Analysis Report my_attach_82862.xlsb

Overview

General Information

Sample Name: my_attach_82862.xlsb
Analysis ID: 433009
MD5: 1f155a8f8c53066ef9dba8520cbcf346
SHA1: 75dda503a5f1bbb11c8de9236ff237a7989e8e80
SHA256: 29b13fa315a5249d1654221cf944f097ac4b0c42a133d07365cd3cc6afdd1a10
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Multi AV Scanner detection for domain / URL
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected Ursnif
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Found abnormal large hidden Excel 4.0 Macro sheet
Office process drops PE file
Potential thread-based time evasion detected
Sigma detected: Microsoft Office Product Spawning Windows Shell
Writes or reads registry keys via WMI
Writes registry values via WMI
Abnormal high CPU Usage
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the installation date of Windows
Registers a DLL
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Yara detected Xls With Macro 4.0

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://quickbooks.aeymotors.com/soft.dll Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000003.285300360.0000000003010000.00000040.00000001.sdmp Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "oUnY8+/8G/QjijBEa03/PDDCyhbZrtKtx8eYSXLSbmKpR2omzPKPDVDiaj+dBCVC5Sp5s16D5EsjkO+S9MLdqEPK+/EAZI0qxYwv0GmWkXSlJi4jyYyJKc5a5Nek5/cWbmHSXPW+Rq2S8QAD5SioqB8j4ScC8nSuqcxPZwTdEUXuTG36kAdjIfamPdH5DlrmzxdodFTkShIE2IKM5O/dCTIwhTSQIj7YF2w9akzONLDoXT8cJE2CEp0UrlGkTtCcRTWQr67rMF2nSqm+ctweTZRfgBKtrDgiEDrXnhmUscy59twRBz1A7dRDpJryotUEkXjZHrb6gv4q0NjsbeCK4Jw4zYJf7CO+eANF3Bou0fo=", "c2_domain": ["authd.feronok.com", "app.bighomegl.at"], "botnet": "1500", "server": "580", "serpent_key": "jT7xNsiVSW2IugIq", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}
Multi AV Scanner detection for domain / URL
Source: authd.feronok.com Virustotal: Detection: 11% Perma Link
Source: app.bighomegl.at Virustotal: Detection: 6% Perma Link
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 50.87.220.158:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: Binary string: c:\571\bar\Nature\industry\Son.pdb source: regsvr32.exe, soft[1].dll.0.dr

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\soft[1].dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\Public\SettingSyncY.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: soft[1].dll.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe

Networking:

barindex
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SUPERSERVERSDATACENTERRU SUPERSERVERSDATACENTERRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: GET /j0D4WkqJA4qbSI2s/tbqllkJ5QjS02c9/Y4oADFKhbig2E3MZ8L/S5BHZDPll/SOOSmvbSSzszfQOGO_2F/ebssg7ZOH9iTiK1egYa/TYvtl48FqSo7aXNnyk8zDn/0M4_2F1RU9EXO/TpeNu_2B/RPWPT_2BSfoiOaYRvUkNxcz/WR4a1P2fCQ/k1EnQMOdYbM0XsiH2/reukwmEF53hW/xa5HBUgFOAx/sGDiJ22uuBIopz/tZj9wmd1r7z3ANuAYbfIk/bhnJIJVnJvAXbS6_/2Fsif8yHgRIg6fa/a0BPP1Z_2FHpWsn1gk/fe5cFcowW/IKK9U HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /c0Zjvpk_/2BhHkEQKFoUb3aKx_2FuhQ9/zz1UpsMDGJ/MqFrowSgYmc2fzVA2/yf5xhKlVBQKb/rwrgpqZOvNV/mxBLQ1oxc7jv8k/5tQFefyNUnYTHJj33dQKu/YqZyqYfZuaOHFPro/3D3_2B6kK9arKKX/Wf1dZBj8QqS_2BWWVF/B7Ahpx3M5/Q3B93_2FcSTrCmxypMPT/8JVp8AUZzhfuucVY_2B/wCiIRjjYq_2FqoNLK9B6bf/0aSehXg9FwafT/cgt8pMOQ/HbDCojQOV1FVprYRnxx13U1/UwN8_2B_2F/vzILJE71SBej4gvGi/FIWIlMn9n/L3 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /8N_2FW41xDzjkhrWQ/7Li83vNh8E0s/iNweknKPsr4/wqFKfz34i2ath6/I0bXROB0tUnNMBxp8qE25/AmJwK10jn6MVat3G/t7FuQx2zVw1ffa5/c7cpkHpQnz9kmDbUqx/Otf3v0Da9/dQZioOeK9Dz9hNXsqwu1/tlEzuHEM4S9kJrg9zGq/RjBYXn9MjpOQGxui0wmfPX/po6OMlacqL3xm/d_2FBFj8/AujuAR6DuH05PJMkT_2BTvZ/D_2BlXEdZ3/ZBW_2FuilrCeiWMje/rHsDq9syNU01/kSBqmc5Fyr_/2B3baeMNkKHxqo/p7TsHB_2FsB3Yjr2vV_2F/OiBfbqWQAEP/P_2F HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: app.bighomegl.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Nqnk1j8Pq1gJEs1x5F/Dd1hhfQAv/jtmHiVvgoBkcYEwLzLyA/C5p24Ce9YgRZRzxsjjD/nxl_2BdpzYbVr0QWXmBP9v/GO1k2SCoSQjXR/yxhwTnmC/pDIJ9c_2Bm_2FrJ_2B9wee3/JVSl6ysora/rGjwo8YPYfbP9mT94/HzBvhbCiqM7B/Bi1eHCPiGVL/46J0oLxANcfziq/thqSh_2Bozif3G_2Fo_2F/k6b3HZTG7RK0p_2F/ovJUD_2BB3IEisf/V1SwB6D9ZycfRmjdXo/1wtqe3ptL/omd3M4svRRs8_2F1Zp8h/fMxrdwrQxKRQQ81i3US/ttoCJ HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: authd.feronok.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1KWgQnO99/jRkbuys9zmBRLf_2Bfsk/j4hnRgNwvnusz6igqqU/69TUSClHMklgWWKD_2F1Zz/rzeT_2BYOFVhf/cyHjXUJp/RmO3IoI8my48PUoCkU_2Bq5/Szeo_2BZSo/JGYOsrFv3PDanQVBJ/aQVxlvGnm7ma/EvG_2Fcbphd/B7D_2FsJViKTei/G4P6ADPlZ3kryG2o13jPZ/lht8TN_2BF0SOOm1/wlXy9yuuvEg2t5t/0qJz6tISKUfXu3ooK_/2B_2FN_2B/Y8QRyMSJiCCXzc8ct_2F/cWxPiUkWHFklqYWaKgD/HT4v_2FZjRB5pDpaTPvsKl/vHhtteYEDrQEo/F_2BGZVP/fKC323Rf/6 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: app.bighomegl.at
Source: msapplication.xml0.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6fbcfddf,0x01d75eba</date><accdate>0x6fbcfddf,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6fbcfddf,0x01d75eba</date><accdate>0x6fbcfddf,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6fc424e9,0x01d75eba</date><accdate>0x6fc424e9,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6fc424e9,0x01d75eba</date><accdate>0x6fc424e9,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6fc424e9,0x01d75eba</date><accdate>0x6fc424e9,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.20.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6fc424e9,0x01d75eba</date><accdate>0x6fc424e9,0x01d75eba</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: quickbooks.aeymotors.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 11 Jun 2021 03:07:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: {C1F50A29-CAAD-11EB-90E4-ECF4BB862DED}.dat.34.dr String found in binary or memory: http://app.bighomegl.at/8N_2FW41xDzjkhrWQ/7Li83vNh8E0s/iNweknKPsr4/wqFKfz34i2ath6/I0bXROB0tUnNMBxp8q
Source: ~DF60CBFC830128400E.TMP.36.dr, {CFEFB1DE-CAAD-11EB-90E4-ECF4BB862DED}.dat.36.dr String found in binary or memory: http://authd.feronok.com/Nqnk1j8Pq1gJEs1x5F/Dd1hhfQAv/jtmHiVvgoBkcYEwLzLyA/C5p24Ce9YgRZRzxsjjD/nxl_2
Source: {B403EC44-CAAD-11EB-90E4-ECF4BB862DED}.dat.29.dr String found in binary or memory: http://authd.feronok.com/c0Zjvpk_/2BhHkEQKFoUb3aKx_2FuhQ9/zz1UpsMDGJ/MqFrowSgYmc2fzVA2/yf5xhKlVBQKb/
Source: {99BBC3ED-CAAD-11EB-90E4-ECF4BB862DED}.dat.20.dr String found in binary or memory: http://authd.feronok.com/j0D4WkqJA4qbSI2s/tbqllkJ5QjS02c9/Y4oADFKhbig2E3MZ8L/S5BHZDPll/SOOSmvbSSzszf
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: msapplication.xml.20.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.20.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.20.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.20.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.20.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.20.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.20.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.20.dr String found in binary or memory: http://www.youtube.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.aadrm.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.cortana.ai
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.office.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.onedrive.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://augloop.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cdn.entity.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://clients.config.office.net/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://config.edge.skype.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cortana.ai
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cortana.ai/api
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://cr.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dev.cortana.ai
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://devnull.onenote.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://directory.services.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://graph.windows.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://graph.windows.net/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&amp;premium=1
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&amp;premium=1
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&amp;premium=1
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://lifecycle.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://login.windows.local
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://management.azure.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://management.azure.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://messaging.office.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ncus.contentsync.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://officeapps.live.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://onedrive.live.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://outlook.office.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://outlook.office365.com/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: sharedStrings.bin String found in binary or memory: https://quickbooks.aeymotors.com/soft.dll
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://settings.outlook.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://staging.cortana.ai
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://store.office.com/addinstemplate
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://tasks.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://templatelogging.office.com/client/log
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://wus2.contentsync.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: D18DB67F-C32A-4E79-9062-0C1A4F78D8FB.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown HTTPS traffic detected: 50.87.220.158:443 -> 192.168.2.3:49714 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.326306030.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326271156.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326446921.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326414458.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326370042.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.586749442.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326338980.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326396498.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326427141.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6180, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.326306030.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326271156.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326446921.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326414458.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326370042.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.586749442.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326338980.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326396498.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326427141.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6180, type: MEMORY

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing 10 from the yellow bar above 11 12 13 Once You have Enable Editing, please clic
Source: Screenshot number: 4 Screenshot OCR: Enable Content 14 from the yellow bar above 15 16 17 ,, WHY I CANNOT OPEN THIS DOCUMENT? 19 2
Found abnormal large hidden Excel 4.0 Macro sheet
Source: my_attach_82862.xlsb Initial sample: Sheet size: 290224
Office process drops PE file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\soft[1].dll Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\Public\SettingSyncY.dll Jump to dropped file
Writes or reads registry keys via WMI
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\regsvr32.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1EC7 NtMapViewOfSection, 3_2_67CD1EC7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1B9C GetProcAddress,NtCreateSection,memset, 3_2_67CD1B9C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD2485 NtQueryVirtualMemory, 3_2_67CD2485
Detected potential crypto function
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD2264 3_2_67CD2264
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D337EA 3_2_67D337EA
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D4F1F0 3_2_67D4F1F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D4DFD2 3_2_67D4DFD2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D4D7C5 3_2_67D4D7C5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67DA1D40 3_2_67DA1D40
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D34510 3_2_67D34510
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D4A216 3_2_67D4A216
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D47200 3_2_67D47200
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D3A9D3 3_2_67D3A9D3
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D408E5 3_2_67D408E5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D31010 3_2_67D31010
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: String function: 67D30F70 appears 31 times
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSB@15/67@7/2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{C19FFCDB-9AC4-4A6F-922D-69857FBC944B} - OProcSessId.dat Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:/Users/Public/SettingSyncY.dll
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6412 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5448 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5308 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6200 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:/Users/Public/SettingSyncY.dll Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6412 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5448 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5308 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6200 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: my_attach_82862.xlsb Initial sample: OLE zip file path = xl/media/image1.png
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: Binary string: c:\571\bar\Nature\industry\Son.pdb source: regsvr32.exe, soft[1].dll.0.dr

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1F7C LoadLibraryA,GetProcAddress, 3_2_67CD1F7C
Registers a DLL
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 -s C:/Users/Public/SettingSyncY.dll
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD2253 push ecx; ret 3_2_67CD2263
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD2200 push ecx; ret 3_2_67CD2209
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D30FB5 push ecx; ret 3_2_67D30FC8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CDEBB5 pushfd ; iretd 3_2_67CDEC0C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CE0B16 pushad ; iretd 3_2_67CE0B17
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CE10D4 push 04853024h; retf 3_2_67CE10DB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CE2807 pushad ; retf 3_2_67CE2809

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\soft[1].dll Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\Public\SettingSyncY.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\Public\SettingSyncY.dll Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\Public\SettingSyncY.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.326306030.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326271156.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326446921.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326414458.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326370042.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.586749442.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326338980.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326396498.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326427141.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6180, type: MEMORY
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Potential thread-based time evasion detected
Source: Initial file Signature Results: Thread-based counter
Found dropped PE file which has not been started or loaded
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\soft[1].dll Jump to dropped file
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\SysWOW64\regsvr32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6152 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe API call chain: ExitProcess graph end node

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D2DD7D _memset,IsDebuggerPresent, 3_2_67D2DD7D
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D48402 ___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer, 3_2_67D48402
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1F7C LoadLibraryA,GetProcAddress, 3_2_67CD1F7C
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67DA7188 mov eax, dword ptr fs:[00000030h] 3_2_67DA7188
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67DA6CC5 push dword ptr fs:[00000030h] 3_2_67DA6CC5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67DA70BE mov eax, dword ptr fs:[00000030h] 3_2_67DA70BE
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D35139 GetProcessHeap, 3_2_67D35139
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D35ED2 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_67D35ED2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67D35EA1 SetUnhandledExceptionFilter, 3_2_67D35EA1

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 185.233.80.31 80 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Domain query: app.bighomegl.at
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: regsvr32.exe, 00000003.00000002.584579403.0000000003760000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: regsvr32.exe, 00000003.00000002.584579403.0000000003760000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000003.00000002.584579403.0000000003760000.00000002.00000001.sdmp Binary or memory string: Progman
Source: regsvr32.exe, 00000003.00000002.584579403.0000000003760000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA, 3_2_67CD1E8A
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, 3_2_67D3E72D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoW, 3_2_67D3ED99
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: EnumSystemLocalesW, 3_2_67D3ED13
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, 3_2_67D3E538
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 3_2_67D3E4B5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 3_2_67D3E438
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: EnumSystemLocalesW, 3_2_67D3E3DC
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, 3_2_67D33BC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_67D3FA7E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, 3_2_67D3E168
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: GetLocaleInfoW,_GetPrimaryLen, 3_2_67D3E904
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, 3_2_67D3E857
Queries the installation date of Windows
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1144 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 3_2_67CD1144
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 3_2_67CD1F10 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 3_2_67CD1F10
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.326306030.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326271156.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326446921.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326414458.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326370042.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.586749442.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326338980.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326396498.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326427141.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6180, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.326306030.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326271156.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326446921.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326414458.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326370042.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.586749442.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326338980.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326396498.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.326427141.0000000005958000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 6180, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 433009 Sample: my_attach_82862.xlsb Startdate: 11/06/2021 Architecture: WINDOWS Score: 100 36 authd.feronok.com 2->36 48 Multi AV Scanner detection for domain / URL 2->48 50 Found malware configuration 2->50 52 Antivirus detection for URL or domain 2->52 54 9 other signatures 2->54 7 EXCEL.EXE 27 43 2->7         started        12 iexplore.exe 2 83 2->12         started        14 iexplore.exe 1 50 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 46 quickbooks.aeymotors.com 50.87.220.158, 443, 49714 UNIFIEDLAYER-AS-1US United States 7->46 30 C:\Users\user\AppData\Local\...\soft[1].dll, PE32 7->30 dropped 32 C:\Users\Public\SettingSyncY.dll, PE32 7->32 dropped 34 C:\Users\user\...\~$my_attach_82862.xlsb, data 7->34 dropped 62 Document exploit detected (creates forbidden files) 7->62 64 Document exploit detected (UrlDownloadToFile) 7->64 18 regsvr32.exe 7->18         started        22 iexplore.exe 38 12->22         started        24 iexplore.exe 35 14->24         started        26 iexplore.exe 35 16->26         started        28 iexplore.exe 35 16->28         started        file6 signatures7 process8 dnsIp9 56 System process connects to network (likely due to code injection or exploit) 18->56 58 Writes or reads registry keys via WMI 18->58 60 Writes registry values via WMI 18->60 38 app.bighomegl.at 185.233.80.31, 49731, 49732, 49742 SUPERSERVERSDATACENTERRU Russian Federation 22->38 40 authd.feronok.com 22->40 42 authd.feronok.com 24->42 44 authd.feronok.com 28->44 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.233.80.31
 authd.feronok.com Russian Federation
50113 SUPERSERVERSDATACENTERRU true
50.87.220.158
 quickbooks.aeymotors.com United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
authd.feronok.com 185.233.80.31 true
app.bighomegl.at 185.233.80.31 true
quickbooks.aeymotors.com 50.87.220.158 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://authd.feronok.com/c0Zjvpk_/2BhHkEQKFoUb3aKx_2FuhQ9/zz1UpsMDGJ/MqFrowSgYmc2fzVA2/yf5xhKlVBQKb/rwrgpqZOvNV/mxBLQ1oxc7jv8k/5tQFefyNUnYTHJj33dQKu/YqZyqYfZuaOHFPro/3D3_2B6kK9arKKX/Wf1dZBj8QqS_2BWWVF/B7Ahpx3M5/Q3B93_2FcSTrCmxypMPT/8JVp8AUZzhfuucVY_2B/wCiIRjjYq_2FqoNLK9B6bf/0aSehXg9FwafT/cgt8pMOQ/HbDCojQOV1FVprYRnxx13U1/UwN8_2B_2F/vzILJE71SBej4gvGi/FIWIlMn9n/L3 true
  • Avira URL Cloud: safe
 unknown
http://authd.feronok.com/Nqnk1j8Pq1gJEs1x5F/Dd1hhfQAv/jtmHiVvgoBkcYEwLzLyA/C5p24Ce9YgRZRzxsjjD/nxl_2BdpzYbVr0QWXmBP9v/GO1k2SCoSQjXR/yxhwTnmC/pDIJ9c_2Bm_2FrJ_2B9wee3/JVSl6ysora/rGjwo8YPYfbP9mT94/HzBvhbCiqM7B/Bi1eHCPiGVL/46J0oLxANcfziq/thqSh_2Bozif3G_2Fo_2F/k6b3HZTG7RK0p_2F/ovJUD_2BB3IEisf/V1SwB6D9ZycfRmjdXo/1wtqe3ptL/omd3M4svRRs8_2F1Zp8h/fMxrdwrQxKRQQ81i3US/ttoCJ true
  • Avira URL Cloud: safe
 unknown