Analysis Report banUwVSwBY

Overview

General Information

Sample Name:	banUwVSwBY (renamed file extension from none to xlsx)
Analysis ID:	431768
MD5:	da5fb469bc9385f16af43843673cadc8
SHA1:	414c25009dd7fad02b87f534779f6863a937aa93
SHA256:	612d8808903469c5840e8697710abe11a2c7e75ccad1e61de969732c42271249
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Obfuscated Macro In XLSM

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Excel documents contains an embedded macro which executes code when the document is opened

IP address seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 190.14.37.134:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 190.14.37.134:80

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 51.89.115.124 51.89.115.124

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /44356.3971392361.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.134Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44356.3971392361.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.115.124Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.196.25
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.115.124
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.134

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FC5BF66.tif

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /44356.3971392361.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.134Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44356.3971392361.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.89.115.124Connection: Keep-Alive

Source: regsvr32.exe, 00000003.00000002.2206688614.0000000001D90000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2207736998.0000000001D50000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.2208486859.0000000001CC0000.00000002.00000001.sdmp

String found in binary or memory: http://servername/isapibackend.dll

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above 19 Once you have enabled editing, please click En
Source: Screenshot number: 4	Screenshot OCR: Enable Content button from the yellow bar above 20 21 22 23 24 25 26 27 28 29 30 31 32
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable Content button from the yellow bar above

Excel documents contains an embedded macro which executes code when the document is opened

Source: workbook.xml

Binary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x15 xr xr6 xr10 xr2" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xmlns:xr10="http://schemas.microsoft.com/office/spreadsheetml/2016/revision10" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2"><fileVersion appName="xl" lastEdited="7" lowestEdited="6" rupBuild="22730"/><workbookPr/><mc:AlternateContent xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"><mc:Choice Requires="x15"><x15ac:absPath url="C:\Users\Admin\Desktop\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{34C063CF-955E-4ACE-9D4C-9A051EAF3AFA}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="29040" windowHeight="15990" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="2" r:id="rId1"/><sheet name="nowik" sheetId="13" state="hidden" r:id="rId2"/><sheet name="1rtgvrt" sheetId="3" state="hidden" r:id="rId3"/><sheet name="2dfgv" sheetId="4" state="hidden" r:id="rId4"/><sheet name="3fescvaer" sheetId="5" state="hidden" r:id="rId5"/><sheet name="4scdac" sheetId="6" state="hidden" r:id="rId6"/><sheet name="5fetaert" sheetId="7" state="hidden" r:id="rId7"/><sheet name="6vrtgarga" sheetId="8" state="hidden" r:id="rId8"/><sheet name="7rvgasdg" sheetId="9" state="hidden" r:id="rId9"/><sheet name="8aevgadrg" sheetId="10" state="hidden" r:id="rId10"/><sheet name="9rrvrv" sheetId="11" state="hidden" r:id="rId11"/><sheet name="10vghsdrb" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">'10vghsdrb'!$A$2</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{140A7094-0E35-4892-8432-C4D2E57EDEB5}" xmlns:x15="http://schemas.microsoft.com/office/spreadsheetml/2010/11/main"><x15:workbookPr chartTrackingRefBase="1"/></ext><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>

Source: classification engine

Classification label: mal68.expl.evad.winXLSX@7/8@0/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$banUwVSwBY.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRF44D.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg1	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -s ..\Post.storg2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: banUwVSwBY.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: banUwVSwBY.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: banUwVSwBY.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: banUwVSwBY.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: banUwVSwBY.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Data Obfuscation:

Yara detected Obfuscated Macro In XLSM

Source: Yara match

File source: intlsheet4.xml, type: SAMPLE

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
190.14.37.134	unknown	Panama	52469	OffshoreRacksSAPA	false
51.89.115.124	unknown	France	16276	OVHFR	false
37.1.196.25	unknown	Ukraine	28753	LEASEWEB-DE-FRA-10DE	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://51.89.115.124/44356.3971392361.dat	false	Avira URL Cloud: safe	unknown
http://190.14.37.134/44356.3971392361.dat	false	Avira URL Cloud: safe	unknown

ID:	431768
Product:	CloudBasic
Start time:	09:30:51
Start date:	09.06.2021
Sample:	banUwVSwBY
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	da5fb469bc9385f16af43843673cadc8
SHA1:	414c25009dd7fad02b87f534779f6863a937aa93
SHA256:	612d8808903469c5840e8697710abe11a2c7e75ccad1e61de969732c42271249
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FC5BF66.tif	TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600	BB737290D394078D8A16D5509C5BC970	C8A63B0AB1EB7745A0027E0A17A6CB4C6F79487E	E11121ECA3FAD55F66EA240EADD4F5B4C978828C94C34736F7673540529B17A5
C:\Users\user\AppData\Local\Temp\060F0000	data	7BA4B91B8DE777EBD4732DD6532D07AA	A6C45F27BA322D4A1C527573937A102686DE7F72	8F0BA1944993205B1285183670B3C0CC60C58A6334314A5DBF8D95A657792447
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jun 9 15:31:52 2021, atime=Wed Jun 9 15:31:52 2021, length=8192, window=hide	DC4B2EA43C8A1B8FCCB693FFF4EC7510	D2D0868322033CE6050D25C557CA675BEF8E2158	9D0AE1E5C75C2605B5ED927EE152290B375E2C7F89F387D09640D61A26AEE5E2
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\banUwVSwBY.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jun 9 15:31:30 2021, mtime=Wed Jun 9 15:31:52 2021, atime=Wed Jun 9 15:31:52 2021, length=338387, window=hide	DCC45B20DFAD34FDD5C231A3678E383E	11CB9B75BB747AC5ECB0E52D67EA215E20F341E3	5CBFCF868BFAE09308FA59BD913ACDD63EB78D26CDF03513901A3C56BA37F638
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	1A68CAC18E09A64F9C562750C73E1945	D0135E42FD06C773B58C580966C764EEFF9926D1	202B7BFACE52B0948B2D7727B2475BF4E8AE9284772855A49838214CD697A555
C:\Users\user\Desktop\D60F0000	data	9590ABBCDB9FA3F3853839CDF04B327E	667E70BED62ED48AE34F40A27DECC0C72B629864	A2B393CBECBC9B16B94CD865027827DAF9432BDC6016256D5AEEF889A3EB3C51
C:\Users\user\Desktop\~$banUwVSwBY.xls	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
C:\Users\user\Desktop\~$banUwVSwBY.xlsx	data	96114D75E30EBD26B572C1FC83D1D02E	A44EEBDA5EB09862AC46346227F06F8CFAF19407	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523

Analysis Report banUwVSwBY

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs