Play interactive tour
Edit tourWindows Analysis Report HRScheduleH3965005.xlsm
Overview
General Information
| Sample Name: | HRScheduleH3965005.xlsm |
| Analysis ID: | 444771 |
| MD5: | 1799e36c7dcdafacaf883a1f9d92f62f |
| SHA1: | d49cb116574bedd7a18eb99b3f74f9b10964f3f8 |
| SHA256: | 1756dea333ae5179a904c49f5fb16b76b03208cce0c05953552a46fd37e685f7 |
| Tags: | IcedIDxlsm |
| Infos: | |
Most interesting Screenshot:  | |
Detection
IcedID
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
System process connects to network (likely due to code injection or exploit)
Yara detected IcedID
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Tries to detect virtualization through RDTSC time measurements
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to query network adapater information
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Excel documents contains an embedded macro which executes code when the document is opened
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains an invalid checksum
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Registers a DLL
Uses a known web browser user agent for HTTP communication
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
Threatname: IcedID |
|---|
{"Campaign ID": 3565085024, "C2 url": "astrocycle.download"}Yara Overview |
|---|
PCAP (Network Traffic) |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_IcedID_1 | Yara detected IcedID | Joe Security |
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_IcedID_1 | Yara detected IcedID | Joe Security | ||
| MAL_IcedID_GZIP_LDR_202104 | 2021 initial Bokbot / Icedid loader for fake GZIP payloads | Thomas Barabosch, Telekom Security |
| |
| JoeSecurity_IcedID_1 | Yara detected IcedID | Joe Security | ||
| JoeSecurity_IcedID_1 | Yara detected IcedID | Joe Security |
Unpacked PEs |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| MAL_IcedID_GZIP_LDR_202104 | 2021 initial Bokbot / Icedid loader for fake GZIP payloads | Thomas Barabosch, Telekom Security |
| |
| MAL_IcedID_GZIP_LDR_202104 | 2021 initial Bokbot / Icedid loader for fake GZIP payloads | Thomas Barabosch, Telekom Security |
| |
| MAL_IcedID_GZIP_LDR_202104 | 2021 initial Bokbot / Icedid loader for fake GZIP payloads | Thomas Barabosch, Telekom Security |
|
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||
| Yara detected IcedID | Show sources | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | File opened: | Jump to behavior | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (creates forbidden files) | Show sources | ||
| Source: | File created: | Jump to behavior | ||
| Document exploit detected (drops PE files) | Show sources | ||
| Source: | File created: | Jump to dropped file | ||
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | Jump to behavior | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
Networking: | |
|---|
| C2 URLs / IPs found in malware configuration | Show sources | ||
| Source: | URLs: | ||
| Source: | HTTP traffic detected: | ||