Analysis Report 9177284661-04302021.xlsm

ID:	403443
Product:	CloudBasic
Start time:	06:01:34
Start date:	04.05.2021
Sample:	9177284661-04302021.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a8b4e37766d35b543884d8882147eaa2
SHA1:	4356c14118ea9098dabb6d9af620003b7929058a
SHA256:	533c8713c4e10c223a9f8139f9d408ca326aee14a1d88382c91f2ff18cf0f93c
Filetype:	Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	7943F9F555A0A5B35484924AB84AE27D	CBD7599EF713FFE16C6FA5BB1E14736E677269CA	50F4E95050F712083129FCCF8E09E7F0B673D6AA09B6B26BF8813125D8D6F280
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\195EC58F.jpg	[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3	4A425E6A5A885C0D0E2589506FD2244B	E23482422480A4720E22F311B42BD65E2F3556F8	76E685FC2035D8CF19945C6686D82054B64D0A9612853D8F428C4B4FE351C160
C:\Users\user\AppData\Local\Temp\EE720000	data	7446C62B26F3B52F6D9A984F6771968A	97910D27E2CEADD2A2F09849062422D46BAAAF59	E0DD16FE1A4B568218CDF8A3C71A3C8F245438C10D4EF67B271A81E77ABEDBE9
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\9177284661-04302021.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:27:01 2020, mtime=Tue May 4 12:02:35 2021, atime=Tue May 4 12:02:35 2021, length=117952, window=hide	74FA1AA7539C02D950B137C7AFE2009D	A3B3FA965CFDD06B6D73D738EAD4DBA41302C1B9	76B0DE305D3C914A064AFFB3FF85CB9C30646BAB8A5E673B441CB7295103BC4D
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 18:52:18 2019, mtime=Tue May 4 12:02:35 2021, atime=Tue May 4 12:02:35 2021, length=12288, window=hide	660D3DA6BBCC8E29D7C27D3148A431AA	7020B2870451FD670EB2BA4432DDA87ABC70B040	E8997C8AAA499DCFD8DDD8FB34A576568E698A3535AF2D52442C332FA63929BC
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	871B42915595DE2EBB2F446CD7EAA5AE	A7825CBFA29A607B1EC703FE705D405E0D259A1A	B7F9561E39BC18C1D2843A95701D3E2654EBB52EE5BF5B8A4FFCFE941CC71DC9
C:\Users\user\Desktop\D1820000	data	0A4A383CD1D7C4DA7A74098AFE637C89	C9E1F6F6C33144EC690A465F0BF98F4275B5A608	FC2058C473E2551E8D03AEFA74F9C21914F64700AC377EC00831AEA96351290B
C:\Users\user\Desktop\~$9177284661-04302021.xlsm	data	836727206447D2C6B98C973E058460C9	D83351CF6DE78FEDE0142DE5434F9217C4F285D2	D9BECB14EECC877F0FA39B6B6F856365CADF730B64E7FA2163965D181CC5EB41

AV Detection:

Multi AV Scanner detection for domain / URL

Source: http://45.144.31.232/44313,6048108796.dat

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: 9177284661-04302021.xlsm	Virustotal: Detection: 38%			Perma Link
Source: 9177284661-04302021.xlsm	ReversingLabs: Detection: 31%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 1MB later: 80MB

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.6:49720 -> 185.45.193.80:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.6:49720 -> 185.45.193.80:80

Networking:

Yara detected MalDoc1

Source: Yara match	File source: sheet3.xml, type: SAMPLE
Source: Yara match	File source: sharedStrings.xml, type: SAMPLE

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.45.193.80Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 45.144.31.232Connection: Keep-Alive

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80
Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80
Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80
Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80
Source: unknown	TCP traffic detected without corresponding DNS query: 82.118.21.70
Source: unknown	TCP traffic detected without corresponding DNS query: 82.118.21.70
Source: unknown	TCP traffic detected without corresponding DNS query: 82.118.21.70
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.232
Source: unknown	TCP traffic detected without corresponding DNS query: 185.45.193.80

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.45.193.80Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44313,6048108796.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 45.144.31.232Connection: Keep-Alive

URLs found in memory or binary data

Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.cortana.ai
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.office.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.onedrive.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://augloop.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cdn.entity.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cortana.ai
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cortana.ai/api
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://cr.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://directory.services.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://graph.windows.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://graph.windows.net/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://login.windows.local
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://management.azure.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://management.azure.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://messaging.office.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://officeapps.live.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://onedrive.live.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://outlook.office.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://settings.outlook.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://tasks.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: F19E34F0-F5C8-43C4-A6F2-C9BCDF4F2C40.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Found malicious Excel 4.0 Macro

Source: 9177284661-04302021.xlsm

Initial sample: urlmon

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation

OLE, VBA macro: Module Byutut, Function Auto_Open, API Microsoft Excel:Application.Run(:Range)

Name: Auto_Open

Found Excel 4.0 Macro with suspicious formulas

Source: 9177284661-04302021.xlsm

Initial sample: EXEC

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: 9177284661-04302021.xlsm	OLE, VBA macro line: Public Function Auto_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module Byutut, Function Auto_Open			Name: Auto_Open

Document contains embedded VBA macros

Source: 9177284661-04302021.xlsm

OLE indicator, VBA macros: true

Classification label

Source: classification engine

Classification label: mal80.troj.expl.evad.winXLSM@1/8@0/3

Creates files inside the user directory

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Creates temporary files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{F612D367-30B3-4645-A2BE-D0BDDD421362} - OProcSessId.dat

Jump to behavior

Reads ini files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Sample is known by Antivirus

Source: 9177284661-04302021.xlsm	Virustotal: Detection: 38%
Source: 9177284661-04302021.xlsm	ReversingLabs: Detection: 31%

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: 9177284661-04302021.xlsm	Initial sample: OLE zip file path = xl/media/image1.jpg
Source: 9177284661-04302021.xlsm	Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: 9177284661-04302021.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: 9177284661-04302021.xlsm	Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: 9177284661-04302021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior