Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

XSG2363662.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VETTORE; BRT S .P .A., Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jan 24 11:15:40 2022, Last Saved Time/Date: Mon Jan 24 11:15:43 2022, Security: 0

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VETTORE; BRT S .P .A., Name of Creating Application: Microsoft Excel, Create Time/Date: Mon Jan 24 11:15:40 2022, Last Saved Time/Date: Mon Jan 24 11:15:43 2022, Security: 0
Entropy:	5.511085804898523
Filename:	XSG2363662.xls
Filesize:	50176
MD5:	0a18e47e743c2a3bdb26333764d4d19c
SHA1:	434030db9b84e3832e5cc1019137205aa1c9de6f
SHA256:	6b3407cfd0ef9a6664e61733b8a838b9cd1d05e084a36a8eff0dddb0e21d34c4
SHA512:	d94effd3ac78e9a722d9cfbaf0612a7cf19e68b99a870f58869f4d0b6dbcbcd5b7a6df22c471161a178d8e7d713e5a31534a1c22830740bc83d139f62300246d
SSDEEP:	1536:bsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm09s4av3b+mMC9EM:bhlYkEIuPm3fNRZmbaoFhZhR0cixIHmw
Preview:	........................>...................................;..................................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Document contains an embedded VBA macro with suspicious strings	System Summary	Scripting
Document contains embedded VBA macros	System Summary
Sample is known by Antivirus	System Summary
Document contains an OLE Workbook stream indicating a Microsoft Excel file	System Summary

C:\Users\user\AppData\Local\Temp\3977.tmp

Composite Document File V2 Document, Cannot read section info

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\3977.tmp
Category:	dropped
Dump:	3977.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.1464700112623651
Encrypted:	false
Ssdeep:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
Size:	1536
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\~DF1716BD010027B375.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF1716BD010027B375.TMP
Category:	dropped
Dump:	~DF1716BD010027B375.TMP.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	32768
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\Local\Temp\~DF67575D7F5A6EBB68.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF67575D7F5A6EBB68.TMP
Category:	dropped
Dump:	~DF67575D7F5A6EBB68.TMP.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	512
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\~DF85705E9879F41F79.TMP

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF85705E9879F41F79.TMP
Category:	dropped
Dump:	~DF85705E9879F41F79.TMP.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	1.8512955148344692
Encrypted:	false
Ssdeep:	384:t//coCkERoz4GoMmV8oN9XHtNjcuwNRaT9E:ub31kW1NNjCNRaTC
Size:	73728
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2796
Target ID:	0
Parent PID:	596
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Size:	28253536
MD5:	D53B85E21886D2AF9815C377537BCAC3
Time:	13:31:15
Date:	24/01/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13ffc0000
Modulesize:	28282880
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Suspicious Remote Thread Created	System Summary

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

cl-

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel

MTTT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2DC1C

2DC1C

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

5q-

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU

Max Display