Windows Analysis Report
KZ429 FEB17 BSRec_InvNet.xlsx

Overview

General Information

Sample Name: KZ429 FEB17 BSRec_InvNet.xlsx
Analysis ID: 562531
MD5: 31b67f4aa8dccb4ed683563dbc104bd0
SHA1: ed39326058a73ab569efa22534f79ac9ee9953e7
SHA256: 4137a3675db12038c970e56f94ce7bee7a0d920e2514eabefd9a2b28348fc9eb

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AE0576B3.emf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDE0E.tmp Jump to behavior
Source: classification engine Classification label: clean0.winXLSX@1/5@0/0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$KZ429 FEB17 BSRec_InvNet.xlsx Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/media/image5.emf
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/drawing4.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/drawing5.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/drawing6.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/media/image6.png
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/embeddings/oleObject1.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/vmlDrawing2.vml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/drawing3.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/media/image1.png
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/media/image2.emf
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/media/image3.emf
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/drawing2.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/_rels/drawing2.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/_rels/vmlDrawing2.vml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/_rels/drawing4.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/_rels/drawing5.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/drawings/_rels/drawing6.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet19.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet9.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet15.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet18.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet12.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet18.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet17.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet16.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet15.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet14.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet19.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet9.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet10.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet11.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/worksheets/sheet13.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp1.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink5.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink2.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink7.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink6.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink1.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink4.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink3.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/_rels/externalLink1.xml.rels
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/ctrlProps/ctrlProp2.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink7.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink6.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/calcChain.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink2.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink3.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink4.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = xl/externalLinks/externalLink5.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE zip file path = docProps/custom.xml
Source: KZ429 FEB17 BSRec_InvNet.xlsx Static file information: File size 1358015 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: KZ429 FEB17 BSRec_InvNet.xlsx Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 562531 Sample: KZ429 FEB17 BSRec_InvNet.xlsx Startdate: 29/01/2022 Architecture: WINDOWS Score: 0 4 EXCEL.EXE 5 13 2->4         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
windowsupdate.s.llnwi.net 41.63.96.0 true