Malicious Office (OOXML) / .XLSM — malware analysis report

Static analysis result for SHA-256 72c6c81dd5ca1a8d…

MALICIOUS

Office (OOXML) / .XLSM

27.3 KB Created: 2023-04-13 09:04:48 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2023-04-14
MD5: 164ca5c60772548d788d9d8e3394e1ed SHA-1: f5a6a9a5dd77972e0edfd981c4919935252677ff SHA-256: 72c6c81dd5ca1a8d67f935a37503c8184a943392dae0fc05f5a13c6ac741a5a8
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File T1059.003 Windows Command Shell

The sample is an XLSM file containing VBA macros. The macro uses URLDownloadToFile to download a Mimikatz executable from a GitHub URL to C:\Windows\Temp\goodware.zip. It then attempts to unzip the file and execute mimikatz.exe with commands to dump credentials, writing the output to C:\Windows\Temp\mimikatz_output.log. This indicates a clear intent to exfiltrate credentials.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD
    URLDownloadToFile in VBA
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA project inside OOXML medium OOXML_VBA
    Document contains a VBA project — VBA macros present
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
ee470a5768035b4419e94bd60e7e7524f4b70b237862bd0262a3914021b93851		 vba-macro oletools.olevba.extract_macros (decoded VBA source from OOXML) 3049 bytes
vbaProject_00.bin
99ef716040a3e667aa2409d8fca6a1d84b3a098fc5b9f18756477aa8a605f8ea		 vba-project OOXML VBA project: xl/vbaProject.bin 36352 bytes
emf_00.emf
b04b3fa5751cca12ab6f453fb005676552aa48db7807d04d89fc3ee9f098b5d6		 ooxml-emf OOXML EMF part: xl/media/image1.emf 2712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.