Windows Analysis Report 4310352755503838173672.xlsb

ID:	532553
Product:	CloudBasic
Start time:	12:50:40
Start date:	02.12.2021
Sample:	4310352755503838173672.xlsb
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	88a363b14590b0c0aab8d954ac3e1b5c
SHA1:	af7b370945a8bcec0a979c93ef83770073f2b08a
SHA256:	1004873035711456c20f311b16484154554d13e060dd2bbb2c0c2ddd4e73ced4
Filetype:	Excel Microsoft Office Open XML Format document with Macro (51004/1) 36.56%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\lvDMlIDBF.rtf	HTML document, ASCII text, with very long lines, with CRLF line terminators	F36D5F88F66FB329BE532A92C60C4723	F61F29BF96EA340E7C09D40E9D1A8A0B068A42DE	B2A8E8D7B6C0B5DE835F54959A9291344D1DB2EA0C68988E482680B00E0A029E
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9CBB1296.png	PNG image data, 800 x 400, 8-bit/color RGBA, non-interlaced	BD23AADA4497DF81DFF5354688F31E37	666BAD186C4E60B5C2E35D9B4D5B636750873112	8460FE3B20B18F3BC0A7C66B29AB9AD503CB5DA8C511BC45987DAF4647E00560
C:\Users\user\Desktop\~$4310352755503838173672.xlsb	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

AV Detection:

Multi AV Scanner detection for submitted file

Source: 4310352755503838173672.xlsb	Virustotal: Detection: 39%			Perma Link
Source: 4310352755503838173672.xlsb	ReversingLabs: Detection: 21%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\wbem\WMIC.exe

Networking:

Found strings which match to known social media urls

Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.664475601.0000000005267000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663229802.0000000003E27000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.664475601.0000000005267000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663229802.0000000003E27000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: mshta.exe, 00000004.00000002.663426175.0000000004020000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: WMIC.exe, 00000002.00000002.452533180.0000000001B00000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: EXCEL.EXE, 00000000.00000002.664475601.0000000005267000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663229802.0000000003E27000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.664475601.0000000005267000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663229802.0000000003E27000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: mshta.exe, 00000004.00000002.663426175.0000000004020000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.664475601.0000000005267000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663229802.0000000003E27000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9CBB1296.png

Jump to behavior

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud:

Yara detected Dridex Downloader

Source: Yara match

File source: C:\ProgramData\lvDMlIDBF.rtf, type: DROPPED

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING FROM YELLOW BAR ABOVE 4 Once you have clicked, please click "Enable Content" 5 6
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED 2 Open this document with Desktop Version of Microsoft Office Excel. 3 CLICK
Source: Screenshot number: 4	Screenshot OCR: Enable Content" 5 6 8 ii h :: ' ' "" R a P 15 ? - 0 0 : : . ,-. .. . :: is ii B~~' .jgA=
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING FROM YELLOW BAR ABOVE 4 Once you have clicked, please click "Enable Content" 5 6
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED 2 Open this document with Desktop Version of Microsoft Office Excel. 3 CLICK
Source: Screenshot number: 8	Screenshot OCR: Enable Content" 5 6 8 ii h " '"'""""'" """ R " i^5'i """ ' " '" 15 \.:L/ ' 0 0 :: is " 19

Found Excel 4.0 Macro with suspicious formulas

Source: 4310352755503838173672.xlsb

Initial sample: EXEC

Found protected and hidden Excel 4.0 Macro sheet

Source: 4310352755503838173672.xlsb

Initial sample: Sheet name: Macro1

Contains functionality to create processes via WMI

Source: EXCEL.EXE, 00000000.00000002.666097488.0000000005C17000.00000004.00000001.sdmp

Binary or memory string: 0E&C:\Windows\System32\Wbem;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\System32\Wbem\wmic.exewmic process call create "mshta C:\ProgramData\lvDMlIDBF.rtf"C:\Windows\System32\Wbem\wmic.exeWinSta0\Default=C:=C:\Users\user\DocumentsALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OS=Windows_NTPath=C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=EWZCVGNUSERNAME=userUSERPROFILE=C:\Users\userWecVersionForRosebud.968=4windir=C:\Windowswindows_tracing_flags=3windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log

Found obfuscated Excel 4.0 Macro

Source: 4310352755503838173672.xlsb

Macro extractor: Sheet: Macro1 high usage of CHAR() function: 26

Found a hidden Excel 4.0 Macro sheet

Source: 4310352755503838173672.xlsb

Macro extractor: Sheet name: Macro1

Searches for the Microsoft Outlook file path

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Detected potential crypto function

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196753		0_2_02196753
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196340		0_2_02196340
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196743		0_2_02196743
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_021966F3		0_2_021966F3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_021966E8		0_2_021966E8

Sample is known by Antivirus

Source: 4310352755503838173672.xlsb	Virustotal: Detection: 39%
Source: 4310352755503838173672.xlsb	ReversingLabs: Detection: 21%

Reads software policies

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\lvDMlIDBF.rtf"
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta C:\ProgramData\lvDMlIDBF.rtf
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\lvDMlIDBF.rtf"			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Binary contains paths to development resources

Source: EXCEL.EXE, 00000000.00000002.664195332.0000000005080000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.663018995.0000000003C40000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$4310352755503838173672.xlsb

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD1DE.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal96.troj.expl.evad.winXLSB@4/3@0/0

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads internet explorer settings

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: 4310352755503838173672.xlsb	Initial sample: OLE zip file path = xl/media/image1.png
Source: 4310352755503838173672.xlsb	Initial sample: OLE zip file path = docProps/custom.xml

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Persistence and Installation Behavior:

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Hooking and other Techniques for Hiding and Protection:

Creates and opens a fake document (probably a fake document to hide exploiting)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: cmd line: lvdmlidbf.rtf			Jump to behavior
Source: unknown	Process created: cmd line: lvdmlidbf.rtf

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\wbem\WMIC.exe TID: 1944	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2212	Thread sleep time: -60000s >= -30000s			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02196753 rdtsc

0_2_02196753

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02196753 rdtsc

0_2_02196753

HIPS / PFW / Operating System Protection Evasion:

Yara detected Xls With Macro 4.0

Source: Yara match

File source: app.xml, type: SAMPLE

May try to detect the Windows Explorer process (often used for injection)

Source: EXCEL.EXE, 00000000.00000002.662748702.0000000000770000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.662731108.0000000001550000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.662577099.000000000014E000.00000004.00000001.sdmp	Binary or memory string: Progman
Source: EXCEL.EXE, 00000000.00000002.662748702.0000000000770000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.662731108.0000000001550000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.662748702.0000000000770000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.662731108.0000000001550000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior