Analysis Report SecuriteInfo.com.Heur.30497.14031

Overview

General Information

Sample Name: SecuriteInfo.com.Heur.30497.14031 (renamed file extension from 14031 to xls)
Analysis ID: 344767
MD5: 26f124898bf4a54f4c110bb58b3f38c4
SHA1: a3eaad9a0cb49e8e12678c9e82d93e53d7d38008
SHA256: 989e829731d55da1c9f0afdcebd1de9df19bfa1ff8935cee7b0eb8f1b5378fc5

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malicious Excel 4.0 Macro
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Contains functionality to inject code into remote processes
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Found malicious URLs in unpacked macro 4.0 sheet
Found obfuscated Excel 4.0 Macro
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Yara detected hidden Macro 4.0 in Excel
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the product ID of Windows
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.msiexec.exe.90000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 3.2.rundll32.exe.970000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.158.184:443 -> 192.168.2.22:49168 version: TLS 1.2
Binary contains paths to debug symbols
Source: Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000004.00000003.2159256851.00000000022C0000.00000004.00000001.sdmp, scfrd[1].dll.0.dr

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: scfrd[1].dll.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then push 0000000Ah 3_2_0097D830
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then mov eax, dword ptr [edi-08h] 3_2_00988830
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then add esi, 02h 3_2_0098CE40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then push 00000000h 3_2_0098DA70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then push 0000000Ah 4_2_0009D830
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then mov eax, dword ptr [edi-08h] 4_2_000A8830
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then add esi, 02h 4_2_000ACE40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then push 00000000h 4_2_000ADA70
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: rnollg.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 172.67.150.228:443

Networking:

barindex
Found malicious URLs in unpacked macro 4.0 sheet
Source: before.1.0.0.sheet.csv_unpack Macro 4.0 Deobfuscator: https://rnollg.com/kev/scfrd.dll
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_00091AF0 InternetReadFile, 4_2_00091AF0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ Jump to behavior
Source: msiexec.exe, 00000004.00000002.2355352317.000000000071B000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com,. equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: msiexec.exe, 00000004.00000002.2355352317.000000000071B000.00000004.00000020.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: rnollg.com
Source: msiexec.exe, 00000004.00000003.2163545510.000000000076F000.00000004.00000001.sdmp String found in binary or memory: Https://homesoapmolds.com/post.php
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp, msiexec.exe, 00000004.00000002.2355352317.000000000071B000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: msiexec.exe, 00000004.00000002.2356290473.0000000002EC0000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0K
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000002.00000002.2155690592.0000000001D27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154774311.0000000002117000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000002.00000002.2155690592.0000000001D27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154774311.0000000002117000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000004.00000002.2355484698.0000000001ED0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000002.00000002.2155690592.0000000001D27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154774311.0000000002117000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000002.00000002.2155690592.0000000001D27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154774311.0000000002117000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: D0EE0000.0.dr String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
Source: SecuriteInfo.com.Heur.30497.xls String found in binary or memory: http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
Source: msiexec.exe, 00000004.00000002.2355484698.0000000001ED0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000004.00000002.2356290473.0000000002EC0000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: http://www.digicert.com/CPS0v
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000002.00000002.2155690592.0000000001D27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154774311.0000000002117000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: msiexec.exe, 00000004.00000002.2355361210.0000000000732000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/
Source: msiexec.exe, 00000004.00000002.2355352317.000000000071B000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/post.php
Source: msiexec.exe, 00000004.00000002.2355352317.000000000071B000.00000004.00000020.sdmp String found in binary or memory: https://gadgetswolf.com/post.phpF/
Source: msiexec.exe, 00000004.00000002.2356290473.0000000002EC0000.00000004.00000001.sdmp String found in binary or memory: https://govemedico.tk/
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://govemedico.tk/post.php
Source: msiexec.exe, 00000004.00000002.2356290473.0000000002EC0000.00000004.00000001.sdmp String found in binary or memory: https://govemedico.tk/t
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://homesoapmolds.com/
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://homesoapmolds.com/post.php
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://homesoapmolds.com/post.phpx
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: before.1.0.0.sheet.csv_unpack String found in binary or memory: https://rnollg.com/kev/scfrd.dll
Source: SecuriteInfo.com.Heur.30497.xls, D0EE0000.0.dr String found in binary or memory: https://rnollg.com/kev/scfrd.dll$8
Source: msiexec.exe, 00000004.00000002.2355385935.0000000000770000.00000004.00000020.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000004.00000002.2355322925.00000000006EF000.00000004.00000020.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown HTTPS traffic detected: 172.67.150.228:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.200.147:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.198.109:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.158.184:443 -> 192.168.2.22:49168 version: TLS 1.2

System Summary:

barindex
Found malicious Excel 4.0 Macro
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: URLDownloadToFileA
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Content X E14 - "" jR V \ A B C D E F G H I J K L M N O P Q R S T 1 ' Cjdigicert' 3
Found Excel 4.0 Macro with suspicious formulas
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: CALL
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: CALL
Found abnormal large hidden Excel 4.0 Macro sheet
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: Sheet size: 503434
Found obfuscated Excel 4.0 Macro
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: High usage of CHAR() function: 147
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00979C60 3_2_00979C60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00973A30 3_2_00973A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0098DA70 3_2_0098DA70
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00979A60 3_2_00979A60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00985BF0 3_2_00985BF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3F8FD 3_2_00A3F8FD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3D806 3_2_00A3D806
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3D2C4 3_2_00A3D2C4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3BB6E 3_2_00A3BB6E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3DD48 3_2_00A3DD48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_00099C60 4_2_00099C60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_00093A30 4_2_00093A30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_00099A60 4_2_00099A60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_000ADA70 4_2_000ADA70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_000A5BF0 4_2_000A5BF0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\formnet.dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll 0BF22B8F9AAEF21AFE71FCBBEA62325E7582DAD410B0A537F38A9EB8E6855890
Source: suicy.dll.4.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: rundll32.exe, 00000002.00000002.2155279240.0000000001B40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2154626174.0000000001F30000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.expl.evad.winXLS@7/12@4/4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_000A9C90 AdjustTokenPrivileges, 4_2_000A9C90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_009869A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 3_2_009869A0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\D0EE0000 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{6564EBFF-51EC-A92E-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{451CDBFF-61EC-8956-3E66-73D0C2BEFC46}
Source: C:\Windows\SysWOW64\msiexec.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\{F5F5D963-6370-39BF-3E66-73D0C2BEFC46}
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD2B9.tmp Jump to behavior
Source: SecuriteInfo.com.Heur.30497.xls OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
Source: unknown Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: c:\PlanetAllow\OpenRoll\cellNumeral\money.pdb source: msiexec.exe, 00000004.00000003.2159256851.00000000022C0000.00000004.00000001.sdmp, scfrd[1].dll.0.dr
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: OLE summary lastprinted = 2021-01-26 16:17:13
Source: SecuriteInfo.com.Heur.30497.xls Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0097D830 LoadLibraryA,GetProcAddress, 3_2_0097D830
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0099E9FA push esi; retf 3_2_0099EABE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0099D1F2 push dword ptr [ecx]; iretd 3_2_0099D1F9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_009982EB push eax; ret 3_2_0099834A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00999A5D push ebp; iretd 3_2_00999AEF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0099EA51 push esi; retf 3_2_0099EABE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A393ED push ecx; ret 3_2_00A39400
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0099B56F push esp; ret 3_2_0099B581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0099B700 push ss; ret 3_2_0099B735
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A52B73 push esi; ret 3_2_00A52B75

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe File created: C:\Users\user\AppData\Roaming\Ida\suicy.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\ProgramData\formnet.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_009869A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 3_2_009869A0
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\ProgramData\formnet.dll Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Ida\suicy.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\msiexec.exe TID: 2796 Thread sleep time: -240000s >= -30000s Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00A3A0CC
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_009869A0 CreateToolhelp32Snapshot,GetCurrentProcessId,Thread32First,GetLastError,Thread32Next, 3_2_009869A0
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0097D830 LoadLibraryA,GetProcAddress, 3_2_0097D830
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00982EF0 mov eax, dword ptr fs:[00000030h] 3_2_00982EF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A50D28 mov eax, dword ptr fs:[00000030h] 3_2_00A50D28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A50865 push dword ptr fs:[00000030h] 3_2_00A50865
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A50C5E mov eax, dword ptr fs:[00000030h] 3_2_00A50C5E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4_2_000A2EF0 mov eax, dword ptr fs:[00000030h] 4_2_000A2EF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3A0CC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00A3A0CC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3ABA4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00A3ABA4

HIPS / PFW / Operating System Protection Evasion:

barindex
Contains functionality to inject code into remote processes
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_0097AE40 CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,SetThreadContext,VirtualProtectEx,ResumeThread,ExitProcess, 3_2_0097AE40
Yara detected hidden Macro 4.0 in Excel
Source: Yara match File source: SecuriteInfo.com.Heur.30497.xls, type: SAMPLE
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe Jump to behavior
Source: msiexec.exe, 00000004.00000002.2355445451.0000000000AD0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: msiexec.exe, 00000004.00000002.2355445451.0000000000AD0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000004.00000002.2355445451.0000000000AD0000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A3968A cpuid 3_2_00A3968A
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 3_2_00A3F6BB
Queries the product ID of Windows
Source: C:\Windows\SysWOW64\msiexec.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00A395A6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 3_2_00A395A6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_00971A00 CreateDialogParamW,GetVersion, 3_2_00971A00
Source: C:\Windows\SysWOW64\msiexec.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 344767 Sample: SecuriteInfo.com.Heur.30497.14031 Startdate: 27/01/2021 Architecture: WINDOWS Score: 100 36 Found malicious Excel 4.0 Macro 2->36 38 Document exploit detected (drops PE files) 2->38 40 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->40 42 7 other signatures 2->42 8 EXCEL.EXE 89 42 2->8         started        process3 dnsIp4 34 rnollg.com 172.67.150.228, 443, 49165 CLOUDFLARENETUS United States 8->34 24 C:\Users\user\AppData\Local\...\scfrd[1].dll, PE32 8->24 dropped 26 C:\ProgramData\formnet.dll, PE32 8->26 dropped 44 Document exploit detected (creates forbidden files) 8->44 46 Document exploit detected (process start blacklist hit) 8->46 48 Document exploit detected (UrlDownloadToFile) 8->48 13 rundll32.exe 8->13         started        file5 signatures6 process7 process8 15 rundll32.exe 13->15         started        signatures9 50 Contains functionality to inject code into remote processes 15->50 18 msiexec.exe 2 33 15->18         started        process10 dnsIp11 28 govemedico.tk 172.67.158.184, 443, 49168 CLOUDFLARENETUS United States 18->28 30 homesoapmolds.com 172.67.198.109, 443, 49167 CLOUDFLARENETUS United States 18->30 32 gadgetswolf.com 172.67.200.147, 443, 49166 CLOUDFLARENETUS United States 18->32 22 C:\Users\user\AppData\Roaming\Ida\suicy.dll, PE32 18->22 dropped file12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.158.184
 unknown United States
13335 CLOUDFLARENETUS false
172.67.150.228
 unknown United States
13335 CLOUDFLARENETUS false
172.67.200.147
 unknown United States
13335 CLOUDFLARENETUS false
172.67.198.109
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
homesoapmolds.com 172.67.198.109 true
rnollg.com 172.67.150.228 true
gadgetswolf.com 172.67.200.147 true
govemedico.tk 172.67.158.184 true