top title background image
flash

order.652.xls

Status: finished
Submission Time: 2020-07-03 13:36:21 +02:00
Malicious
Exploiter
Evader
Hidden Macro 4.0

Comments

Tags

Details

  • Analysis ID:
    243224
  • API (Web) ID:
    382147
  • Analysis Started:
    2020-07-03 13:36:22 +02:00
  • Analysis Finished:
    2020-07-03 13:50:06 +02:00
  • MD5:
    ca5c54a4a3182190a31e4a15708f9719
  • SHA1:
    5afa2c750b2c796571bb00aea19d3491c2328b78
  • SHA256:
    5df08cb2cb21c1320ae154dedd1331f00c872fbe3aa1cf4b6517666f6f916183
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 88
System: unknown
malicious
Score: 80
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Potential for more IOCs and behavior

IPs

IP Country Detection
45.252.248.11
Viet Nam
47.57.165.162
United States

Domains

Name IP Detection
macx.work
47.57.165.162
celadon-emerald.mockienan.com
45.252.248.11

URLs

Name Detection
http://schema.org/WebPage

Dropped files

Name File Type Hashes Detection
C:\Users\Public\KJu.vbs
ASCII text, with CRLF line terminators
#
C:\Users\Public\BWr.html
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
Click to see the 15 hidden entries
C:\Users\Public\VggKjF.txt
ASCII text, with CRLF line terminators
#
C:\Users\user\Desktop\AA030000
Applesoft BASIC program data, first line number 16
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\DW0XW0ZS.txt
ASCII text
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\CC729SKB.txt
ASCII text
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\84G94MOI.txt
ASCII text
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\order.652.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Jan 28 13:45:46 2020, mtime=Fri Jul 3 10:37:25 2020, atime=Fri Jul 3 10:37:25 2020, length=182784, window=hide
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58367 bytes, 1 file
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Jan 28 13:33:37 2020, mtime=Fri Jul 3 10:37:25 2020, atime=Fri Jul 3 10:37:25 2020, length=12288, window=hide
#
C:\Users\user\AppData\Local\Temp\TarCEF4.tmp
data
#
C:\Users\user\AppData\Local\Temp\CabCEE9.tmp
Microsoft Cabinet archive data, 58367 bytes, 1 file
#
C:\Users\user\AppData\Local\Temp\A9030000
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RKTPOU1B\3JSKZBM3.htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
#