Edit tour

Windows Analysis Report
Check Payment.eml

Overview

General Information

Sample name:	Check Payment.eml
Analysis ID:	1430491
MD5:	2c7e548f731a80b689481e3cc6f05513
SHA1:	7b4cfa7fb2021c996fb047568fa3e457b2c2fccb
SHA256:	53e6dea514c1777fa60cdd548589a027e7762bcfc5ff59c31e440c9f7057da48
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7024 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Check Payment.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 3992 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "02F950BF-7EBD-4E3E-AB30-F50D507A889D" "B5D18ECE-6FCC-4415-8848-F3035AEF4D60" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 4896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://a269b7443oo.larksuite.com/wiki/KuMGwcfwEihk5Ek4n97uzOwJsxf?from=from_copylinkl MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,10023705042341734068,17381464898221404007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NXK7BJ2E\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:50031 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.7.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: a269b7443oo.larksuite.com

Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:50031 version: TLS 1.2

Source: classification engine

Classification label: clean2.winEML@17/182@52/210

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240423T1816250279-7024.etl

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Check Payment.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "02F950BF-7EBD-4E3E-AB30-F50D507A889D" "B5D18ECE-6FCC-4415-8848-F3035AEF4D60" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://a269b7443oo.larksuite.com/wiki/KuMGwcfwEihk5Ek4n97uzOwJsxf?from=from_copylinkl
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,10023705042341734068,17381464898221404007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "02F950BF-7EBD-4E3E-AB30-F50D507A889D" "B5D18ECE-6FCC-4415-8848-F3035AEF4D60" "7024" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://a269b7443oo.larksuite.com/wiki/KuMGwcfwEihk5Ek4n97uzOwJsxf?from=from_copylinkl
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,10023705042341734068,17381464898221404007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com	34.149.173.23	true	false	unknown
www.google.com	142.250.9.105	true	false	high
lark-frontier.byteoversea.com	unknown	unknown	false	unknown
mcs-bd.larksuite.com	unknown	unknown	false	unknown
slardar-bd.larksuite.com	unknown	unknown	false	unknown
lf-scm-us.larksuitecdn.com	unknown	unknown	false	unknown
api22-eeftva-docs-quic.larksuite.com	unknown	unknown	false	unknown
api16-eeftva-gateway.larksuite.com	unknown	unknown	false	unknown
a269b7443oo.larksuite.com	unknown	unknown	false	unknown
internal-api-lark-api.larksuite.com	unknown	unknown	false	unknown
sf16-unpkg.larksuitecdn.com	unknown	unknown	false	unknown
accounts.larksuite.com	unknown	unknown	false	unknown
dm.larksuite.com	unknown	unknown	false	unknown
api22-eeftva-drive-quic.larksuite.com	unknown	unknown	false	unknown
sf16-short-va.bytedapm.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
23.45.182.99	unknown	United States	20940	AKAMAI-ASN1EU	false
23.215.0.197	unknown	United States	16625	AKAMAI-ASUS	false
52.109.4.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.9.105	www.google.com	United States	15169	GOOGLEUS	false
23.61.11.188	unknown	United States	20940	AKAMAI-ASN1EU	false
23.61.11.143	unknown	United States	20940	AKAMAI-ASN1EU	false
23.45.233.33	unknown	United States	20940	AKAMAI-ASN1EU	false
23.207.202.59	unknown	United States	20940	AKAMAI-ASN1EU	false
23.207.202.23	unknown	United States	20940	AKAMAI-ASN1EU	false
23.207.202.20	unknown	United States	20940	AKAMAI-ASN1EU	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
34.117.97.41	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.38.189.17	unknown	United States	16625	AKAMAI-ASUS	false
34.149.173.23	direct.quic-webcast-proxy-useast4-v3.useast4.byteglb.com	United States	2686	ATGS-MMD-ASUS	false
23.215.0.137	unknown	United States	16625	AKAMAI-ASUS	false
23.221.214.166	unknown	United States	35994	AKAMAI-ASUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.89.179.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.214.135	unknown	United States	35994	AKAMAI-ASUS	false
23.45.182.88	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.105.94	unknown	United States	15169	GOOGLEUS	false
23.218.224.6	unknown	United States	6453	AS6453US	false
23.45.233.9	unknown	United States	20940	AKAMAI-ASN1EU	false
23.218.224.25	unknown	United States	6453	AS6453US	false
172.253.124.95	unknown	United States	15169	GOOGLEUS	false
23.38.189.41	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.52.131	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.193.106.147	unknown	United States	16625	AKAMAI-ASUS	false
64.233.185.94	unknown	United States	15169	GOOGLEUS	false
23.221.242.90	unknown	United States	8612	TISCALI-IT	false
142.250.9.84	unknown	United States	15169	GOOGLEUS	false
52.109.6.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.45.182.70	unknown	United States	20940	AKAMAI-ASN1EU	false
74.125.138.101	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430491
Start date and time:	2024-04-23 18:15:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Check Payment.eml
Detection:	CLEAN
Classification:	clean2.winEML@17/182@52/210
Cookbook Comments:	Found application associated with file extension: .eml

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4679554894199565
Encrypted:	false
SSDEEP:
MD5:	A1F3F680F3D40B6D0B3A50121A4C5328
SHA1:	4186E294E95C0F768599709EA7B2A4F5E0B36699
SHA-256:	56A118BABCFAB55FE0D4C2548170CC2BEE7D3B88E6DF89690041A7E3E90476A7
SHA-512:	623A18B274F3225F8EF57F2414BFBDAE33D188225A070C200F17C38FCCFAEC1E0C895F0A05CB1CD033BDD356D732B858AE08AB7B31FB3A556EB19A3BA21085A0
Malicious:	false
Reputation:	unknown
Preview:	p...... ................(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 15:16:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.989884150178684
Encrypted:	false
SSDEEP:
MD5:	B02C6707965B737535D04E5AB1AA4395
SHA1:	1778C363B6FCFD5C34D550B9020240020A1F57D3
SHA-256:	60412ED8F15843F01DD196D28A03056F763A44E10AF0C3F0715E10B0841AE987
SHA-512:	2D48771B5B21083066F127D30EBEAD44BF97A7FF6B50E449080FBAAF2B78A3C240D8F72E6EF51D2F725C9A9DBEE2EE399EDF25B1DECDFD2702BDD4C9C1524EFE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....?~.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........;3o......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	5.851184723703514
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Check Payment.eml
File size:	292'879 bytes
MD5:	2c7e548f731a80b689481e3cc6f05513
SHA1:	7b4cfa7fb2021c996fb047568fa3e457b2c2fccb
SHA256:	53e6dea514c1777fa60cdd548589a027e7762bcfc5ff59c31e440c9f7057da48
SHA512:	dec3b9d585a882f8d6922c4b3e4f967d43dda2bfe797626933d3b4f670d6e464184e0540426ae9d2ff310428618fb7f1a2b37e94652bce6042374b4fd138898c
SSDEEP:	6144:dVKQRvWnld+j2LQmxV/EINGumrQzH+1QOugJGoXSC6JU:dVKQRvcIj8QAqIu+mvXDKU
TLSH:	7F54D071CAA9AED5072D3AC0451C7F841D8C279BC7B69766FA8974F13C4A160EF2C4B8
File Content Preview:	Received: from SA3PR03MB7187.namprd03.prod.outlook.com (2603:10b6:806:2f6::11).. by DM6PR03MB3466.namprd03.prod.outlook.com with HTTPS; Fri, 12 Apr 2024.. 15:54:32 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;.. b=BHiNVm

Subject:	Check Payment
From:	Megan B <mbennett@projectturnabout.org>
To:	Megan B <mbennett@projectturnabout.org>
Cc:
BCC:
Date:	Fri, 12 Apr 2024 15:54:22 +0000
Communications:	You don't often get email from mbennett@projectturnabout.org. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Please see attached.
Attachments:	Payment Slips.msg

Key	Value
Received	from BY5PR13MB4519.namprd13.prod.outlook.com ([fe80::7b61:d0fc:1689:17f3]) by BY5PR13MB4519.namprd13.prod.outlook.com ([fe80::7b61:d0fc:1689:17f3%7]) with mapi id 15.20.7409.055; Fri, 12 Apr 2024 15:54:22 +0000
ARC-Seal	i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CWzfsuD4uYFRphcISyrg6I72fWcJ8LavVJrb2yQq9PScExBbmBdhtUtkPtGHqrE2CaEf2GdhFnBosarruJp38NVVzUzu7/0mos6MH2FSF8WWZgJ0IdKfUGJiV8BjADG5lc55xdV6vPZCC/H3InaAgiGJ16VIn5D4Z3HGZxOMLpxyAhX89kzb8LgXJuPS19CFsYuLMw81CUtCTGJjPfpslxivrJ08HTxxVZRF0EaTcghXgUz+ib6M9OD+LbptbOjiM+8VLlwYUpfCiCZut0C/r1IMSdSIpUVNlHFTIVKlgz/lh8Q6c5afXQ9HTb/uA4LTHFL+eiqmrK2H7QKXHRLwYQ==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2RUi/3lHn8tzbI3tej0fnNt1SSvNgs0selxoMAZkGW8=; b=hBtdCFebitfg2APFiARsakbZuuQiVTPmlWbEQ5PI9HOMFuKnmDg0yyvbjwjNeo+2lHtBOCURJu/va00lrDM5J3Jh3xWsz1amWdxOs9Oa9UW+buk1eMaPWvr9Ec/X8ZRZKKMq3/ECnifACxgRrXmAltfEWNobAucNLN7lZC8seSIS9AMpFt4yoO2GT5BUC0TmofP4Fbb52lpRd8Jaay/8zCTcd3gzue9u1QXEyyOWjmB/htTT9AuBM6DsqjW5cXidBSsmYLLz/WKf10kF85NnUts7StdRMOg+ndbMWkQ2B7Vy7/BHKGLzI9KL48ignhLNu0+YrFrrRk7XmK5qIugFig==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=projectturnabout.org; dmarc=pass action=none header.from=projectturnabout.org; dkim=pass header.d=projectturnabout.org; arc=none
Authentication-Results	spf=pass (sender IP is 207.195.178.120) smtp.mailfrom=projectturnabout.org; dkim=pass (signature was verified) header.d=projectturnabout.onmicrosoft.com;dmarc=bestguesspass action=none header.from=projectturnabout.org;compauth=pass reason=109
Received-SPF	Pass (protection.outlook.com: domain of projectturnabout.org designates 207.195.178.120 as permitted sender) receiver=protection.outlook.com; client-ip=207.195.178.120; helo=spfdal-rxy-rsq.zixsmbhosted.com; pr=C
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=projectturnabout.onmicrosoft.com; s=selector2-projectturnabout-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2RUi/3lHn8tzbI3tej0fnNt1SSvNgs0selxoMAZkGW8=; b=C4XoHT260CkQV0kySdNgUr0Z6os1Ai2LzS1XCCNVwx+JTGSPHAWk7AvvILxFtinknY8M4NEnsk07IvxAYVzAU/LS5JmgWi92T2UNp6Jy0pqFIohBBWxXIURPd4MxrK+4GPOEgVRQvHkB6De7yvHLQCiowdwTOUSvdfTCjdyfDH4=
From	Megan B <mbennett@projectturnabout.org>
To	Megan B <mbennett@projectturnabout.org>
Subject	Check Payment
Thread-Topic	Check Payment
Thread-Index	AQHajPGm1wqn2mkqAUaizYp4w0lQpQ==
Date	Fri, 12 Apr 2024 15:54:22 +0000
Message-ID	<BY5PR13MB4519BF6F0E146FE0BCDB4D53A4042@BY5PR13MB4519.namprd13.prod.outlook.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
msip_labels
Authentication-Results-Original	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=projectturnabout.org;
x-ms-traffictypediagnostic	BY5PR13MB4519:EE_\|IA2PR13MB6613:EE_\|CY4PEPF0000E9D1:EE_\|SA3PR03MB7187:EE_\|DM6PR03MB3466:EE_
X-MS-Office365-Filtering-Correlation-Id	3b7dba4b-2e1c-43a5-4e18-08dc5b08d64e
routeto	zixserver
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;
X-Microsoft-Antispam-Message-Info-Original	xBEHjpq5zLohZgto3Gm25YgZ7acu8GdCDDTgMJUIqElzB1HDxLgw1Qtyz7OIGZTzmVwTgZ0aUEWmDKpC976NLOpYfiRcSfqyhukvQaj9XWImyRS3/wAB2n+e9cI3MtGlgV/djxE/WrF0ka7YN1wQ6I9bPVaU53mloKbfQRRax37CvlsfNNmRPOyn5KNdUi5sSp1zj3aPpb96FoyjiG8WUSukDzHn4hSmtiB3RyHvYyIVtg6xpGVN2b/3WYEI+4t56H//MHb8X/6yktr7YVH313ib+VaE0LKFxCKmPA5yK0OxiusWkQkpDbgd5oozXy0bJgdX0ur1PwReLoph38vU6oaSY7dMVfuXFCabQqwvTZclvBr+pNyGGqTtDYbD8cLhDEPa4S/oN+bLEfnm6wOMfMdTbFOAJfEw5tZXFdMzQUfEzZ2yDJSj+Flp+7wPKFPdWmWuyd1m4A/bfvzB2I+hs8Fr3wACtn1qinSuC4KNr+h5/P22Vb9TdCchIkRHb27nbjj2rF2VRjDNmPDHvBb7O4UNfIRjKiTQXPtwhHa4zVN7NzoeZdPXBGNBI/XfuhnwjxYQyBufkQYLfwgTszVxX/ol/gwFRrMtqg3DJ4exAKztUHjb2Wqq0h6KNdWU6TmAMzeCLoXnvWPKAr0XOYDJZboIZjTT6QCrXe+dp/J0JMVhzvl+JWWL+cwWx9YPQ6+jCCmj0T2/npe88oOQ2piXPkxXYiinU6p18PBjMHTLTT663hsENB0CVYPMBMZASvOyVwKeR9HIMGs6uucE+tl/+1YooYVRNhk8PBlj1Zzn7n5exQXzV/11QAmWYCQhwATH6b+LrJMTgjYROGOQlSFq11CjQLPO2o0tLlJPagU/wZXlhqA3P3o1dK1AByOg5q25yxPm+8WMxPmfvRpmtcBsOyTU4PEtVfIW/JOeUxYP8Tq3z300Hp8x9EMgFYfychehe1NKFhxMwk3n08XqvLjT3OKjrdi9qTfSl/FoCKViky7pdh+TCw4CGB19BOHiIuUm2tAyrq6rTrwtIDO8XQvfamiuStG+a0rmJW83V8EdPZDRfnb4rcqmGPRKWxi+ARJKO1DAn5jQhpHoWjRZfOOSHPaALYAd1EOSKA46wkP6NzNeEAc/MsDFMywB5mbud3V1AHeL8UJxo9Q2qC3k0CFpqyfH+C+eY6lsEw7Wud4emZEVcd4mPVDjrbHxj2byb2JGKZ7c1473Ls0sbBdRnwaBYKtDNPDQ94PzqfrNTqssKmbrCb2RWJvw39PVgn9s9K+N
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR13MB4519.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(4200700016)(7416005)(366007)(1800799015)(376005)(3613699003)(38070700009);DIR:OUT;SFP:1501;
X-MS-Exchange-AntiSpam-MessageData-Original-ChunkCount	1
X-MS-Exchange-AntiSpam-MessageData-Original-0	+CPr3mRm7tCxV/nhhYInnQzGudlZFJvztDLr612SKhfZ25ocT/AVSpVtO8UAeTYc9LVHeMUp4t7uR/W7ZDT+Rlgvvj1iQVgco3ebtbkb1pvaD/ADj0x+h0o5WigaEtSe06aumYMXPVuVVO+ChXCaDH+kRoZOMWFJOg2hLIi8t9h5cj04cArUa6kCpGs2d0ff9BT/Hm0RPH2w8WtEUZOOPHJ4dWPRflbNU9mvpa9I/48TCTQL+PiEbnqjGDGBfDej6XI3CAC8yoREP7UxfU2vyBqp+hWGrPJNyfhTYyDOUbF9JInqB+Ou00prBgmDegmDHWK7+OrR0BRsYDN3ixKfVEnGJWZ9Gxt31bGVPrPWhxslSRHhCAjhses8MLjpfpIXrNLVULsVB3LzYpDsoQodEW3Zl80aIF8ptJkUuhUKaFOqeh+klLO9OH/OXq6j8baZXkqFNAgPz4NNV8BYV64OyTzoMjs8QRy8CAK2nEUg7iBrHgnRYkgjPYG9mGO+XJ3Ro/1r2tnEFHcNypBGmeVwvDspyO0ILNcr5WwwbUvpT/Z3HakA5CMof8D9zZRIjOLm6IKbp2uJt9OeVBJCdAq0Pt7FiiqfNhSWPuB53LqWGsZLFTKRV4fGpuigL5ENZEXj7UR6DdsrAhA3d9LVA5IT4AF5qNU8B9OERQiIdLtJKnamvw+ODmErtxJzaDJsWkWuhyD2Dk/UWkaB9AfVXzzVd7ac3bq7HeXWPNQ0lK2NI6HktOju1uLoMetVwOcwM9C+usgHIDreQhkXV538lkzirdFAbOqHFm7burPiYEnhe/3c4g2Y4uM3Y4kCd+5mQvqB88yDd3prwmLV7wf5NxS5eXaE1hfoQ8VM1UQRWqgElZpqcVipr3r7Drsb0uAf+BV7nS039WCDJIkmVVbmgZ5lqW47zZeoFETCcg7GyU9eEGOYKmYJozCv4tRY0TVBaojtJTPFpAPkdkGvAzqzpJsFRsI3gUgU4A2nMHSe0igueQ4mC+0yWyuK19hjcGX/k9RuO61npn+y3+ZV9kmWAFFCKU8PXpqexq+RssT1gBT2ytgfs4pK1mw4GVZhgLf7gFBQCbqP574kWa6rElSHWG5K47xtlI9krqoUNEM59X1rEYs8E/3vqRTizb3if+Kk3dKDN1A4py+JIdwxGH3X+FRt+LEKpOcljvqiPgCluqP6Gse691RFnABkorrVcK/yns6lJgwSkhdIDdxz5xB/99qu2bcEoMz/Ja/TUrfqDE6L4A7XGemaEZMTLspa5sWTIdbuaohmNdOxQwTQxVZDw9yjKW3d8K3CP5wcYj/LAcaED5Luli0AOs1QqvFJR0dZX8FpeofizoMbs9W2GkJ3ti+EPY7/zkdZkn3uEYV8Z75Yw0sLdrncpCcXm7fI+4s/opO7jIL2nnrCYyLdZe0AMLq3z8biTT0Iv6xteeODSCtper6YBnb72s5gf4gWEkeVQPIIUu6pkapPxP0Azbj/mGFDl7KJBWTRXaiNxMS7+S5Sc8fRdY8UvyDGiGL/vPCRF5YFcLCj+cBu31GmJLCQk6sHxgSCjA/OFkOvJkDSwCVSM8yR3/x7Wq/mcXJYKDrUhSI2
Content-Type	multipart/mixed; boundary="_004_BY5PR13MB4519BF6F0E146FE0BCDB4D53A4042BY5PR13MB4519namp_"
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SA3PR03MB7187
X-ZIXHOSTED-CUSTOMER	pro56241
X-VPM-HOST	zgw-pro56241.b.smb.prod.dallas.zixnet.com
X-VPM-GROUP-ID	2ffe104f-d80c-49c5-8191-a6c269bb7728
X-VPM-MSG-ID	dfe62709-fc39-457b-b71c-94b04f3a8af8
X-VPM-ENC-REGIME	Plaintext
X-VPM-IS-HYBRID	0
Return-Path	mbennett@projectturnabout.org
X-MS-Exchange-Organization-ExpirationStartTime	12 Apr 2024 15:54:29.3089 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	3b7dba4b-2e1c-43a5-4e18-08dc5b08d64e
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	e68716b0-7fbd-494b-b20a-44ac0c304c38:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped	CY4PEPF0000E9D1.namprd03.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	CY4PEPF0000E9D1.namprd03.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id-Prvs	4bd2f0c3-0e44-4db8-3c6e-08dc5b08d241
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;
X-Forefront-Antispam-Report	CIP:207.195.178.120;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:spfdal-rxy-rsq.zixsmbhosted.com;PTR:spfdal-rxy-rsq.zixsmbhosted.com;CAT:NONE;SFTY:9.25;SFS:(13230031)(3613699003);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	12 Apr 2024 15:54:29.1996 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	3b7dba4b-2e1c-43a5-4e18-08dc5b08d64e
X-MS-Exchange-CrossTenant-Id	e68716b0-7fbd-494b-b20a-44ac0c304c38
X-MS-Exchange-CrossTenant-AuthSource	CY4PEPF0000E9D1.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.5062888
X-MS-Exchange-Processed-By-BccFoldering	15.20.7409.037
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	fkozzy/YGLmO6+LrNZTctwJwNyDEU52dHGrqercqHkqLXNuCnSem2RkFuSZToLE9hb5/8MWk2Yu89OhjWKN83uOQeuP3bKS8QKNgk4U71Iww+WRGTvnNJq/ef0YoxV5uOLyF8uDyWjE9CG1lLtz3W90WOQ56KyltS9hDVZCIkusF+8X1rqpbEbtuVQnoek/AOxnYjhDrXIB/+dYtyFB6TDNOSw8g+AzB1UCYs2B38VPGQwMLXim/IzjukijHYgxE01kfuhpXpdEoZuqu1BnGtwemdrfNzPa9LRRYmOQMhvOHk2Da1uGD9Zkkj/FhPz/ZK+43ZZ1yM8pyIhEAckeUcRrEz/ZT4ShopS+PB4LzPhr17OR60adfhsW+atTydAbkEw2g/HcFE/UTxMUMHpvY4sebWOtL5U0qS7ANN1o5MJh/qzBh6pOE8sG8+41DDReUqXzv3nJ4zpcxGwqWslCJ6oHQM0t3QSXS8mad0bRbToICYuPZO4ejN2HdQYgBE2P0mz2HHYRTQ+TRNSgWU/UdnzlgSa97GEE8dMquSmIe8vZAdsinyg7BLNHKHTqD9wCaQU4Qtsslege26zhaGITpYqRLmRBqYdo8/98sbj7cQ6XQm7pZKa9UQvAL1B1XxDyRLgJQZtP3wgbBA+G4HqimrNNhTO1lQwtuQq8jE776epjiz+jPqfc0JyR90qfLAtMJkBqj8SW9tlLvW96DY74UPzDbDh14WLhbY0doW+TzHmEuiuoI3/TGb6xrATYfs0Z+tI/5IZR0Nwb2bTYsiFY+RoDxJ6YZ3am73ECavVKaZJyYqqwO9ayN792NnQKrgOmV0wRUKPXebsvVFh6uqv5QqhwjtIT3J779KxDOT93NS1/RKPsTAV4HJMoHFBRWDnxtRB3WnJ3okSRngoKcPHnkgliKigJKVmbixoKaLaY8yYxT/xHeJZnIq7mOww4aoHbqTlwoGryLHzWtsREpuEuoWJ6QsXORfPuKSoaEopynyzlpMka+UCx3WCyqfxEs8jyXsWJx/jmwwGHVBjQEeTvON0JG2xNtmSgX2qP7LNbHU5pYmdT2ewz6ok9GUpPsOBPKe32ZLSM1Lx7Rcw1cFkjqNmCUFnvZcjx5CTjXniUiRO/ILyrtUCbkOlpvtMdj2k0ulThlcQrzVv/FL75EUDQkxZ1/+ZtKajqBjxgtRMUJRzKdeajvvMTDuFyiqhfKQRLAFHgbWr730yJdDI0abd0R5nDag/yYpm8qF1tUk936IXBwAFq1gRG1k4NyP0Il2hY1JL5Zzy3T8/72q3+Y3k8BW6rqZPKbwlL8FqyYpvPImcYTWceHMWFnUIXgLvGxF4aejtmkUDiOeJq5zQ9CJWlU4Dj3G8B3YUzfE+4GO4CpvG+c0X/J8uRA89OCYQNuiLuQHUpct6VyeLJWoMTDtFQKKOxgsRezdLGhCNnC+ByFtlwQ/q23SLXBzdOewoUwxvGSV/j5oT59ORlZzDKKmlR8kNjXx2LNGC6hwJNEFx9+P+Pip09AXB1X+wgXAUMtYpFSCGGOd+tL+NQMX2E8TOqmMmLiLNo6Sv7nDRjxzZxBZ+aI8v71p5PrxtZfB7Kx4tlYpJfzj7pFOOzY60KZoi16WAAZiZoX3qPN2HMXcbevSlXkFRpW6eIrZV++3vHzKMUaTDQyCIStqjctLdfVcykCCMmikovw3NnST3DcQQEuqrng0kU8OvbDTy3Y/6BCu5z8D+nUBcnRtqKJL72WPbY5SmAgBDDqJERPuiVMv07kZlShuDX6FTynSVoNRQrguQtVZ2jAixDVNyNECEk85JGLw5Aa+XgM5rK2AHmzhGepxAtqGVrpsb1Hn1wsi5EKjA+QQIvkN8Fh9MtyFa2j321zSj1aKVdYZe7mDaB0XZs2Qu+gbYqQU2fjzVo6zZUU3Qb8o7cvoiVqCs5T0rqet/0gh4Ms6UMuSGiusCLKjDSsZ8qV24RuAZyM5W/3NM9q0U3blm7hhKdcn3GnemuP3bCeu95EO5aPfra7jY+O367txMM=
MIME-Version	1.0

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Check Payment.eml

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F931AEC9-7123-42C6-A79A-387479C17A22

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D08A07C5.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NXK7BJ2E\Payment Slips (002).msg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NXK7BJ2E\Payment Slips (002).msg:Zone.Identifier

C:\Users\user\AppData\Local\Temp\olkC00F.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Windows Analysis Report
Check Payment.eml

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre