Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: unknown |
HTTPS traffic detected: 108.167.165.249:443 -> 192.168.2.22:49165 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49168 version: TLS 1.2 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe |
Source: global traffic |
DNS query: name: senderoalcielo.com |
Source: global traffic |
TCP traffic: 192.168.2.22:49165 -> 108.167.165.249:443 |
Source: global traffic |
TCP traffic: 192.168.2.22:49165 -> 108.167.165.249:443 |
Source: Joe Sandbox View |
IP Address: 5.100.155.169 5.100.155.169 |
Source: Joe Sandbox View |
JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DA3B3626.png |
Jump to behavior |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail) |
Source: unknown |
DNS traffic detected: queries for: senderoalcielo.com |
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.0.dr |
String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c |
Source: 77EC63BDA74BD0D0E0426DC8F8008506.0.dr |
String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com/ |
Source: regsvr32.exe, 00000003.00000002.2155075481.0000000004AC7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136756609.0000000004A37000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XML.asp |
Source: regsvr32.exe, 00000003.00000002.2155075481.0000000004AC7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136756609.0000000004A37000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: regsvr32.exe, 00000003.00000002.2151924460.0000000003A60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2132271668.0000000003970000.00000002.00000001.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous. |
Source: regsvr32.exe, 00000003.00000002.2150993644.0000000001CC0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2131607908.0000000001C40000.00000002.00000001.sdmp |
String found in binary or memory: http://servername/isapibackend.dll |
Source: regsvr32.exe, 00000003.00000002.2155075481.0000000004AC7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136756609.0000000004A37000.00000002.00000001.sdmp |
String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: regsvr32.exe, 00000003.00000002.2155075481.0000000004AC7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136756609.0000000004A37000.00000002.00000001.sdmp |
String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: regsvr32.exe, 00000003.00000002.2151924460.0000000003A60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2132271668.0000000003970000.00000002.00000001.sdmp |
String found in binary or memory: http://www.%s.comPA |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: http://www.hotmail.com/oe |
Source: regsvr32.exe, 00000003.00000002.2155075481.0000000004AC7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136756609.0000000004A37000.00000002.00000001.sdmp |
String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
String found in binary or memory: http://www.windows.com/pctv. |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49168 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49165 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49165 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49168 -> 443 |
Source: unknown |
HTTPS traffic detected: 108.167.165.249:443 -> 192.168.2.22:49165 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49168 version: TLS 1.2 |
Source: Screenshot number: 4 |
Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. 15 16 Protected View |
Source: Screenshot number: 4 |
Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start 19 the decryption of the docum |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet. Protected View This fi |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document |
Source: Document image extraction number: 1 |
Screenshot OCR: Enable editing" to unlock the editing document downloaded from the Internet. 0 Protected View This |
Source: Document image extraction number: 1 |
Screenshot OCR: Enable content" to perform Microsoft Office Decryption Core to start the decryption of the document |
Source: idea-22543577.xlsm |
Initial sample: CALL |
Source: workbook.xml |
Binary string: 1" sheetId="16" state="hidden" r:id="rId1"/><sheet name="Sheet" sheetId="17" r:id="rId2"/><sheet name="Sheet1" sheetId="4" r:id="rId3"/><sheet name="Sheet2" sheetId="12" r:id="rId4"/><sheet name="Sheet4" sheetId="10" state="hidden" r:id="rId5"/><sheet name="Sheet5" sheetId="11" state="hidden" r:id="rId6"/><sheet name="Sheet6" sheetId="15" state="hidden" r:id="rId7"/><sheet name="Sheet7" sheetId="14" state="hidden" r:id="rId8"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Sheet6!$AJ$9</definedName></definedNames><calcPr calcId="122211"/></workbook> |
Source: regsvr32.exe, 00000003.00000002.2154816088.00000000048E0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2136554514.0000000004850000.00000002.00000001.sdmp |
Binary or memory string: .VBPud<_ |
Source: classification engine |
Classification label: mal64.expl.evad.winXLSM@5/13@2/2 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\Desktop\~$idea-22543577.xlsm |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Temp\CVRECBE.tmp |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA |
Jump to behavior |
Source: unknown |
Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail2.dll |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail2.dll |
Jump to behavior |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: idea-22543577.xlsm |
Initial sample: OLE zip file path = xl/media/image1.png |
Source: idea-22543577.xlsm |
Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\wail1.dll |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe TID: 2328 |
Thread sleep time: -60000s >= -30000s |
Jump to behavior |
Source: C:\Windows\System32\regsvr32.exe TID: 2408 |
Thread sleep time: -60000s >= -30000s |
Jump to behavior |