Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 3f9422a1a5a050de…

MALICIOUS

Office (OOXML) / .XLSM

27.3 KB Created: 2023-04-13 09:04:48 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2023-04-14
MD5: 1cf3b5e4f26571e5d928d16f30b14727 SHA-1: 53a06563ec0d61337fd2b3b4c656592b930f315e SHA-256: 3f9422a1a5a050de093850725c99c16a0ab85b60edd3958dd7c6c9fa611a8b9d
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059.003 Windows Command Shell

The sample is an XLSM file containing VBA macros. The macro uses URLDownloadToFile to download a ZIP archive from GitHub, which is then extracted. The extracted contents include mimikatz.exe, which is then executed with commands to perform privilege escalation and dump password hashes. This indicates an attempt to harvest credentials from the compromised system.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ee470a5768035b4419e94bd60e7e7524f4b70b237862bd0262a3914021b93851		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3049 bytes
vbaProject_00.bin
99ef716040a3e667aa2409d8fca6a1d84b3a098fc5b9f18756477aa8a605f8ea		 vba-project OOXML VBA project: xl/vbaProject.bin 36352 bytes
emf_00.emf
b04b3fa5751cca12ab6f453fb005676552aa48db7807d04d89fc3ee9f098b5d6		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.