Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.977608547343463
Encrypted:	false
Size:	2673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9935801168055858
Encrypted:	false
Size:	2675
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.00528146398373
Encrypted:	false
Size:	2689
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9923405817864204
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.980215703762547
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 11:34:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.988602950191592
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\Downloads\289d11d1-8c6d-4ef4-abec-a2760236c5a4.tmp

Microsoft Excel 2007+

dropped

Details

File:	C:\Users\user\Downloads\289d11d1-8c6d-4ef4-abec-a2760236c5a4.tmp
Category:	dropped
Dump:	289d11d1-8c6d-4ef4-abec-a2760236c5a4.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Microsoft Excel 2007+
Entropy:	7.5872432590636825
Encrypted:	false
Size:	14125
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\Downloads\Mortgage Calculator and Comparator.xlsx (copy)

Microsoft Excel 2007+

dropped

C:\Users\user\Downloads\Mortgage Calculator and Comparator.xlsx.crdownload (copy)

Microsoft Excel 2007+

dropped

URLs

Name

Malicious

http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx

Details

Filetype:	URL
Filename:	http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx

Signature Hits	Behavior Group	Mitre Attack
Detected non-DNS traffic on DNS port	Networking	Extra Window Memory Injection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion	Extra Window Memory Injection
Sigma detected: Excel Network Connections	System Summary	Extra Window Memory Injection Masquerading
Sigma detected: Suspicious Office Outbound Connections	System Summary	Extra Window Memory Injection
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Classification label	System Summary	Extra Window Memory Injection
Connects to IPs without corresponding DNS lookups	Networking	Extra Window Memory Injection
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Extra Window Memory Injection Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Extra Window Memory Injection
Downloads compressed data via HTTP	Networking
Downloads files from webservers via HTTP	Networking	Extra Window Memory Injection Non-Application Layer Protocol Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking
Queries a list of all running processes	Malware Analysis System Evasion	Extra Window Memory Injection Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	Extra Window Memory Injection File and Directory Discovery
Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook		Application Window Discovery
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Encrypted Channel
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Uses an in-process (OLE) Automation server	System Summary
Checks if Microsoft Office is installed	System Summary	System Information Discovery
Uses secure TLS version for HTTPS connections	Compliance, Networking

http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx

217.160.0.56

Details

Name:	http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx
IP:	217.160.0.56
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

Details

Name:	s-part-0017.t-0009.fb-t-msedge.net
IP:	13.107.253.45
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Excel Network Connections	System Summary
Sigma detected: Suspicious Office Outbound Connections	System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking

www.google.com

142.250.185.196

Details

Name:	www.google.com
IP:	142.250.185.196
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

excelworks.co.uk

217.160.0.56

Details

Name:	excelworks.co.uk
IP:	217.160.0.56
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

s-part-0039.t-0009.t-msedge.net

13.107.246.67

s-part-0039.t-0009.fb-t-msedge.net

13.107.253.67

s-part-0032.t-0009.t-msedge.net

13.107.246.60

s-part-0029.t-0009.t-msedge.net

13.107.246.57

IPs

Domain

Country

Malicious

52.113.194.132

unknown

United States

217.160.0.56

excelworks.co.uk

Germany

142.250.74.206

unknown

United States

192.168.2.16

unknown

172.217.18.3

unknown

United States

13.107.253.45

s-part-0017.t-0009.fb-t-msedge.net

United States

192.168.2.18

unknown

192.168.2.4

unknown

40.79.150.121

unknown

United States

192.168.2.6

unknown

192.168.2.5

unknown

74.125.206.84

unknown

United States

239.255.255.250

unknown

Reserved

142.250.185.196

www.google.com

United States

52.109.28.46

unknown

United States

142.250.186.110

unknown

United States

184.28.90.27

unknown

United States

216.58.212.163

unknown

United States

There are 8 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx

Files

URLs

Domains

IPs

IOC Report
http://excelworks.co.uk/downloads/Mortgage%20Calculator%20and%20Comparator.xlsx