Analysis Report IovwfUybUJ.xlsx

ID:	411582
Product:	CloudBasic
Start time:	02:22:58
Start date:	12.05.2021
Sample:	IovwfUybUJ.xlsx
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	bcb5f8c6da6103a5bbd4891095f807af
SHA1:	fccc0e19a042d3da003bc4184b32c784ca5dfd14
SHA256:	9872498872843b5aae813d390df3e46ae02a4cc994ade723e4f5ba2973043fb7
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\32819ACB.png	PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced	A516B6CB784827C6BDE58BC9D341C1BD	9D602E7248E06FF639E6437A0A16EA7A4F9E6C73	EF8F7EDB6BA0B5ACEC64543A0AF1B133539FFD439F8324634C3F970112997074
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\47B18D72.png	PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced	D8574C9CC4123EF67C8B600850BE52EE	5547AC473B3523BA2410E04B75E37B1944EE0CCC	ADD8156BAA01E6A9DE10132E57A2E4659B1A8027A8850B8937E57D56A4FC204B
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4B18A11.png	PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced	3D0E5573022CD8A7F78291FC7959C19F	92A55931306950014C83BFB50997B5F1BAD489F1	727E6480CC68136081EAF26F3CAD5C1970191F092BF44C524330365185A6E74C
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5214BE50.png	PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced	02DB1068B56D3FD907241C2F3240F849	58EC338C879DDBDF02265CBEFA9A2FB08C569D20	D58FF94F5BB5D49236C138DC109CE83E82879D0D44BE387B0EA3773D908DD25F
C:\Users\user\AppData\Local\Temp\2FDE0000	data	D742F24BB867B2F33782A977D82523FE	96462A057F390033856182E9EE600D58266BD270	3D32037F66CB3C88ABC251EB39612AA30A5AE7743C3C560EBFD7B03AA4117724
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 08:23:42 2021, atime=Wed May 12 08:23:42 2021, length=8192, window=hide	CF9C7B389DC070C9FDD1BFAEF95CB8D8	27BEB192A5F9A87A6C73DC89148A5114D1B152CD	510CE14870D11BCBC9F98A64BF281F149C4B944877B38F28B142CEAC462C5A4C
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\IovwfUybUJ.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:18 2020, mtime=Wed May 12 08:23:42 2021, atime=Wed May 12 08:23:42 2021, length=82897, window=hide	D6B23A17B47E07D3F9ECB5189F9D2D52	B02CB3E10FCCFFD0E54ACF3090A40B7ECDEB0E1F	A194726FA7E6FF4655F7328639903254B591A06E88CCA66E5A84736BBFB0D7D7
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	EC8BFA504F021734837C28B3B42BC4CE	43DAEB03D0DDF96039E252698C7FCBEBA45169E4	446520601B8F5F2509DB01D6FEC178A23E9CDB1AA9B5F33D3D9CC73F19C41245
C:\Users\user\Desktop\FFDE0000	data	7898148263817928F2B05480C1794ABD	664A3D1F6E4D35F3A4166C4E54C42B9AC4EC250E	332495AE67C3B5E37A9BBF329950970BE34483FA70CF4D2BE62E122DBDD3C067
C:\Users\user\Desktop\~$IovwfUybUJ.xls	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
C:\Users\user\Desktop\~$IovwfUybUJ.xlsx	data	96114D75E30EBD26B572C1FC83D1D02E	A44EEBDA5EB09862AC46346227F06F8CFAF19407	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523

AV Detection:

Multi AV Scanner detection for domain / URL

Source: qvqy23thdsed03xjeqtf.xyz

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for submitted file

Source: IovwfUybUJ.xlsx	Virustotal: Detection: 40%			Perma Link
Source: IovwfUybUJ.xlsx	ReversingLabs: Detection: 25%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Potential document exploit detected (performs DNS queries with low reputation score)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DNS query: name: qvqy23thdsed03xjeqtf.xyz

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: qvqy23thdsed03xjeqtf.xyz

Networking:

Office document connecting to suspicious TLD

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DNS traffic detected: qvqy23thdsed03xjeqtf.xyz

Outdated Microsoft Office dropper detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DNS query: qvqy23thdsed03xjeqtf.xyz is down

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DNS query: qvqy23thdsed03xjeqtf.xyz

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: qvqy23thdsed03xjeqtf.xyz replaycode: Name error (3)

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\47B18D72.png

Jump to behavior

Found strings which match to known social media urls

Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: qvqy23thdsed03xjeqtf.xyz

URLs found in memory or binary data

Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2099200495.0000000001C97000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2099200495.0000000001C97000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000003.00000002.2099200495.0000000001C97000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2099200495.0000000001C97000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2099200495.0000000001C97000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please click Enab
Source: Screenshot number: 4	Screenshot OCR: Enable Content 14 from the yellow bar above 15 16 17 18 WHY I CANNOTOPEN THIS DOCUMENT? 19 2
Source: Document image extraction number: 9	Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Conten
Source: Document image extraction number: 9	Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
Source: Document image extraction number: 15	Screenshot OCR: Enable Editing from the yellow bar above CB Once You have Enable Editing, please click Enable Cont
Source: Document image extraction number: 15	Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? W You are using IDS or And

Found Excel 4.0 Macro with suspicious formulas

Source: IovwfUybUJ.xlsx	Initial sample: CALL
Source: IovwfUybUJ.xlsx	Initial sample: EXEC

Found abnormal large hidden Excel 4.0 Macro sheet

Source: IovwfUybUJ.xlsx	Initial sample: Sheet size: 16417
Source: IovwfUybUJ.xlsx	Initial sample: Sheet size: 5574

Excel documents contains an embedded macro which executes code when the document is opened

Source: workbook.xml

Binary string: " sheetId="1" r:id="rId1"/><sheet name="Doc1" sheetId="2" r:id="rId2"/><sheet name="Doc2" sheetId="3" r:id="rId3"/><sheet name="Doc3" sheetId="4" r:id="rId4"/><sheet name="Doc4" sheetId="5" r:id="rId5"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">'Doc3'!$AU$11</definedName></definedNames><calcPr calcId="145621"/></workbook>

Binary contains paths to development resources

Source: rundll32.exe, 00000003.00000002.2099010236.0000000001AB0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@3/11@1/0

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$IovwfUybUJ.xlsx

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD596.tmp

Jump to behavior

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iuhdvcl.ckd,DllRegisterServer

Sample is known by Antivirus

Source: IovwfUybUJ.xlsx	Virustotal: Detection: 40%
Source: IovwfUybUJ.xlsx	ReversingLabs: Detection: 25%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iuhdvcl.ckd,DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\iuhdvcl.ckd,DllRegisterServer			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/media/image3.png
Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/media/image4.png
Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/media/image1.png
Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/media/image2.png
Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: IovwfUybUJ.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior