2364330379.0000000001000000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: msiexec.exe, 00000005.00000002.2364330379.0000000001000000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000005.00000002.2364330379.0000000001000000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0050968A cpuid

4_2_0050968A

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetLocaleInfoA,

4_2_0050F6BB

Queries the product ID of Windows

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_005095A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_005095A6

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00441A00 CreateDialogParamW,GetVersion,

4_2_00441A00

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior