Analysis Report document-1245492889.xls

Overview

General Information

Sample Name: document-1245492889.xls
Analysis ID: 383157
MD5: e30c71417d7675c13ca725d3bb4172eb
SHA1: 80350061fb497c3fc79ac2cd4f8a315aceae412e
SHA256: 05d2f75e43502476f32925c3f8ca82245c4f5433c4d405779e6fd178cd37ea13
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (drops PE files)
Found malware configuration
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Ursnif
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Found obfuscated Excel 4.0 Macro
Machine Learning detection for dropped file
Office process drops PE file
Yara detected hidden Macro 4.0 in Excel
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains embedded VBA macros
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses code obfuscation techniques (call, push, ret)
Yara detected Xls With Macro 4.0
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 6.2.rundll32.exe.270000.1.raw.unpack Malware Configuration Extractor: Ursnif [[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]
Multi AV Scanner detection for submitted file
Source: document-1245492889.xls Virustotal: Detection: 54% Perma Link
Source: document-1245492889.xls Metadefender: Detection: 32% Perma Link
Source: document-1245492889.xls ReversingLabs: Detection: 18%
Machine Learning detection for dropped file
Source: C:\Users\user\fikftkm.thj2 Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 207.174.213.126:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.62.4:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.185.129.4:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.50.218.68:443 -> 192.168.2.22:49173 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: 0104[1].gif.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: vts.us.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 207.174.213.126:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 207.174.213.126:443

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 207.174.213.126 207.174.213.126
Source: Joe Sandbox View IP Address: 198.50.218.68 198.50.218.68
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ Jump to behavior
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: vts.us.com
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown HTTPS traffic detected: 207.174.213.126:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.62.4:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.185.129.4:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.50.218.68:443 -> 192.168.2.22:49173 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please elk 14 Ru
Source: Screenshot number: 8 Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please ell 14 R
Source: Screenshot number: 12 Screenshot OCR: Enable Editing, please click Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18
Source: Screenshot number: 12 Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
Source: Document image extraction number: 9 Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Conten
Source: Document image extraction number: 9 Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
Source: Screenshot number: 16 Screenshot OCR: Enable Editing 11 1 from the yellow bar above 12 13 ' @ Once You have Enable Editing, please clic
Source: Screenshot number: 16 Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
Source: Screenshot number: 20 Screenshot OCR: Enable Editing 11 1 from the yellow bar above 12 13 ' @ Once You have Enable Editing, please clic
Source: Screenshot number: 20 Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
Found Excel 4.0 Macro with suspicious formulas
Source: document-1245492889.xls Initial sample: CALL
Source: document-1245492889.xls Initial sample: EXEC
Found abnormal large hidden Excel 4.0 Macro sheet
Source: document-1245492889.xls Initial sample: Sheet size: 4081
Source: document-1245492889.xls Initial sample: Sheet size: 12790
Found obfuscated Excel 4.0 Macro
Source: document-1245492889.xls Initial sample: High usage of CHAR() function: 40
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\fikftkm.thj2 Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 6_2_00125F16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00123A14 6_2_00123A14
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00121B1E 6_2_00121B1E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_0012150C 6_2_0012150C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125A25 6_2_00125A25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125378 6_2_00125378
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125262 6_2_00125262
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00122566 6_2_00122566
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00121967 6_2_00121967
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00122A69 6_2_00122A69
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001292B2 6_2_001292B2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001231B3 6_2_001231B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001288BA 6_2_001288BA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00123FAB 6_2_00123FAB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00122FAF 6_2_00122FAF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00121CD0 6_2_00121CD0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001227D4 6_2_001227D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001243D8 6_2_001243D8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_001213C5 6_2_001213C5
Document contains embedded VBA macros
Source: document-1245492889.xls OLE indicator, VBA macros: true
Yara signature match
Source: document-1245492889.xls, type: SAMPLE Matched rule: SUSP_EnableContent_String_Gen date = 2019-02-12, hash1 = 525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de, author = Florian Roth, description = Detects suspicious string that asks to enable active content in Office Doc, reference = Internal Research
Source: document-1245492889.xls, type: SAMPLE Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@13/17@5/5
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\EDCE0000 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRC58F.tmp Jump to behavior
Source: document-1245492889.xls OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServer
Source: document-1245492889.xls Virustotal: Detection: 54%
Source: document-1245492889.xls Metadefender: Detection: 32%
Source: document-1245492889.xls ReversingLabs: Detection: 18%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj1,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj3,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj4,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServer Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj1,DllRegisterServer Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj3,DllRegisterServer Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj4,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\rundll32.exe Automated click: OK
Source: C:\Windows\System32\rundll32.exe Automated click: OK
Source: C:\Windows\System32\rundll32.exe Automated click: OK
Source: C:\Windows\System32\rundll32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx 6_2_00125F7B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_00125F94
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_00125FDD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax 6_2_0012604B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_00126124
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi 6_2_0012614F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx 6_2_0012625E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax 6_2_001262B5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax 6_2_00126343
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax 6_2_0012635D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], ebp 6_2_00126368
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_00126385
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx 6_2_001263B4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_00126483
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_001264F2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax 6_2_001264FE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_0012650A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi 6_2_00126567
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi 6_2_001265A9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], eax 6_2_00126610
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_00126685
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx 6_2_001266C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_001266E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi 6_2_00126781
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx 6_2_001267B6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_0012684C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_00126858
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], edx 6_2_00126926
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax 6_2_00126945
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax 6_2_00126951
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx 6_2_001269D6

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\fikftkm.thj2 Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\fikftkm.thj2 Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\fikftkm.thj2 Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\fikftkm.thj2 Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\rundll32.exe Window / User API: threadDelayed 463 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif Jump to dropped file

Anti Debugging:

barindex
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 6_2_00122A69 xor edi, dword ptr fs:[00000030h] 6_2_00122A69

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected hidden Macro 4.0 in Excel
Source: Yara match File source: document-1245492889.xls, type: SAMPLE
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer Jump to behavior
Yara detected Xls With Macro 4.0
Source: Yara match File source: document-1245492889.xls, type: SAMPLE

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 383157 Sample: document-1245492889.xls Startdate: 07/04/2021 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Document exploit detected (drops PE files) 2->38 40 10 other signatures 2->40 7 EXCEL.EXE 88 51 2->7         started        process3 dnsIp4 28 mundotecnologiasolar.com 162.241.62.4, 443, 49168 UNIFIEDLAYER-AS-1US United States 7->28 30 accesslinksgroup.com 192.185.129.4, 443, 49170 UNIFIEDLAYER-AS-1US United States 7->30 32 3 other IPs or domains 7->32 22 C:\Users\user\fikftkm.thj2, PE32 7->22 dropped 24 C:\Users\user\AppData\Local\...\0104[1].gif, PE32 7->24 dropped 26 C:\Users\user\fikftkm.thj, HTML 7->26 dropped 42 Document exploit detected (UrlDownloadToFile) 7->42 12 rundll32.exe 7->12         started        14 rundll32.exe 7->14         started        16 rundll32.exe 7->16         started        18 2 other processes 7->18 file5 signatures6 process7 process8 20 rundll32.exe 12->20         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
207.174.213.126
 vts.us.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
198.50.218.68
 comosairdoburaco.com.br Canada
16276 OVHFR false
162.241.62.4
 mundotecnologiasolar.com United States
46606 UNIFIEDLAYER-AS-1US false
5.100.155.169
 ponchokhana.com United Kingdom
394695 PUBLIC-DOMAIN-REGISTRYUS false
192.185.129.4
 accesslinksgroup.com United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
mundotecnologiasolar.com 162.241.62.4 true
accesslinksgroup.com 192.185.129.4 true
ponchokhana.com 5.100.155.169 true
vts.us.com 207.174.213.126 true
comosairdoburaco.com.br 198.50.218.68 true