Windows Analysis Report
Sgioba.xlsx

ID:	1571432
Product:	CloudBasic
Start time:	11:18:31
Start date:	09.12.2024
Sample:	Sgioba.xlsx
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f098c0bf9bd12985a19ea9f937f93e39
SHA1:	6e5e06752e8c801b7ab21651dfdb9ec232f3f925
SHA256:	064f3e372e8f1aa18916e02aa857c0d4842765942d155266cd40f85f8d171663
Filetype:	Excel Microsoft Office Open XML Format document (35004/1) 81.40%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9727C9E3.jpeg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 2481x3508, components 3	BC46B1844BEDD95C2F3A6D7BF4BD72E0	FB938E079C37A377C2F2F81237DD8F3A1A069DB1	68938D4B73A2DC46CA804CAD2C99E9AA9BAD64746C21843C553B2CAAAFB049D3
C:\Users\user\Desktop\~$Sgioba.xlsx	data	9AC4D67F6E514F452D4A1DB79CE3B2E8	33F8C665ECBB81275D2E49D48F2565A58A282043	407E1D871964C93DBDBD4D00613CD0A9E30D3ED6352D8052C58E7A252D52FC5A

Compliance

Source: unknown

HTTPS traffic detected: 52.113.195.132:443 -> 192.168.2.16:49695 version: TLS 1.2

Software Vulnerabilities

Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443

Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695
Source: global traffic	TCP traffic: 192.168.2.16:49695 -> 52.113.195.132:443
Source: global traffic	TCP traffic: 52.113.195.132:443 -> 192.168.2.16:49695

Source: excel.exe

Memory has grown: Private usage: 5MB later: 195MB

Networking

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49695 -> 52.113.195.132:443

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695

Source: unknown

HTTPS traffic detected: 52.113.195.132:443 -> 192.168.2.16:49695 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean2.winXLSX@1/2@0/8

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Sgioba.xlsx

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{5AE242C3-9890-4546-A378-08865E42228D} - OProcSessId.dat

Source: Sgioba.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: Sgioba.xlsx

Initial sample: OLE indicators vbamacros = False

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Language, Device and Operating System Detection

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid