Windows Analysis Report
April_2024.xlsx

ID:	1447845
Product:	CloudBasic
Start time:	09:04:51
Start date:	27.05.2024
Sample:	April_2024.xlsx
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	540d4503a8980abd04ae7d4a1893ad13
SHA1:	c2c3e388008debe8a5168a14a5a03195e01e3767
SHA256:	4d718458b777b4d4f03218570a02289fc75b794000166023554db12091e81a69
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256

Software Vulnerabilities

Source: excel.exe

Memory has grown: Private usage: 6MB later: 94MB

System Summary

Source: classification engine

Classification label: clean0.winXLSX@1/0@0/3

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$April_2024.xlsx

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{861A0BA9-0AB9-4F74-8976-2FD20B785159} - OProcSessId.dat

Source: April_2024.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet7.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet8.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet9.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet10.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet11.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet12.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet13.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/sheet14.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet4.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet7.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet8.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet9.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet11.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet12.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet13.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet14.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable1.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable2.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable3.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable4.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable5.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable1.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable2.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable3.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable4.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable6.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable7.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable5.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable6.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotTables/pivotTable7.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet10.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = docProps/thumbnail.wmf
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition1.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords1.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition2.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords2.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition3.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords3.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition4.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords4.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition5.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords5.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition6.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition7.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/tables/table1.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = docProps/custom.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings5.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition2.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition3.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition4.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition5.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings6.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = xl/printerSettings/printerSettings7.bin
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/item2.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/item3.xml
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: April_2024.xlsx	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: April_2024.xlsx

Initial sample: OLE indicators vbamacros = False

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Language, Device and Operating System Detection

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid