Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

Required Order Quantity.xlsx

Status: finished
Submission Time: 2021-04-12 07:37:18 +02:00
Malicious
Trojan
Spyware
Exploiter
Evader
FormBook GuLoader

Comments

Tags

  • VelvetSweatshop
  • xlsx

Details

  • Analysis ID:
    385184
  • API (Web) ID:
    672472
  • Analysis Started:
    2021-04-12 07:45:58 +02:00
  • Analysis Finished:
    2021-04-12 08:01:13 +02:00
  • MD5:
    0bbf60240e66e82ba4adf5d8e9b61ba0
  • SHA1:
    d9d2142b4b34e3aad4020dd4d2ee918bd7d34847
  • SHA256:
    3b4f801135ba694a061a4608da04b1c0935f090b7b4c540bcace9b1bd1eecb9a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

malicious
Score: 11/48
malicious

IPs

IP Country Detection
103.141.138.118
 Viet Nam
103.67.236.191
 India
52.59.165.42
 United States
Click to see the 1 hidden entries
74.125.143.82
 United States

Domains

Name IP Detection
chapelcouture.com
 34.102.136.180
stdyworkfinetraingst.dns.army
 103.141.138.118
demo.sdssoftltd.co.uk
 103.67.236.191
Click to see the 8 hidden entries
vccmd03.googlecode.com
 0.0.0.0
vccmd01.t35.com
 0.0.0.0
vccmd01.googlecode.com
 0.0.0.0
vccmd02.googlecode.com
 0.0.0.0
www.chapelcouture.com
 0.0.0.0
vccmd01.zxq.net
 0.0.0.0
fqe.short.gy
 52.59.165.42
googlecode.l.googleusercontent.com
 74.125.143.82

URLs

Name Detection
http://stdyworkfinetraingst.dns.army/findoc/svchost.exe
https://demo.sdssoftltd.co.uk/bin_iOxAb78.binhttp://103.141.138.118/bin_iOxAb78
https://demo.sdssoftltd.co.uk/bin_iOxAb78.bin
Click to see the 25 hidden entries
www.evolvekitchendesign.com/ffw/
http://vccmd02.googlecode.com/files/cmsys.gif.exe
http://vccmd03.googlecode.com/files/cmsys.gif)
http://vccmd01.zxq.net/cmsys.gif
http://vccmd02.googlecode.com/filesoLgFqAfjBmuVwzFlRdVmuMSmtmQbIqqyE
http://www.%s.comPA
http://investor.msn.com/
http://vccmd01.t35.com/cmsys.gif8X;E
http://vccmd01.t35.com/cmsys.gifr
http://vccmd01.googlecode.com/files/cmsys.gif
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
http://www.icra.org/vocabulary/.
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
http://vccmd02.googlecode.com/files/cmsys.gif4
http://vccmd01.googlecode.com/files/cmsys.giffi
http://vccmd01.zxq.net/cmsys.gifr
http://www.hotmail.com/oe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
http://vccmd02.googlecode.com/files/cmsys.gifuVwzFlRdVmuMSmtmQbIqqyE
http://103.141.138.118/bin_iOxAb78.bin
http://vccmd02.googlecode.com/files/cmsys.gif
http://www.msnbc.com/news/ticker.txt
http://investor.msn.com
http://vccmd03.googlecode.com/files/cmsys.gif
http://www.windows.com/pctv.

Dropped files

Name File Type Hashes Detection
C:\Windows\system\svchost.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\system\spoolsv.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\system\explorer.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
Click to see the 28 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\Public\vbc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\~$Required Order Quantity.xlsx
 data
 #
C:\Users\user\AppData\Roaming\mrsys.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\stsys.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\icsys.icn.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ADA7AC24.jpeg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
 #
C:\Users\user\AppData\Local\Temp\Tar820D.tmp
 data
 #
C:\Users\user\AppData\Local\Temp\Cab820C.tmp
 Microsoft Cabinet archive data, 58596 bytes, 1 file
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FDFD920E.emf
 Windows Enhanced Metafile (EMF) image data version 0x10000
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F8A3293A.png
 PNG image data, 620 x 392, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C986F9D2.png
 PNG image data, 1366 x 430, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B9A50DD.jpeg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
 Microsoft Cabinet archive data, 58596 bytes, 1 file
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A96033F3.png
 PNG image data, 1366 x 430, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9DD37EEF.png
 PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\956F0579.emf
 Windows Enhanced Metafile (EMF) image data version 0x10000
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6F9E15D5.png
 PNG image data, 620 x 392, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\68E65BAB.png
 PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5BA27D26.png
 PNG image data, 845 x 90, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4FB5DC01.emf
 Windows Enhanced Metafile (EMF) image data version 0x10000
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\316FFEB7.png
 PNG image data, 845 x 90, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\20BD94C.png
 PNG image data, 992 x 192, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1507558.png
 PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
 data
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
 data
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
 data
 #