Windows Analysis Report
gamme #U00e9talon CPG.xlsx

Overview

General Information

Sample name: gamme #U00e9talon CPG.xlsx
renamed because original name is a hash value
Original sample name: gamme talon CPG.xlsx
Analysis ID: 1522665
MD5: 3bc820335842b679d5a17f7675b05e83
SHA1: 5276b9c117c8068601a48f23d8b9bdd0db971ea5
SHA256: 3d25aba9124d9f921c93c31ccdf5e171db997236f4a9dcf2dddd696c90b1a32d
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections

Classification

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64249 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64248 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64251 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64252 version: TLS 1.2
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64248 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64248
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64252 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64252
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64251 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64251
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64250 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64250
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64249 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64249
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 192.168.2.4:64253 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64253
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 192.168.2.4:64254 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64254
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64255 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64255
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 192.168.2.4:64256 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64256
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 192.168.2.4:64257 -> 13.107.246.60:443
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: global traffic TCP traffic: 13.107.246.60:443 -> 192.168.2.4:64257
Source: excel.exe Memory has grown: Private usage: 1MB later: 120MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.60 13.107.246.60
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: global traffic HTTP traffic detected: GET /rules/rule170022v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule170012v12s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324001v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324003v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324002v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324004v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324005v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule324006v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64251
Source: unknown Network traffic detected: HTTP traffic on port 64256 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64250
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64253
Source: unknown Network traffic detected: HTTP traffic on port 64255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64252
Source: unknown Network traffic detected: HTTP traffic on port 64257 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64250 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64248 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64249 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64255
Source: unknown Network traffic detected: HTTP traffic on port 64253 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64254 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64254
Source: unknown Network traffic detected: HTTP traffic on port 64252 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64257
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64256
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64248
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64249
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64249 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64248 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64251 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:64252 version: TLS 1.2
Source: classification engine Classification label: clean4.winXLSX@3/9@0/1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$gamme #U00e9talon CPG.xlsx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{D0D59A53-C9B2-422E-8CDC-AE9ACDC9F952} - OProcSessId.dat Jump to behavior
Source: gamme #U00e9talon CPG.xlsx OLE indicator, Workbook stream: true
Source: DC830000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a0f-f192-11d4-a65f-0040963251e5}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE zip file path = xl/calcChain.xml
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/charts/chart1.xml
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/charts/chart2.xml
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/charts/chart3.xml
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/charts/chart4.xml
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: DC830000.0.dr Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll Jump to behavior
Source: gamme #U00e9talon CPG.xlsx Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 782 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1522665 Sample: gamme #U00e9talon CPG.xlsx Startdate: 30/09/2024 Architecture: WINDOWS Score: 4 5 EXCEL.EXE 145 61 2->5         started        dnsIp3 10 s-part-0032.t-0009.t-msedge.net 13.107.246.60, 443, 64248, 64249 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 5->10 8 splwow64.exe 5->8         started        process4
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.60
 s-part-0032.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
s-part-0032.t-0009.t-msedge.net 13.107.246.60 true