Windows Analysis Report sample20211025-01.xls

Overview

General Information

Sample Name: sample20211025-01.xls
Analysis ID: 508537
MD5: 2172d539dfc31f78f87363c9837fc788
SHA1: a0af38a44615a87108f842cf32f5b5f8b289fe43
SHA256: 7116c93e85891626185692c325a7c648bf2f2effb5c05582f77a18144b620164
Infos:

Most interesting Screenshot:

Detection

Ursnif Dropper
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Italy targeted Ursnif dropper document
Document contains an embedded VBA macro with suspicious strings
Document contains embedded VBA macros

Classification

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior

E-Banking Fraud:

barindex
Detected Italy targeted Ursnif dropper document
Source: Initial sample OLE, VBA macro line: Ursnif specific tokens

System Summary:

barindex
Document contains an embedded VBA macro with suspicious strings
Source: sample20211025-01.xls OLE, VBA macro line: Excel4MacroSheets.Add(Before:=Worksheets((1))).Name = Ecco_la: l_esperienza
Source: sample20211025-01.xls OLE, VBA macro line: ActiveSheet.Visible = 0
Document contains embedded VBA macros
Source: sample20211025-01.xls OLE indicator, VBA macros: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDE4D.tmp Jump to behavior
Source: sample20211025-01.xls OLE indicator, Workbook stream: true
Source: classification engine Classification label: mal52.bank.expl.winXLS@1/0@0/0
Source: sample20211025-01.xls Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 508537 Sample: sample20211025-01.xls Startdate: 25/10/2021 Architecture: WINDOWS Score: 52 7 Detected Italy targeted Ursnif dropper document 2->7 9 Document contains an embedded VBA macro with suspicious strings 2->9 5 EXCEL.EXE 53 15 2->5         started        process3
No contacted IP infos