Windows Analysis Report
Upgraded Continuous Flow Task Tracker Final Version.xlsm

Overview

General Information

Sample name:	Upgraded Continuous Flow Task Tracker Final Version.xlsm
Analysis ID:	1501301
MD5:	143d71989e671c1848419ca68caab2ff
SHA1:	dbefcf21ff717e403e771ee2edbc7332813633c7
SHA256:	4a600105d03db02d501350afd9eb9dcd9471779b59002c536de3da474c02e7c3
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Classification

Signatures

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.123.243.219:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49755 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755

Source: excel.exe

Memory has grown: Private usage: 2MB later: 78MB

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.253.72 13.107.253.72

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /config/v2/Office/excel/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7b7423E565-A626-48D4-A186-93E31FBB3F25%7d&Application=excel&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=excel.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bDB47F978-C39B-4158-BF57-A2779289117D%7d&LabMachine=false HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipIf-None-Match: "NBZZ0yPtnIZxj0NZ+as1PGyLKGN8GOvVL0RXS5Wllhw="User-Agent: Microsoft Office 2014DisableExperiments: falseX-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130Host: ecs.office.com
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v12s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170022v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr

String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 52.123.243.219:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49755 version: TLS 1.2

Document contains embedded VBA macros

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	OLE indicator, VBA macros: true
Source: 97D30000.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF2A3CC292D347A8A1.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean5.winXLSM@3/8@0/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Upgraded Continuous Flow Task Tracker Final Version.xlsm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{DB47F978-C39B-4158-BF57-A2779289117D} - OProcSessId.dat

Jump to behavior

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	OLE indicator, Workbook stream: true
Source: 97D30000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a0f-f192-11d4-a65f-0040963251e5}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable3.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/style1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/colors1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/style2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/colors2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart2.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart1.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable1.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable2.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable3.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable4.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable5.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable3.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/style1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/colors1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/style2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/colors2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable2.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable3.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable4.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable5.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart2.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm

Initial sample: OLE summary creatingapplication = Microsoft Macintosh Excel

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF2A3CC292D347A8A1.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 978

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.253.72	s-part-0044.t-0009.fb-t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.123.243.219	svc.ms-acdc-teams.office.com	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
svc.ms-acdc-teams.office.com	52.123.243.219	true
bg.microsoft.map.fastly.net	199.232.210.172	true
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	573220372DA4ED487441611079B623CD	8F9D967AC6EF34640F1F0845214FBC6994C0CB80	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	data	2163B0B7961BC52A39EC5CD5DA3FCDE1	CAFDEED251C7C114EDE9DFC6D874B7E4B34E9CDD	66EC1AC3A54F5DC36890C7922E51607D54D4DA6E9CE510EEEF1BBCB1582BFE6F
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd	data	1165714F4C78E565ABF9F4CFB34CC7BD	38ED6CCC728AFE28CF623E8C710AC0269EDAEEC8	3E2C51B67170531EE1DF09ADF220490C5DC02F83C5A03A848B738D19B78161DD
C:\Users\user\AppData\Local\Temp\~DF2A3CC292D347A8A1.TMP	Composite Document File V2 Document, Cannot read section info	548C0C33DA35973355FB3600D94EFAB0	37B93A5ACA33BFF9E569B487D2F7182DB4B90BB5	FDB44B0DEE5E432AF9852470D30890A17315690FAF90F086672D4C6B3E155C5A
C:\Users\user\Desktop\97D30000	Microsoft Excel 2007+	9344CBE738631B9A4B67B25599F060BA	AFD31D56E8D83CEDB943B026571ED37C1B798943	31DB7759A9C18ECB734DAD146E2530832FAEB4275E7482525BA62DF1AA41C805
C:\Users\user\Desktop\97D30000:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Desktop\Upgraded Continuous Flow Task Tracker Final Version.xlsm (copy)	Microsoft Excel 2007+	9344CBE738631B9A4B67B25599F060BA	AFD31D56E8D83CEDB943B026571ED37C1B798943	31DB7759A9C18ECB734DAD146E2530832FAEB4275E7482525BA62DF1AA41C805
C:\Users\user\Desktop\~$Upgraded Continuous Flow Task Tracker Final Version.xlsm	data	9C7132B2A8CABF27097749F4D8447635	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.123.243.219:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49755 version: TLS 1.2

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 52.123.243.219:443
Source: global traffic	TCP traffic: 52.123.243.219:443 -> 192.168.2.4:49734
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49753
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49754 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49754
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 13.107.253.72:443
Source: global traffic	TCP traffic: 13.107.253.72:443 -> 192.168.2.4:49755

Source: excel.exe

Memory has grown: Private usage: 2MB later: 78MB

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.253.72 13.107.253.72

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /config/v2/Office/excel/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7b7423E565-A626-48D4-A186-93E31FBB3F25%7d&Application=excel&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=excel.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bDB47F978-C39B-4158-BF57-A2779289117D%7d&LabMachine=false HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipIf-None-Match: "NBZZ0yPtnIZxj0NZ+as1PGyLKGN8GOvVL0RXS5Wllhw="User-Agent: Microsoft Office 2014DisableExperiments: falseX-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130Host: ecs.office.com
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v12s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170022v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr

String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 52.123.243.219:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.4:49755 version: TLS 1.2

Document contains embedded VBA macros

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	OLE indicator, VBA macros: true
Source: 97D30000.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF2A3CC292D347A8A1.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean5.winXLSM@3/8@0/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Upgraded Continuous Flow Task Tracker Final Version.xlsm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{DB47F978-C39B-4158-BF57-A2779289117D} - OProcSessId.dat

Jump to behavior

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	OLE indicator, Workbook stream: true
Source: 97D30000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a0f-f192-11d4-a65f-0040963251e5}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable3.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/pivotTable6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/style1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/colors1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/style2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/colors2.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart5.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/chart6.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart2.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/charts/_rels/chart1.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable1.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable2.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable3.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable4.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable5.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable6.xml.rels
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/calcChain.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition1.xml
Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/sheet6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable3.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/pivotTable6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/style1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/colors1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/style2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/colors2.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart5.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/chart6.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet5.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/worksheets/_rels/sheet6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable2.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable3.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable4.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable5.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotTables/_rels/pivotTable6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart1.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart2.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/charts/_rels/chart6.xml.rels
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheDefinition1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/pivotCacheRecords1.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml
Source: 97D30000.0.dr	Initial sample: OLE zip file path = xl/pivotCache/_rels/pivotCacheDefinition1.xml.rels

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Upgraded Continuous Flow Task Tracker Final Version.xlsm

Initial sample: OLE summary creatingapplication = Microsoft Macintosh Excel

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF2A3CC292D347A8A1.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 978

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

ID:	1501301
Product:	CloudBasic
Start time:	17:48:53
Start date:	29.08.2024
Sample:	Upgraded Continuous Flow Task Tracker Final Version.xlsm
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	143d71989e671c1848419ca68caab2ff
SHA1:	dbefcf21ff717e403e771ee2edbc7332813633c7
SHA256:	4a600105d03db02d501350afd9eb9dcd9471779b59002c536de3da474c02e7c3
Filetype:	Excel Microsoft Office Open XML Format document with Macro (52504/1) 52.24%

Windows Analysis Report
Upgraded Continuous Flow Task Tracker Final Version.xlsm

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report Upgraded Continuous Flow Task Tracker Final Version.xlsm

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
Upgraded Continuous Flow Task Tracker Final Version.xlsm