Analysis Report Documents (252).xlsm

Overview

General Information

Sample Name: Documents (252).xlsm
Analysis ID: 382991
MD5: 966c13f10fa0b3bfe75da87bca817396
SHA1: 1769db2ec1d019b526e63637a413ceab10d00ff3
SHA256: 963963dd218deb7e041b5a2ccf85a48c12d62bd2bdc248d6636b332f234cba14
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Wmic Launch regsvr32
Contains functionality to create processes via WMI
Creates processes via WMI
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Office document connecting to suspicious TLD
Outdated Microsoft Office dropper detected
Performs DNS queries to domains with low reputation
Potential document exploit detected (performs DNS queries with low reputation score)
Excel documents contains an embedded macro which executes code when the document is opened
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\wbem\WMIC.exe
Potential document exploit detected (performs DNS queries with low reputation score)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE DNS query: name: xherzog24pv.xyz
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: xherzog24pv.xyz

Networking:

barindex
Office document connecting to suspicious TLD
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE DNS traffic detected: xherzog24pv.xyz
Outdated Microsoft Office dropper detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE DNS query: xherzog24pv.xyz is down
Performs DNS queries to domains with low reputation
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE DNS query: xherzog24pv.xyz
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: xherzog24pv.xyz replaycode: Name error (3)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F763B4BE.png Jump to behavior
Source: unknown DNS traffic detected: queries for: xherzog24pv.xyz
Source: WMIC.exe, 00000003.00000002.2083197234.0000000001BD0000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2083045967.0000000001CC0000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing" 11 from the yellow bar above 12 13 @ Once You have Enable Editing, please click "
Source: Screenshot number: 4 Screenshot OCR: Enable Content" 14 from the yellow bar above 15 16 17 18 WHY I CANNOT OPEN THIS DOCUMENT? 19
Source: Screenshot number: 8 Screenshot OCR: Enable Editing" 11 from the yellow bar above 12 13 @ Once You have Enable Editing, please click "
Source: Screenshot number: 8 Screenshot OCR: Enable Content X R12 - "- jR V \ A B C D E F G H I J K L M N O P Q R S : 1 2 ' Ga,, THIS DO
Source: Screenshot number: 12 Screenshot OCR: Enable Editing" from the yellow bar above @ Once You have Enable Editing, please click "Enable Con
Source: Screenshot number: 12 Screenshot OCR: Enable Content Al " " Clickfor more details A B C D E F G H I J K L M N O P Q R S 1 2 3 4 5
Source: Screenshot number: 16 Screenshot OCR: enable content only if you trust the contents of the file. Trust Center Settings Learn more about
Source: Screenshot number: 16 Screenshot OCR: Enable Macros Content " You should enable content only if you trust the contents of the file. Tru
Contains functionality to create processes via WMI
Source: WMIC.exe, 00000003.00000002.2083116468.00000000001E0000.00000004.00000020.sdmp Binary or memory string: C:\Users\user\Documents\C:\Windows\System32\Wbem;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\System32\Wbem\wmic.exewmic.exe process call create 'regsvr32 -s C:/Users/Public/dbhfr.xref'C:\Windows\System32\Wbem\wmic.exeWinSta0\Default
Found Excel 4.0 Macro with suspicious formulas
Source: Documents (252).xlsm Initial sample: EXEC
Found abnormal large hidden Excel 4.0 Macro sheet
Source: Documents (252).xlsm Initial sample: Sheet size: 88698
Excel documents contains an embedded macro which executes code when the document is opened
Source: workbook.xml Binary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="7" rupBuild="23127"/><workbookPr defaultThemeVersion="124226"/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="C:\Users\Janadark\3D Objects\corp\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="8_{29DC8E7E-AE72-4A96-8469-EA40E9BC458E}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15840" firstSheet="1" activeTab="1" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="dbapi &quot;=sd" sheetId="4" state="hidden" r:id="rId1"/><sheet name="FrameSecure" sheetId="5" r:id="rId2"/></sheets><definedNames><definedName name="dontdoit" function="1" xlm="1">-676986879</definedName><definedName name="okwell" function="1" xlm="1">124715010</definedName><definedName name="plzno" function="1" xlm="1">-709623808</definedName><definedName name="_xlnm.Auto_Open">'dbapi "=sd'!$AA$6</definedName></definedNames><calcPr calcId="144525"/></workbook>
Source: classification engine Classification label: mal96.troj.expl.evad.winXLSM@4/12@1/1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$Documents (252).xlsm Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBBEE.tmp Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe process call create 'regsvr32 -s C:/Users/Public/dbhfr.xref'
Source: unknown Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s C:/Users/Public/dbhfr.xref
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe process call create 'regsvr32 -s C:/Users/Public/dbhfr.xref' Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Documents (252).xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: Documents (252).xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: Documents (252).xlsm Initial sample: OLE zip file path = xl/media/image3.png
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2796 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 382991 Sample: Documents (252).xlsm Startdate: 07/04/2021 Architecture: WINDOWS Score: 96 22 Sigma detected: Wmic Launch regsvr32 2->22 24 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->24 26 Performs DNS queries to domains with low reputation 2->26 28 7 other signatures 2->28 6 EXCEL.EXE 85 45 2->6         started        11 regsvr32.exe 2->11         started        process3 dnsIp4 18 xherzog24pv.xyz 6->18 20 192.168.2.255 unknown unknown 6->20 16 C:\Users\user\...\~$Documents (252).xlsm, data 6->16 dropped 30 Document exploit detected (UrlDownloadToFile) 6->30 13 WMIC.exe 6->13         started        file5 signatures6 process7 signatures8 32 Creates processes via WMI 13->32
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.255

Contacted Domains

Name IP Active
xherzog24pv.xyz unknown unknown