Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

sample20220124-01.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VETTORE BRT S.P.A., Create Time/Date: Mon Jan 24 08:04:38 2022, Last Saved Time/Date: Mon Jan 24 08:04:41 2022, Security: 0, Comments: DATA ORA

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VETTORE BRT S.P.A., Create Time/Date: Mon Jan 24 08:04:38 2022, Last Saved Time/Date: Mon Jan 24 08:04:41 2022, Security: 0, Comments: DATA ORA
Entropy:	5.4276709427017735
Filename:	sample20220124-01.xls
Filesize:	51200
MD5:	4e8ec74a93b831a92a1b016722e79365
SHA1:	330af52281a3a9ae4836062f98f77fe5f8a834e4
SHA256:	e68fcd845683be392885de766f158a1c6b00cea57bdd68b5ff44d54e62400e1f
SHA512:	68dfa7849da02bd108d78a14686a7c7eded8e45206208fd8afda9886262b12dfafda475c0ed1dfef46dd48c41f9e5048364d158a0a82279d8fedaf226cd5aa22
SSDEEP:	1536:fsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0hs4avxDdmsicY:fhlYkEIuPm3fNRZmbaoFhZhR0cixIHmg
Preview:	........................>...................................;..................................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Document contains an embedded VBA macro with suspicious strings	System Summary	Scripting
Document contains embedded VBA macros	System Summary
Sample is known by Antivirus	System Summary
Document contains an OLE Workbook stream indicating a Microsoft Excel file	System Summary
Document has a 'comments' value indicative of goodware	System Summary

C:\Users\user\AppData\Local\Temp\41FF.tmp

Composite Document File V2 Document, Cannot read section info

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\41FF.tmp
Category:	dropped
Dump:	41FF.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.1464700112623651
Encrypted:	false
Ssdeep:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
Size:	1536
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\~DF12FD691A8C519DA7.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF12FD691A8C519DA7.TMP
Category:	dropped
Dump:	~DF12FD691A8C519DA7.TMP.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	1.8483782394368125
Encrypted:	false
Ssdeep:	384:qo/jrfCQRtQMm58jR92nbtiHaTNRaZ9E:qQTJthfUnRiHKNRaZC
Size:	73728
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\~DF53CCF8CC4483A0FB.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF53CCF8CC4483A0FB.TMP
Category:	dropped
Dump:	~DF53CCF8CC4483A0FB.TMP.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	512
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\~DFA1A8704CE37CB6FE.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DFA1A8704CE37CB6FE.TMP
Category:	dropped
Dump:	~DFA1A8704CE37CB6FE.TMP.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	32768
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1892
Target ID:	0
Parent PID:	596
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Size:	28253536
MD5:	D53B85E21886D2AF9815C377537BCAC3
Time:	10:58:16
Date:	24/01/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f4a0000
Modulesize:	28282880
Wow64:	false

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

.s(

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel

MTTT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2DF28

2DF28

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

!x(

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU

Max Display