Edit tour

Windows Analysis Report
Craig McGriff Exploration LL3 (002).docx

Overview

General Information

Sample name:	Craig McGriff Exploration LL3 (002).docx
Analysis ID:	1417464
MD5:	aea2db17c93475adf3af10e3d6f66114
SHA1:	7734b38fcfe977966372e7b31b72ff2b1925d93f
SHA256:	7289830b123c1ffc1fb9a9779670335736996493b6e48779109d7f719a37a9c1
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Suspicious Office Outbound Connections

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 4952 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49708, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 4952, Protocol: tcp, SourceIp: 52.123.251.46, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 4952, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 52.123.251.46:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443

Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 52.123.251.46:443
Source: global traffic	TCP traffic: 52.123.251.46:443 -> 192.168.2.5:49708

Source: winword.exe

Memory has grown: Private usage: 1MB later: 61MB

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /config/v2/Office/word/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7b1F4559EC-6E14-4687-A9A6-DBC91E5354E2%7d&Application=word&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bBE7A0C35-2DAF-4D58-A459-EFDC0A078524%7d&LabMachine=false HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipIf-None-Match: ""User-Agent: Microsoft Office 2014DisableExperiments: falseX-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130Host: ecs.office.com

Source: 33069485410.ttf.0.dr	String found in binary or memory: http://fontworks.co.jp/This
Source: 31996480045.ttf.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 33069485410.ttf.0.dr	String found in binary or memory: https://github.com/fontworks-fonts/Klee)Klee
Source: App1711708369469203900_BE7A0C35-2DAF-4D58-A459-EFDC0A078524.log.0.dr	String found in binary or memory: https://login.windows.net
Source: 33069485410.ttf.0.dr	String found in binary or memory: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: CatalogCacheMetaData.xml.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true

Source: CatalogCacheMetaData.xml.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{A17D625D-BA5F-4D7C-8E4B-4F9FF0D4E6F6}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Craig McGriff Exploration LL3 (002).docx	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{A17D625D-BA5F-4D7C-8E4B-4F9FF0D4E6F6}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{A17D625D-BA5F-4D7C-8E4B-4F9FF0D4E6F6}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{A17D625D-BA5F-4D7C-8E4B-4F9FF0D4E6F6}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown			Jump to behavior

Source: Craig McGriff Exploration LL3 (002).LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Craig McGriff Exploration LL3 (002).docx
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates

Source: Craig McGriff Exploration LL3 (002).docx	Initial sample: OLE zip file path = word/media/image4.emf
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Exploitation for Client Execution	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://fontworks.co.jp/This	0%	Avira URL Cloud	safe
http://fontworks.co.jp/This	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	31996480045.ttf.0.dr	false		high
https://github.com/fontworks-fonts/Klee)Klee	33069485410.ttf.0.dr	false		high
https://login.windows.net	App1711708369469203900_BE7A0C35-2DAF-4D58-A459-EFDC0A078524.log.0.dr	false		high
http://fontworks.co.jp/This	33069485410.ttf.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL0	33069485410.ttf.0.dr	false		high

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417464
Start date and time:	2024-03-29 11:32:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Craig McGriff Exploration LL3 (002).docx
Detection:	CLEAN
Classification:	clean3.winDOCX@2/239@0/1
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svc.ms-acdc-teams.office.com	march-25-2024-7579.xlsx	Get hash	malicious	Unknown	Browse	52.123.251.29
	AI.Gemini Ultra For EU V1.0.1 PC.msi	Get hash	malicious	Unknown	Browse	52.123.251.45
	PODIATRYASSOCIATES-OneDrive-file94077#.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.249.155
	Adresse incompl#U00e8te ou erron#U00e9e.eml	Get hash	malicious	Unknown	Browse	52.123.251.53
	scanned_doc#2024-27-2_5208.xlsx	Get hash	malicious	Unknown	Browse	52.123.251.23
	SecuriteInfo.com.Trojan.StartPage1.57411.26596.3304.exe	Get hash	malicious	Unknown	Browse	52.123.251.35
	https://protect-us.mimecast.com/s/kDUnCo29gJSlg9RPwS10Xsu?domain=1drv.ms	Get hash	malicious	Unknown	Browse	52.123.251.42
	web_search_tool (1).docm	Get hash	malicious	Unknown	Browse	52.123.251.15
	002-VENIAMZS[1].xlsx	Get hash	malicious	Unknown	Browse	52.123.251.59
	UNI-45733-DS.xlam.xlsx	Get hash	malicious	Unknown	Browse	52.123.251.61

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	20.42.73.29
	AMP4qOxnnc.elf	Get hash	malicious	Mirai	Browse	20.247.156.214
	mpsl.elf	Get hash	malicious	Mirai	Browse	20.210.161.80
	mips.elf	Get hash	malicious	Mirai	Browse	51.142.97.153
	arm7.elf	Get hash	malicious	Mirai	Browse	104.209.83.205
	https://1drv.ms/f/s!AsWd4BQz7qwJa8oeifBH2QA-eNg	Get hash	malicious	HTMLPhisher	Browse	13.107.139.11
	https://depl.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.76.134.238
	https://attwebupdate.w3spaces.com/	Get hash	malicious	Unknown	Browse	40.76.134.238
	https://proud-sand-024e5ed10.5.azurestaticapps.net/Win08ShDMeEr0887/index.html	Get hash	malicious	TechSupportScam	Browse	20.22.16.164

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46
	7ITPeT3VWW.exe	Get hash	malicious	LummaC	Browse	52.123.251.46
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46
	20qMFnd9tO.exe	Get hash	malicious	LummaC	Browse	52.123.251.46
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	52.123.251.46
	Zam#U00f3wienie_27900045542300.CMD.cmd	Get hash	malicious	DBatLoader, Remcos	Browse	52.123.251.46
	jUlAlD6KHz.exe	Get hash	malicious	RisePro Stealer	Browse	52.123.251.46

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2290), with no line terminators
Category:	dropped
Size (bytes):	2290
Entropy (8bit):	5.0898576072245305
Encrypted:	false
SSDEEP:	48:cGaQdypdSyrvnzy7SymJdyKdydASyNdyrwnzyrTdnzyDkSyrXnzyyyZXy+xNyO:dEpdbT27bwEKEdAbNEs2vd2IbT27Y+x3
MD5:	9B676966E94D476F27EA6CF9DCB30A2F
SHA1:	E2AC4E53723B823185DF1C97D0CED47645D6A497
SHA-256:	29CA0025F4A173838EFD06B22BF58C3E58BC81355E42597ACDD4EF2CDB8F1ECD
SHA-512:	F7A51BA487CB3A7EF209EDA31611282532C1A13BCD5FDE67F47073AC4783B188616398969FC054366913360DBC9A8192DAF7F963A7FD3643CECF89E6064DFC7B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>15</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-03-29T10:32:52Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-04T14:08:57Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31169036496.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-03-29T10:32:52Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876226<

File type:	Microsoft Word 2007+
Entropy (8bit):	7.972095975895978
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	Craig McGriff Exploration LL3 (002).docx
File size:	2'653'638 bytes
MD5:	aea2db17c93475adf3af10e3d6f66114
SHA1:	7734b38fcfe977966372e7b31b72ff2b1925d93f
SHA256:	7289830b123c1ffc1fb9a9779670335736996493b6e48779109d7f719a37a9c1
SHA512:	22baf32dcf210a41f8ff098366bb14401b67594a87c978ee987e3a34ab0cd521199f5099b05d46ee81963f1afcbb5b2d2177d8db42ac0390976e950fdf2e2ba8
SSDEEP:	49152:5pLz7J0YxytnZD6vWTP6zbVIDFREMMVzAeWXv3CsYVxax5Xw7Di6mcCq2jzi+01O:5FJDynDOWLwbVoREMUnWXvXmax5A7WRt
TLSH:	50C5339390EB5A56E4A53276D982437D0B19D072A9337DF08638B03BF640DE8E8385F7
File Content Preview:	PK..........!....4n...........[Content_Types].xml ...(.........................................................................................................................................................................................................

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:32:51.902769089 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:51.902801037 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:51.902883053 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:51.903189898 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:51.903204918 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.199786901 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.199860096 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.214431047 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.214443922 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.214629889 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.215801954 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.260237932 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.498610020 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.498640060 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.498656034 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.498699903 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.498711109 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.498763084 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.498779058 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.592983961 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.593004942 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.593050957 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.593075991 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.593081951 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.593130112 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.686806917 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.686831951 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.686861038 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.686866999 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.686914921 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.687226057 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687239885 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687288046 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.687292099 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687302113 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.687403917 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.687807083 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687819958 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687891006 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.687895060 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.687932968 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.688608885 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.688621998 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.688682079 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.688687086 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.688721895 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.781104088 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781122923 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781176090 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.781183004 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781223059 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.781512976 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781528950 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781577110 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.781582117 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.781624079 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.782151937 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782166004 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782212019 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.782216072 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782222986 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782253981 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.782260895 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782295942 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.782303095 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.782390118 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.785779953 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.785794973 CET	443	49708	52.123.251.46	192.168.2.5
Mar 29, 2024 11:32:52.785820007 CET	49708	443	192.168.2.5	52.123.251.46
Mar 29, 2024 11:32:52.785825014 CET	443	49708	52.123.251.46	192.168.2.5

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Craig McGriff Exploration LL3 (002).docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Klee One\33069485410.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Roboto\29157941112.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Roboto\31996480045.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\798A25AB.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7C3DB7F1.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\95058F6A.emz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DCF55D3E.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E4B90BB0.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{A17D625D-BA5F-4D7C-8E4B-4F9FF0D4E6F6}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{0B68D85A-89EE-4307-9C39-51F9AD7A41BF}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B3DDC897-BBCE-409E-BFC1-8A478B237948}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1711708369469203900_BE7A0C35-2DAF-4D58-A459-EFDC0A078524.log

C:\Users\user\AppData\Local\Temp\TCD44CC.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD44CC.tmp\harvardanglia2008officeonline.xsl

C:\Users\user\AppData\Local\Temp\TCD44CE.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD44CE.tmp\iso690.xsl

C:\Users\user\AppData\Local\Temp\TCD44E1.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD44E1.tmp\ieee2006officeonline.xsl

C:\Users\user\AppData\Local\Temp\TCD44E3.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD44E3.tmp\TabList.glox

C:\Users\user\AppData\Local\Temp\TCD44F4.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD44F4.tmp\InterconnectedBlockProcess.glox

C:\Users\user\AppData\Local\Temp\TCD44F5.tmp\Content.inf

Windows Analysis Report
Craig McGriff Exploration LL3 (002).docx

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 11:32:51.901424885 CET	1.1.1.1	192.168.2.5	0x72f6	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 29, 2024 11:32:51.901424885 CET	1.1.1.1	192.168.2.5	0x72f6	No error (0)	svc.ms-acdc-teams.office.com		52.123.251.46	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:32:51.901424885 CET	1.1.1.1	192.168.2.5	0x72f6	No error (0)	svc.ms-acdc-teams.office.com		52.123.251.51	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:32:51.901424885 CET	1.1.1.1	192.168.2.5	0x72f6	No error (0)	svc.ms-acdc-teams.office.com		52.123.251.3	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:32:51.901424885 CET	1.1.1.1	192.168.2.5	0x72f6	No error (0)	svc.ms-acdc-teams.office.com		52.123.251.27	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:33:06.963397980 CET	1.1.1.1	192.168.2.5	0x37cb	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:32:52 UTC	807	OUT	GET /config/v2/Office/word/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7b1F4559EC-6E14-4687-A9A6-DBC91E5354E2%7d&Application=word&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bBE7A0C35-2DAF-4D58-A459-EFDC0A078524%7d&LabMachine=false HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip If-None-Match: "" User-Agent: Microsoft Office 2014 DisableExperiments: false X-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130 Host: ecs.office.com
2024-03-29 10:32:52 UTC	1159	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=14400 Content-Length: 149369 Content-Type: application/json Expires: Fri, 29 Mar 2024 14:32:52 GMT ETag: "FG8hXROx2XKzUW/BC9SYn4AWMaCYoBWCMH1UGhUD1zU=" Server: Microsoft-IIS/10.0 request-id: de531b43-c062-7b0b-f324-1d17f8b8f0fd Alt-Svc: h3=":443",h3-29=":443" X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Office&DestinationEndpoint=MIRA-WW-BL0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: de531b43-c062-7b0b-f324-1d17f8b8f0fd BL0PR02CA0007 2024-03-29T10:32:52.333Z X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: MNZ X-FEProxyInfo: BL0PR02CA0007.NAMPRD02.PROD.OUTLOOK.COM X-FEEFZInfo: MNZ X-Powered-By: ASP.NET X-FEServer: BL0PR02CA0007 Date: Fri, 29 Mar 2024 10:32:52 GMT Connection: close
2024-03-29 10:32:52 UTC	15225	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 63 37 32 65 61 32 38 37 2d 65 64 37 37 2d 34 66 61 36 2d 61 34 38 30 2d 33 37 31 32 34 30 36 63 33 36 37 65 22 3a 22 61 6b 61 2e 6d 73 2f 45 63 73 43 61 6e 61 72 79 22 2c 22 43 61 63 68 65 45 78 70 69 72 79 49 6e 4d 69 6e 22 3a 32 34 30 2c 22 45 6e 61 62 6c 65 53 6d 61 72 74 45 54 61 67 22 3a 31 2c 22 43 6f 6e 66 69 67 49 64 44 65 6c 69 6d 69 74 65 72 49 6e 4c 6f 67 22 3a 22 3b 22 7d 2c 22 4e 61 6e 63 79 4f 66 66 69 63 65 54 65 61 6d 22 3a 7b 22 7a 68 65 74 61 6e 34 31 32 32 30 32 31 22 3a 74 72 75 65 7d 2c 22 4f 66 66 69 63 65 5f 41 63 63 65 73 73 22 3a 7b 22 55 73 65 46 6f 72 6d 54 68 65 6d 65 49 66 4e 6f 50 61 72 65 6e 74 53 65 63 74 69 6f 6e Data Ascii: {"ECS":{"ConfigLogTarget":"default","c72ea287-ed77-4fa6-a480-3712406c367e":"aka.ms/EcsCanary","CacheExpiryInMin":240,"EnableSmartETag":1,"ConfigIdDelimiterInLog":";"},"NancyOfficeTeam":{"zhetan4122021":true},"Office_Access":{"UseFormThemeIfNoParentSection
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 4e 77 42 55 41 46 51 41 51 77 41 77 41 45 73 41 4e 51 42 45 41 45 30 41 44 45 4d 41 52 67 42 52 41 44 63 41 56 41 42 55 41 45 4d 41 4d 41 42 4c 41 44 55 41 51 67 42 47 41 41 41 51 41 43 6b 58 53 58 4e 54 64 57 4a 7a 59 33 4a 70 63 48 52 70 62 32 35 51 64 58 4a 6a 61 47 46 7a 5a 58 49 42 41 67 45 41 45 41 41 70 43 30 6c 7a 51 58 56 30 62 31 4a 6c 62 6d 56 33 41 51 49 41 41 42 41 43 4b 52 35 54 64 57 4a 7a 59 33 4a 70 63 48 52 70 62 32 35 46 65 48 42 70 63 6d 46 30 61 57 39 75 52 47 46 30 5a 56 52 70 62 57 56 51 43 48 41 47 68 6f 44 47 43 67 45 47 67 4a 71 65 41 54 41 43 41 42 41 43 4b 52 35 54 64 57 4a 7a 59 33 4a 70 63 48 52 70 62 32 35 46 65 48 42 70 63 6d 46 30 61 57 39 75 52 47 46 30 5a 56 52 70 62 57 56 51 42 48 41 47 68 6f 44 47 43 67 45 47 67 4c 42 Data Ascii: NwBUAFQAQwAwAEsANQBEAE0ADEMARgBRADcAVABUAEMAMABLADUAQgBGAAAQACkXSXNTdWJzY3JpcHRpb25QdXJjaGFzZXIBAgEAEAApC0lzQXV0b1JlbmV3AQIAABACKR5TdWJzY3JpcHRpb25FeHBpcmF0aW9uRGF0ZVRpbWVQCHAGhoDGCgEGgJqeATACABACKR5TdWJzY3JpcHRpb25FeHBpcmF0aW9uRGF0ZVRpbWVQBHAGhoDGCgEGgLB
2024-03-29 10:32:52 UTC	1159	IN	Data Raw: 5c 22 3a 32 2c 5c 22 61 5c 22 3a 31 36 38 30 39 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 38 31 37 32 37 5c 22 2c 5c 22 70 5c 22 3a 32 2c 5c 22 61 5c 22 3a 31 32 36 34 39 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 32 30 30 30 30 33 34 37 38 5c 22 2c 5c 22 70 5c 22 3a 32 2c 5c 22 61 5c 22 3a 37 35 36 35 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 30 33 38 38 33 30 5c 22 2c 5c 22 70 5c 22 3a 32 2c 5c 22 61 5c 22 3a 35 34 35 31 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 37 39 33 37 30 5c 22 2c 5c 22 70 5c 22 3a 32 2c 5c 22 61 5c 22 3a 32 31 35 34 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 37 39 39 39 37 5c 22 2c 5c 22 70 5c 22 3a 32 2c 5c 22 61 5c 22 3a 32 31 33 32 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 32 30 30 30 30 35 32 38 37 5c Data Ascii: \":2,\"a\":16809},{\"s\":\"wa104381727\",\"p\":2,\"a\":12649},{\"s\":\"wa200003478\",\"p\":2,\"a\":7565},{\"s\":\"wa104038830\",\"p\":2,\"a\":5451},{\"s\":\"wa104379370\",\"p\":2,\"a\":2154},{\"s\":\"wa104379997\",\"p\":2,\"a\":2132},{\"s\":\"wa200005287\
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 33 34 38 30 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 38 30 39 31 37 5c 22 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 33 37 32 38 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 38 31 37 31 34 5c 22 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 33 36 38 38 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 32 30 30 30 30 30 30 31 31 5c 22 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 32 30 33 37 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 38 30 32 37 38 5c 22 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 36 39 36 7d 2c 7b 5c 22 73 5c 22 3a 5c 22 77 61 31 30 34 33 38 30 34 32 39 5c 22 2c 5c 22 70 5c 22 3a 33 2c 5c 22 61 5c 22 3a 35 38 38 7d 5d 7d 22 2c 22 45 6e 61 62 6c 65 57 6f 72 64 41 64 64 49 6e 54 68 Data Ascii: ,\"p\":3,\"a\":3480},{\"s\":\"wa104380917\",\"p\":3,\"a\":3728},{\"s\":\"wa104381714\",\"p\":3,\"a\":3688},{\"s\":\"wa200000011\",\"p\":3,\"a\":2037},{\"s\":\"wa104380278\",\"p\":3,\"a\":696},{\"s\":\"wa104380429\",\"p\":3,\"a\":588}]}","EnableWordAddInTh
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 69 65 77 22 3a 74 72 75 65 2c 22 57 6f 72 64 2e 43 70 4c 65 73 73 4c 69 6e 65 54 65 6c 65 6d 65 74 72 79 22 3a 74 72 75 65 2c 22 41 75 74 68 65 6e 74 69 63 61 74 65 64 50 72 6f 76 69 64 65 72 73 53 65 61 72 63 68 52 65 71 75 65 73 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 47 72 61 6d 6d 61 72 43 68 65 63 6b 69 6e 67 2e 42 72 61 7a 69 6c 69 61 6e 43 6f 6e 74 72 61 63 74 65 64 50 72 65 70 6f 73 69 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 49 43 72 69 74 69 71 75 65 2e 4c 6f 67 47 72 61 6d 6d 61 72 46 6c 61 67 45 64 69 74 73 22 3a 74 72 75 65 2c 22 47 72 61 6d 6d 61 72 43 68 65 63 6b 69 6e 67 2e 45 6e 67 6c 69 73 68 45 6e 74 4d 65 6e 74 61 6c 48 65 61 6c 74 68 42 69 61 73 22 3a 66 61 6c 73 65 2c 22 44 6f 63 45 78 70 6f 72 74 2e 41 64 64 43 68 69 6c 64 72 Data Ascii: iew":true,"Word.CpLessLineTelemetry":true,"AuthenticatedProvidersSearchRequestEnabled":true,"GrammarChecking.BrazilianContractedPrepositions":true,"ICritique.LogGrammarFlagEdits":true,"GrammarChecking.EnglishEntMentalHealthBias":false,"DocExport.AddChildr
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 52 65 70 61 69 72 54 61 73 6b 52 65 6d 6f 76 65 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 49 6e 73 74 61 6c 6c 54 61 73 6b 43 6f 6e 66 69 67 75 72 65 6c 69 67 68 74 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 6c 69 65 6e 74 75 70 64 61 74 65 54 61 73 6b 43 6c 69 65 6e 74 64 6f 77 6e 6c 6f 61 64 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 49 6e 73 74 61 6c 6c 54 61 73 6b 53 74 72 65 61 6d 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 49 6e 73 74 61 6c 6c 54 61 73 6b 43 72 65 61 74 65 77 6f 72 6b 69 6e 67 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 55 70 64 61 Data Ascii: ":{"EventFlag":2},"RepairTaskRemoveinstallation":{"EventFlag":2},"InstallTaskConfigurelight":{"EventFlag":2},"ClientupdateTaskClientdownload":{"EventFlag":2},"InstallTaskStream":{"EventFlag":2},"InstallTaskCreateworkingconfiguration":{"EventFlag":2},"Upda
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 74 46 6c 61 67 22 3a 32 7d 2c 22 41 62 61 6e 64 6f 6e 4c 6f 67 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 72 65 61 74 65 54 61 73 6b 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 54 61 73 6b 43 72 65 61 74 69 6f 6e 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 52 65 61 73 73 69 67 6e 54 61 73 6b 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 52 65 6f 70 65 6e 54 61 73 6b 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 6f 6d 70 6c 65 74 65 54 61 73 6b 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 7d 2c 22 44 6f 63 75 6d 65 6e 74 41 63 74 69 76 69 74 69 65 73 22 3a 7b 22 Data Ascii: tFlag":2},"AbandonLog":{"EventFlag":2},"CreateTaskActivity":{"EventFlag":2},"TaskCreationActivity":{"EventFlag":2},"ReassignTaskActivity":{"EventFlag":2},"ReopenTaskActivity":{"EventFlag":2},"CompleteTaskActivity":{"EventFlag":2}}},"DocumentActivities":{"
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 68 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 2c 22 53 75 62 4e 61 6d 65 73 70 61 63 65 73 22 3a 7b 22 49 6e 73 69 67 68 74 73 22 3a 7b 22 45 76 65 6e 74 73 22 3a 7b 22 53 6d 61 72 74 4c 6f 6f 6b 75 70 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 53 6d 61 72 74 4c 6f 6f 6b 75 70 5f 5f 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 53 6d 61 72 74 4c 6f 6f 6b 75 70 5f 5f 5f 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 7d 2c 22 53 79 73 74 65 6d 22 3a 7b 22 45 76 65 6e 74 73 22 3a 7b 22 41 63 74 69 76 69 74 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 7d 2c 22 53 79 73 74 65 6d 68 63 38 63 67 4f 6a 46 51 22 3a 7b 22 45 76 65 6e 74 73 22 3a 7b 22 38 36 35 33 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 Data Ascii: h":{"EventFlag":2}},"SubNamespaces":{"Insights":{"Events":{"SmartLookup":{"EventFlag":2},"SmartLookup__":{"EventFlag":2},"SmartLookup___":{"EventFlag":2}}},"System":{"Events":{"Activity":{"EventFlag":2}}},"Systemhc8cgOjFQ":{"Events":{"8653":{"EventFlag":2
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 6c 73 65 2c 22 4c 61 79 6f 75 74 41 6e 64 44 69 73 70 6c 61 79 2e 56 69 70 67 64 4d 75 73 74 44 69 65 4d 61 79 32 30 32 33 22 3a 66 61 6c 73 65 2c 22 4c 61 79 6f 75 74 41 6e 64 44 69 73 70 6c 61 79 2e 56 69 70 67 64 4d 75 73 74 44 69 65 4d 61 72 63 68 32 30 32 33 22 3a 66 61 6c 73 65 2c 22 55 73 65 4e 65 77 49 6e 66 72 61 46 6f 72 55 6e 73 61 66 65 45 64 69 74 54 65 6c 65 6d 22 3a 66 61 6c 73 65 2c 22 55 73 65 41 73 79 6e 63 43 6f 6e 66 69 67 54 6f 6b 65 6e 66 6f 72 41 63 72 6f 6e 79 6d 73 22 3a 66 61 6c 73 65 2c 22 55 73 65 41 73 79 6e 63 43 6f 6e 66 69 67 54 6f 6b 65 6e 66 6f 72 44 69 67 69 74 61 6c 50 72 69 6e 74 22 3a 66 61 6c 73 65 2c 22 4c 61 79 6f 75 74 41 6e 64 44 69 73 70 6c 61 79 2e 42 75 69 6c 64 53 6c 69 63 65 73 46 72 6f 6d 46 73 70 61 67 65 Data Ascii: lse,"LayoutAndDisplay.VipgdMustDieMay2023":false,"LayoutAndDisplay.VipgdMustDieMarch2023":false,"UseNewInfraForUnsafeEditTelem":false,"UseAsyncConfigTokenforAcronyms":false,"UseAsyncConfigTokenforDigitalPrint":false,"LayoutAndDisplay.BuildSlicesFromFspage
2024-03-29 10:32:52 UTC	16384	IN	Data Raw: 30 33 30 36 35 39 2d 32 2d 33 2c 50 2d 44 2d 31 30 33 30 36 35 36 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 36 34 39 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 36 34 32 2d 31 32 2d 38 2c 50 2d 44 2d 31 30 33 30 36 33 37 2d 37 2d 33 2c 50 2d 44 2d 31 30 33 30 36 33 36 2d 37 2d 33 2c 50 2d 44 2d 31 30 33 30 36 33 35 2d 37 2d 33 2c 50 2d 44 2d 31 30 33 30 36 33 34 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 36 33 33 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 36 32 38 2d 32 2d 34 2c 50 2d 44 2d 31 30 33 30 35 39 31 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 35 36 31 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 35 36 30 2d 33 39 2d 38 2c 50 2d 44 2d 31 30 33 30 35 34 37 2d 32 2d 34 2c 50 2d 44 2d 31 30 33 30 35 34 35 2d 31 2d 33 2c 50 2d 44 2d 31 30 33 30 35 34 32 2d 31 2d 33 2c 50 2d Data Ascii: 030659-2-3,P-D-1030656-1-3,P-D-1030649-1-3,P-D-1030642-12-8,P-D-1030637-7-3,P-D-1030636-7-3,P-D-1030635-7-3,P-D-1030634-1-3,P-D-1030633-1-3,P-D-1030628-2-4,P-D-1030591-1-3,P-D-1030561-1-3,P-D-1030560-39-8,P-D-1030547-2-4,P-D-1030545-1-3,P-D-1030542-1-3,P-

Target ID:	0
Start time:	11:32:47
Start date:	29/03/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xdb0000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre