Analysis Report document-47-2637.xls

ID:	432941
Product:	CloudBasic
Start time:	00:05:31
Start date:	11.06.2021
Sample:	document-47-2637.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	92dcc47a1a044fc3a2328ec6eef3918b
SHA1:	6f9266a6c0b702cbaa0a3583df5c8cd1357eae35
SHA256:	ac4b99079b1ceb11db593097e421de9d9092765feedc23a3ab8ef912b292c988
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6529B5B3-6D5E-4521-86C2-74637D63C046	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	EFDCCF0E3988CC8522DA896FF634963A	C14FFFC27E2118EE983A089C4288A894336C558B	A773943B455B0B061DB5E88D3E99F7C2982931ADF334514C4CD564403A3A40B1
C:\Users\user\AppData\Local\Temp\D8810000	data	8ADAF6B90235725A61872A8DB4229AB4	0D3F245BA39D7F1909A6BECEA21D444DDCC2992C	EF4D3E61002EE375D7DA35AC750AE8473E476DEE0CBBDD779208FA3A1079D8F4
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 16:19:49 2019, mtime=Fri Jun 11 06:06:25 2021, atime=Fri Jun 11 06:06:25 2021, length=8192, window=hide	C17835DE1533EE31CF716FFCD2BEAC22	2F8F01FF8FF43311472B475398FC9E1DFED3EC53	9CD9102A634AD9C62E44C783A47E437E2D8C19AC07DE5F2A173D320D6643BC84
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\document-47-2637.xls.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:43 2020, mtime=Fri Jun 11 06:06:26 2021, atime=Fri Jun 11 06:06:26 2021, length=92672, window=hide	55EB1B86A51BA808580E7D8F6B69C6F8	8060B4A00590F6720A2E3DBCF32DB7CC1E6D4572	3771E847369345DE9B338EAEB13AD78BBDAE9734AD28A411086E72AA174FF41B
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	76DDF8AD6F08D42714419B5F042F0B0D	FBDDF758BD78A5D4F9DD2FA75CF7C243AF7B903C	BCF2EA38D3219270EE2D8295AE7059C1AEB42B3486DB50686CA6E83F6D8DF13E
C:\Users\user\Desktop\56620000	Applesoft BASIC program data, first line number 16	A128138DAF2B0EF988191575CC89C60E	94919944D17E1A500D6B4D7958DEC55F8C295053	9257667CD47E559630286BFE64552BDE4A44AF3CB45392F501394832893F5B9F
C:\Users\user\Desktop\99810000	Applesoft BASIC program data, first line number 16	85DA544B4D80414FFA7A91346A2DD333	7AFEF0F5DBF3476F1FA06ED5490125D87D8F3FB2	A083B8DADA5B4AA41D290E7796E6F3AE2AE77340AC9295D74182041B5A9F92B6
C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	PE32 executable (GUI) Intel 80386, for MS Windows	CE639EB63B7C1C1EC94651B65CCEC383	B92544ED405C33F2DB64A0BCA41646CB712E246B	2D2EAD13B2796AD58D070DC1FD36961866F25E1E436661C760A879EAC35982F9

AV Detection:

Multi AV Scanner detection for submitted file

Source: document-47-2637.xls	Virustotal: Detection: 26%			Perma Link
Source: document-47-2637.xls	Metadefender: Detection: 22%			Perma Link
Source: document-47-2637.xls	ReversingLabs: Detection: 15%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 198.244.146.96:443 -> 192.168.2.3:49716 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: extexport.pdbGCTL source: nnAzot.exe, 00000004.00000002.224789217.0000000000C01000.00000020.00020000.sdmp, nnAzot.exe.2.dr
Source:	Binary string: extexport.pdb source: nnAzot.exe, nnAzot.exe.2.dr

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 1MB later: 79MB

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: webhub365.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.3:49716 -> 198.244.146.96:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.3:49716 -> 198.244.146.96:443

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: webhub365.com

URLs found in memory or binary data

Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.office.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://augloop.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cdn.entity.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cortana.ai
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://cr.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://directory.services.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://graph.windows.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://login.windows.local
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://management.azure.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://management.azure.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://tasks.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 6529B5B3-6D5E-4521-86C2-74637D63C046.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 198.244.146.96:443 -> 192.168.2.3:49716 version: TLS 1.2

E-Banking Fraud:

Checks if browser processes are running

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: GetModuleFileNameW,PathFindFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, IEXPLORE.EXE		4_2_00C06422
Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: GetModuleFileNameW,PathFindFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedge.exe		4_2_00C06422
Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: GetModuleFileNameW,PathFindFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgecp.exe		4_2_00C06422
Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: GetModuleFileNameW,PathFindFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgesh.exe		4_2_00C06422

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing" and then click "Enable Content". 23 24 25 26 27 28 29 30 31 32 33 34 35
Source: Screenshot number: 4	Screenshot OCR: Enable Content". 23 24 25 26 27 28 29 30 31 32 33 34 35 36 ^ V S " a Offic Sheet1

Found Excel 4.0 Macro with suspicious formulas

Source: document-47-2637.xls

Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Source: document-47-2637.xls

Initial sample: Sheet size: 14533

Detected potential crypto function

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C06EB1

4_2_00C06EB1

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe 2D2EAD13B2796AD58D070DC1FD36961866F25E1E436661C760A879EAC35982F9

Classification label

Source: classification engine

Classification label: mal84.bank.expl.evad.winXLS@6/8@1/1

Creates files inside the user directory

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_01

Creates temporary files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{86E1C1D0-EB0C-43A4-B7BA-E0F0BAC366D9} - OProcSessId.dat

Jump to behavior

Document contains an OLE Workbook stream indicating a Microsoft Excel file

Source: document-47-2637.xls

OLE indicator, Workbook stream: true

Reads ini files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: document-47-2637.xls	Virustotal: Detection: 26%
Source: document-47-2637.xls	Metadefender: Detection: 22%
Source: document-47-2637.xls	ReversingLabs: Detection: 15%

Spawns processes

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c copy '%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe' C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe 'C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe' C:\aZ8ThU0Y\ERdZMUem GdPT AuMr7
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c copy '%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe' C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe 'C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe' C:\aZ8ThU0Y\ERdZMUem GdPT AuMr7			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: extexport.pdbGCTL source: nnAzot.exe, 00000004.00000002.224789217.0000000000C01000.00000020.00020000.sdmp, nnAzot.exe.2.dr
Source:	Binary string: extexport.pdb source: nnAzot.exe, nnAzot.exe.2.dr

Document has a 'vbamacros' value indicative of goodware

Source: document-47-2637.xls

Initial sample: OLE indicators vbamacros = False

Document has an 'encrypted' value indicative of goodware

Source: document-47-2637.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation:

Binary contains a suspicious time stamp

Source: nnAzot.exe.2.dr

Static PE information: 0xA55DB0F5 [Fri Nov 30 21:19:49 2057 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C09865 push ecx; ret

4_2_00C09878

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C03367 LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,

4_2_00C03367

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Document contains OLE streams with high entropy indicating encrypted embedded content

Source: document-47-2637.xls

Stream path 'Workbook' entropy: 7.97723236264 (max. 8.0)

Malware Analysis System Evasion:

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: GetModuleFileNameW,PathFindFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,

4_2_00C06422

Found large amount of non-executed APIs

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

API coverage: 6.9 %

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C06EB1 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

4_2_00C06EB1

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C07684 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

4_2_00C07684

Contains functionality to register its own exception handler

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: 4_2_00C09380 SetUnhandledExceptionFilter,		4_2_00C09380
Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe	Code function: 4_2_00C096D1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_00C096D1

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C09583 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_00C09583

Contains functionality to query windows version

Source: C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

Code function: 4_2_00C08F20 GetVersionExA,

4_2_00C08F20