Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2376
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	08:21:37
Date:	08/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13fc90000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\cmd.exe

'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Details

Is windows:	true
Is dropped:	false
PID:	1692
Target ID:	2
Parent PID:	2376
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Size:	345088
MD5:	5746BD7E255DD6A8AFA06F7C42C1BA41
Time:	08:21:38
Date:	08/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x4ac30000
Modulesize:	364544
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\schtasks.exe

schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Details

Is windows:	true
Is dropped:	false
PID:	2500
Target ID:	4
Parent PID:	1692
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\System32\schtasks.exe
Commandline:	schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Size:	285696
MD5:	97E0EC3D6D99E8CC2B17EF2D3760E8FC
Time:	08:21:39
Date:	08/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xff330000
Modulesize:	294912
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival,	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Spawns processes	System Summary,	Process Injection

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2412
Target ID:	0
Parent PID:	792
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Size:	27110184
MD5:	5D6638F2C8F8571C593999C58866007E
Time:	08:17:39
Date:	08/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x970000
Modulesize:	27131904
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Spawns processes	System Summary,	Process Injection

C:\Windows\SysWOW64\cmd.exe

'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Details

Is windows:	true
Is dropped:	false
PID:	1304
Target ID:	1
Parent PID:	2412
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	'C:\Windows\System32\cmd.exe' /c schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	08:17:42
Date:	08/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xbd0000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Spawns processes	System Summary,	Process Injection

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Details

Is windows:	true
Is dropped:	false
PID:	4608
Target ID:	3
Parent PID:	1304
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\schtasks.exe
Commandline:	schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Size:	185856
MD5:	15FF7D8324231381BAD48A052F85DF04
Time:	08:17:43
Date:	08/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xad0000
Modulesize:	204800
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival,	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1380
Target ID:	2
Parent PID:	1304
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	08:17:42
Date:	08/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6b2800000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

URLs

Name

Malicious

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://wus2-000.contentsync.

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

https://powerlift.acompli.net

unknown

https://rpsticket.partnerservices.getmicrosoftkey.com

unknown

https://lookup.onenote.com/lookup/geolocation/v1

unknown

https://cortana.ai

unknown

https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech

unknown

https://cloudfiles.onenote.com/upload.aspx

unknown

https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile

unknown

https://entitlement.diagnosticssdf.office.com

unknown

https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy

unknown

https://api.aadrm.com/

unknown

https://ofcrecsvcapi-int.azurewebsites.net/

unknown

https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies

unknown

https://api.microsoftstream.com/api/

unknown

https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive

unknown

https://cr.office.com

unknown

https://portal.office.com/account/?ref=ClientMeControl

unknown

https://ecs.office.com/config/v2/Office

unknown

https://graph.ppe.windows.net

unknown

https://res.getmicrosoftkey.com/api/redemptionevents

unknown

https://powerlift-frontdesk.acompli.net

unknown

https://tasks.office.com

unknown

https://officeci.azurewebsites.net/api/

unknown

https://sr.outlook.office.net/ws/speech/recognize/assistant/work

unknown

https://store.office.cn/addinstemplate

unknown

https://wus2-000.pagecontentsync.

unknown

https://outlook.office.com/autosuggest/api/v1/init?cvid=

unknown

https://globaldisco.crm.dynamics.com

unknown

https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech

unknown

https://store.officeppe.com/addinstemplate

unknown

https://dev0-api.acompli.net/autodetect

unknown

https://www.odwebp.svc.ms

unknown

https://api.powerbi.com/v1.0/myorg/groups

unknown

https://web.microsoftstream.com/video/

unknown

https://graph.windows.net

unknown

https://dataservice.o365filtering.com/

unknown

https://officesetup.getmicrosoftkey.com

unknown

https://analysis.windows.net/powerbi/api

unknown

https://prod-global-autodetect.acompli.net/autodetect

unknown

https://outlook.office365.com/autodiscover/autodiscover.json

unknown

https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios

unknown

https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech

unknown

https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json

unknown

https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false

unknown

https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/

unknown

http://weather.service.msn.com/data.aspx

unknown

https://apis.live.net/v5.0/

unknown

https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks

unknown

https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios

unknown

https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml

unknown

https://management.azure.com

unknown

https://incidents.diagnostics.office.com

unknown

https://clients.config.office.net/user/v1.0/ios

unknown

https://insertmedia.bing.office.net/odc/insertmedia

unknown

https://o365auditrealtimeingestion.manage.office.com

unknown

https://outlook.office365.com/api/v1.0/me/Activities

unknown

https://api.office.net

unknown

https://incidents.diagnosticssdf.office.com

unknown

https://asgsmsproxyapi.azurewebsites.net/

unknown

https://clients.config.office.net/user/v1.0/android/policies

unknown

https://entitlement.diagnostics.office.com

unknown

https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json

unknown

https://outlook.office.com/

unknown

https://storage.live.com/clientlogs/uploadlocation

unknown

https://templatelogging.office.com/client/log

unknown

https://outlook.office365.com/

unknown

https://webshell.suite.office.com

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive

unknown

https://management.azure.com/

unknown

https://ncus-000.contentsync.

unknown

https://login.windows.net/common/oauth2/authorize

unknown

https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile

unknown

https://graph.windows.net/

unknown

https://api.powerbi.com/beta/myorg/imports

unknown

https://devnull.onenote.com

unknown

https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json

unknown

https://messaging.office.com/

unknown

https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile

unknown

https://augloop.office.com/v2

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing

unknown

https://skyapi.live.net/Activity/

unknown

https://clients.config.office.net/user/v1.0/mac

unknown

https://dataservice.o365filtering.com

unknown

https://api.cortana.ai

unknown

https://onedrive.live.com

unknown

https://ovisualuiapp.azurewebsites.net/pbiagave/

unknown

https://visio.uservoice.com/forums/368202-visio-on-devices

unknown

https://directory.services.

unknown

https://login.windows-ppe.net/common/oauth2/authorize

unknown

https://staging.cortana.ai

unknown

There are 90 hidden URLs, click here to show them.

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

s 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ECF60

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

windir

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

o/1

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

p/1

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Properties

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Url

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastClean

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

DisableWinHttpCertAuth

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

DisableIsOwnerRegex

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

DisableSessionAwareHttpClose

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

DisableADALForExtendedApps

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

DisableADALSetSilentAuth

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

msoridDisableGuestCredProvider

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

msoridDisableOstringReplace

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

VBAFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

MSForms

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

MSComctlLib

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ReviewToken

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

199FA

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

en-US

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

en-US

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

EXCELFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

RoamingConfigurableSettings

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

RoamingLastSyncTime

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

RoamingLastWriteTime

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

CacheReady

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastRequest

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

CacheReady

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastUpdate

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

NextUpdate

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

ProductFiles

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

(*3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ED0E6

There are 73 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

3B4000

heap private

page read and write

C0E000

unkown

page read and write

620000

unkown

page readonly

3F7000

heap default

page read and write

42D000

heap default

page read and write

A0F000

unkown

page read and write

3F0000

heap default

page read and write

24D000

unkown

page read and write

438000

heap default

page read and write

3B0000

heap private

page read and write

106000

unkown

page read and write

35E000

unkown

page read and write

D0000

unkown

page read and write

60000

unkown

page readonly

436000

heap default

page read and write

AAE000

unkown

page read and write

There are 6 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Registry

Memdumps