Edit tour

Windows Analysis Report
Re_ Remittances needed (1).eml

Overview

General Information

Sample name:	Re_ Remittances needed (1).eml
Analysis ID:	1430571
MD5:	c307adf0c0d4db6a92d2977aa224c46b
SHA1:	80060d2ed5be1dfabff839fdba57230ed1817896
SHA256:	e20012cca0b8c7ba8fe00d901ecb021530a9e1b4ae0b0da89e491bdd7d3985fe
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6288 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Re_ Remittances needed (1).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6148 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

Acrobat.exe (PID: 2924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

Acrobat.exe (PID: 6892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.216.143

Source: global traffic

Source: 56965894-3c7d-444a-a784-ac78ae7f64c1.tmp.14.dr, 16371014-b5ca-4efb-876c-dcae9763750a.tmp.14.dr

String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: classification engine

Classification label: clean1.winEML@26/71@0/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240423T2215510482-6288.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Re_ Remittances needed (1).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Re_ Remittances needed (1).eml	Binary or memory string: lLqemuGE7pgI/W34Rm6KsVaRnxk5OFl9n0jCcP4gcfGiNO3ziSNHPLdUmNGerk69wMu5gRvoR/t/
Source: Re_ Remittances needed (1).eml	Binary or memory string: Jj01FHMVnoTuNcwPsqaN3t5g2Vzr/mLFFqieC0B6uMBVoiFjyfnElaF+u2l+HgFS4068vv7jCX//
Source: Re_ Remittances needed (1).eml	Binary or memory string: OU/XhLMtD9l5dqZXjy/4pDTQn6FPJ/2ZjFnKOmufFUgXutvMcIEw6xsbMmp1UQpneeIfp60lwZWl
Source: Re_ Remittances needed (1).eml	Binary or memory string: ad/wgWjfDzW47m/WLwr8MdQTwl4o8SeFv+Ems9S13RvER8P6TDcQeMuy8W+JPFNlpRi8D6R4L1vx
Source: Re_ Remittances needed (1).eml	Binary or memory string: We0D+uCRjjXf9m5XPg81/tGd7XWdcd0sGCd4gQfEvumoC/9miiWhIjweqlEzqkCyR2f0ug0vMCin
Source: Re_ Remittances needed (1).eml	Binary or memory string: AGdehBQEmUPHJM+e4FeEclLNrWhQwuPd75blZ5YuhHejXliNvXA2cMPhoGbI2AJapZHL26ZHLnwn
Source: Re_ Remittances needed (1).eml	Binary or memory string: k0bn7k1yEK0SZL83HHZTYokqLkTFJ6aavmCI1737JsigjY/VLfTH6frnluM8I+OPTc+CuXVZr35j
Source: Re_ Remittances needed (1).eml	Binary or memory string: cJIKbJROWVQfPIkOdhfrusLyPF0E4S1LqEmuZlNZ6131NBrq7p+eGqxE3C1EYtJJhx23oRvEj4Nx
Source: Re_ Remittances needed (1).eml	Binary or memory string: gWKiHGFsyeiSsEWtzK/Y8/Nkwwm7Zr8mz+V7b55ayN1LUvuaTC7Yt73Ns+iu+Fs0EiFxm7DzAb2W
Source: Re_ Remittances needed (1).eml	Binary or memory string: RPUx6/CpWqns2yjIiQ/BOiR3nV1QyzerPVmcI6J9Qeo7h87Nkp3r5vMTxSqT001HMe8uJ2nyniBt
Source: Re_ Remittances needed (1).eml	Binary or memory string: PzeM8KmpyzR58ImqemUd60OpqU2N8hPGxjcDh3nknOwSclnro+khrivNaTuLfeF9pdx0EOmlp8U2

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430571
Start date and time:	2024-04-23 22:15:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Re_ Remittances needed (1).eml
Detection:	CLEAN
Classification:	clean1.winEML@26/71@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTT-BACKBONEGTTDE	FE8sC55u4j.elf	Get hash	malicious	Mirai	Browse	62.50.4.183
	ZOHH8muwjh.elf	Get hash	malicious	Mirai	Browse	194.183.117.247
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	81.31.17.51
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	195.81.19.29
	https://webex-install.com	Get hash	malicious	NetSupport RAT	Browse	23.203.101.20
	VOlsbvDoA0.elf	Get hash	malicious	Mirai	Browse	151.171.24.157
	994LJMbRxE.elf	Get hash	malicious	Mirai	Browse	66.7.159.79
	5DkGWDuyYR.elf	Get hash	malicious	Mirai	Browse	77.67.63.236
	xQwEu422am.elf	Get hash	malicious	Mirai	Browse	212.222.239.85

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.179103463869439
Encrypted:	false
SSDEEP:	6:V1LXkX1L+q2PRN2nKuAl9OmbnIFUt8q1LXx1Zmw+q1LXnLVkwORN2nKuAl9Ombjd:XUovaHAahFUt8YB1/+YB5JHAaSJ
MD5:	E1135970F09E4C46C0E9D4BF4420D3D4
SHA1:	1918B778A9846745F924A576E55FB0AF1CF0A738
SHA-256:	772087E1D3E6667B2C3506695DD3A1DDF4CD1A8E5D5F1F2FD54D8F636CE5C860
SHA-512:	5E75718953B19D92B97BA634B11585BF2D08DFD36E4A9339C0432BF7A57AF39F72BC60211D1925463253E9EB58CC3C54E86DE569C07DC75D6379E444E5D62000
Malicious:	false
Reputation:	low
Preview:	2024/04/23-22:16:12.287 7a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/23-22:16:12.288 7a8 Recovering log #3.2024/04/23-22:16:12.288 7a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.391320105529435
Encrypted:	false
SSDEEP:	1536:8DYLIigscbP11HLsFgs09NcAz79ysQqt2CTyAqoQ7trcm0FvEk2yyKy5FxQp53uY:5Ngx9qgrmiGu24qoQBrt0FvFmVwezyQ8
MD5:	D78983013EF21B91BFF13A02DC4B3431
SHA1:	D8BE52B1774AB8CEC7A9C8A702E4CA8103365FBA
SHA-256:	BE397CA5255AC18997F162C547C157524BEF79CEFABBB398C3A2336AA832A9EE
SHA-512:	9909BF9386E30F0056BFE3933135DC14E81F25BFD0E58E08245F7E96C3017027E331016E131A600E1EE63699C36EEF5A65775563CAA48FFA8D9DF4205D248A9E
Malicious:	false
Preview:	TH02...... .Pp..........SM01X...,...p...............IPM.Activity...........h...............h............H..hd.O...........h............H..h\cal ...pDat...h.Yw.0.....O....h..............h........_`.j...h...@...I.lw...h....H...8..j...0....T...............d.........2h...............k..{.......B...!h.............. hV........O...#h....8.........$h........8....."h........8.....'h..f...........1h...<.........0h....4....j../h....h......jH..h....p...d.O...-h .........O...+h;......X.O......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	6.04511251464117
TrID:
File name:	Re_ Remittances needed (1).eml
File size:	8'612'270 bytes
MD5:	c307adf0c0d4db6a92d2977aa224c46b
SHA1:	80060d2ed5be1dfabff839fdba57230ed1817896
SHA256:	e20012cca0b8c7ba8fe00d901ecb021530a9e1b4ae0b0da89e491bdd7d3985fe
SHA512:	d72ed6c5e99737eff5bd64111b2794e94ce784df6da3ac62f1b94cde64496799f16296c0f4f6cff9dcf0c20de34be5a82da253477f97fb1436d00e4400ccc7d4
SSDEEP:	49152:NRcE1ZTUfW0/dF7bikKkNnfDo93eff9bl8U0WZzeESEdwPsfpKjQxwTpqU560qqI:E
TLSH:	92861227F84F16D74F2490B7DF477C04BCA872630DA135B17F8981BC94EE16A868963A
File Content Preview:	Authentication-Results: relay.mimecast.com;...dkim=pass header.d=gmail.com header.s=20230601 header.b=K1VMqid+;...dmarc=pass (policy=none) header.from=gmail.com;...spf=pass (relay.mimecast.com: domain of transportaa.montreal@gmail.com designates 209.85.16

Subject:	Re: Remittances needed
From:	Transport A&A Adam <transportaa.montreal@gmail.com>
To:	Eduardo Vega <eduardo.vega@stonhard.com>
Cc:
BCC:
Date:	Mon, 22 Apr 2024 11:27:05 -0400
Communications:	Here are the missing invoices from January. Adam On Mon, Apr 22, 2024 at 11:26AM Eduardo Vega <eduardo.vega@stonhard.com> wrote: > Hi Adam, > Thank you for letting us know that, we are going to make a shot pay for > our next ACH payment. > > And I just realized that our firewall blocked that email of January 31st , > could you please resend the invoices of Jan 31st to me? > > Best regards! > ------------------------------ > De: Transport A&A Adam <transportaa.montreal@gmail.com> > Enviado: lunes, 22 de abril de 2024 9:06 > Para: Eduardo Vega <eduardo.vega@stonhard.com> > Asunto: Re: Remittances needed > > Caution: This email originated from an external source. Do not click links > or open attachments unless you recognize the sender and know the content is > safe. > > Hi Eduardo, thanks for getting back to me so quickly! > There seems to be an overpayment of $325 on the April 18th payment. > Invoice 103950 was paid in full but then a second payment was made towards > that same invoice for $325. I've added it as a credit so please short pay > your next invoice by that amount. > Also to note is that there is a batch of invoices from January that > haven't been paid. Please see the attached statement and let me know if you > need any backups. > Thanks, Adam > Transport A&A > > > > On Mon, Apr 22, 2024 at 9:35AM Eduardo Vega <eduardo.vega@stonhard.com> > wrote: > > Hi Adam, > > Attached are both of them, I think the remittance of April 18th was sent > last Friday, Could you please confirm? > > > Best regards > Eduardo Vega > > ------------------------------ > De: Transport A&A Adam <transportaa.montreal@gmail.com> > Enviado: viernes, 19 de abril de 2024 12:45 > Para: Eduardo Vega <eduardo.vega@stonhard.com> > Asunto: Remittances needed > > Caution: This email originated from an external source. Do not click links > or open attachments unless you recognize the sender and know the content is > safe. > > Hey Eduardo, I'm looking for two remittances please. one for a payment > made on March 28th, $5201.49 and another made on April 18th for $7566.78. > Can you look into this for me and get back when you have a chance? > Thanks, Adam > Transport A&A > > > > >
Attachments:	STONHARD INVOICES 103823-103838.pdf STONHARD PACKING LISTS.pdf

Key	Value
Authentication-Results	relay.mimecast.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=K1VMqid+; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (relay.mimecast.com: domain of transportaa.montreal@gmail.com designates 209.85.167.43 as permitted sender) smtp.mailfrom=transportaa.montreal@gmail.com
Received	by mail-lf1-f43.google.com with SMTP id 2adb3069b0e04-51ab4ee9df8so4264677e87.1 for <eduardo.vega@stonhard.com>; Mon, 22 Apr 2024 08:35:36 -0700 (PDT)
X-MC-Unique	CeNoRPXuPRi97QZsAQPdgg-1
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1713800134; x=1714404934; darn=stonhard.com; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=EPQbbsbonDSPQ8KCUWfgqP3fmpwktCw7Mgububbcgc4=; b=K1VMqid+rYCZ6T/Ti0Lhv5MPb1zNV+HIU9SrJXD6aXlD0DaRsvWYLPDUwf0gelnhEJ tVMZfwj8oqDnqtQAXk+6UlXKZLX0HFSZpO2S82rU+42pCGXQdCNo24HWFKSBNypYzCZb HoSahAj7ANTBuxjRU6Ri0Ia84tiiJAvksT7LYIaMvQmi7G6GfY1KSiiHjibqWm58Whka TRHUWP3F2QvT2q/YEThAXwlCLBDt7kMQp7oLYx3c+8uEbspkI4dL82ouq+cULDkeXe25 DBIr3AJdf2ZaRpzQv7NrKw5utJAYbs9OK/1GKxF2wOI9REVSYG965LmmwHZRd9uQQIhj eLsw==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713800134; x=1714404934; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=EPQbbsbonDSPQ8KCUWfgqP3fmpwktCw7Mgububbcgc4=; b=UzW8HSbFy/Jha7ZG+4xNHJU6IyzRnwhpNYlf+ysOg1W2iakno6kqnW+d41owtKM4UP 4HlxG8BpRQl0e6JAy8tZtHyLsNPDQEjQd4MupTkoCTi8QiPQe+WLZDYymHsHlQC1NhM8 vMfkwLQiKmXyYlYfQ/a+NfWxe4tD9AEWruX23hG5iRjdrhxwnivH70UH88g8Qf3xC/cu Ggucr4S8DDQlTI1oXZbhPpTuQiF78ARBS9VFe9le63GhYj78GrICBPLU8xMoowCLB66G 8eMv9ItAjIV/9TdMoit7jQqmB540QY9uulApJ/L3YMZW0iZV7ft8NUlk1OTA/KkQPMkU OVfg==
X-Gm-Message-State	AOJu0YzdCectEVEmtQmJgSqd4Svppxl+yQi5StDHkWfUS+ikrfzYLYzk dNHDlpSCU95D5EkoyEE4fhnAXgosHC2I883HTvHgHs9p7Akq38csUheTVrE6xPZIRWZpxvoIyrp sisqbf2UkOt76hvl07Hzs0F5S83g4qg==
X-Google-Smtp-Source	AGHT+IG7QX05MZ6iQOnt0ybxTvuuJP79exWpvi5PemfEiwWbCVJdgTee0dmaSACFCsyqmZ6ALqfZY2mHP441PQpRJ1Y=
X-Received	by 2002:a05:6512:31c9:b0:516:cc31:dbf0 with SMTP id j9-20020a05651231c900b00516cc31dbf0mr10169403lfe.17.1713800133040; Mon, 22 Apr 2024 08:35:33 -0700 (PDT)
MIME-Version	1.0
References	<CAOaCQ_BANNvArkxw+CL7NGKjj5kp2GF8c2EA3qjHDUavQ-a7wA@mail.gmail.com> <PH0PR18MB4591A9D266F238A655C984E6FB122@PH0PR18MB4591.namprd18.prod.outlook.com> <CAOaCQ_Dqtc4cHD8q-BMwaPfr0Zbzk-kimzJcN3Ecy51UTJBxLw@mail.gmail.com> <PH0PR18MB45914B5DCCE4D4150B349783FB122@PH0PR18MB4591.namprd18.prod.outlook.com>
In-Reply-To	<PH0PR18MB45914B5DCCE4D4150B349783FB122@PH0PR18MB4591.namprd18.prod.outlook.com>
From	Transport A&A Adam <transportaa.montreal@gmail.com>
Date	Mon, 22 Apr 2024 11:27:05 -0400
Message-ID	<CAOaCQ_A2ChOMdxU42zeG2M9OFQjPLO5N76sqXE=nC4WBsOz-0g@mail.gmail.com>
Subject	Re: Remittances needed
To	Eduardo Vega <eduardo.vega@stonhard.com>
X-Mimecast-Spam-Score	-4
Content-Type	multipart/mixed; boundary="00000000000025e9d40616b13052"

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 22:16:21.796297073 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:21.796334028 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:21.796435118 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:21.796669006 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:21.796683073 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.119997978 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.120299101 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.120315075 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.121767998 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.121841908 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.123917103 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.123996019 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.124092102 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.168159008 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.173250914 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.173259974 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.220242977 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.229275942 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.229350090 CEST	443	49718	23.62.216.143	192.168.2.16
Apr 23, 2024 22:16:22.229438066 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.230896950 CEST	49718	443	192.168.2.16	23.62.216.143
Apr 23, 2024 22:16:22.230909109 CEST	443	49718	23.62.216.143	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:16:22 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-04-23 20:16:22 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Tue, 23 Apr 2024 20:16:22 GMT Connection: close
2024-04-23 20:16:22 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Target ID:	0
Start time:	22:15:51
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Re_ Remittances needed (1).eml"
Imagebase:	0x20000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	2
Start time:	22:15:52
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "016F1EBA-115D-4877-9F9C-41459D6E8602" "7EAD5ED6-0459-4323-8199-461E7BAB052C" "6288" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff7570c0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	11
Start time:	22:16:06
Start date:	23/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD INVOICES 103823-103838.pdf"
Imagebase:	0x7ff741c50000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	12
Start time:	22:16:07
Start date:	23/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff679db0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	22:16:11
Start date:	23/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VPL6CO4Q\STONHARD PACKING LISTS.pdf"
Imagebase:	0x7ff741c50000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	14
Start time:	22:16:12
Start date:	23/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1592,i,13904569476606750348,1530364221901000283,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff679db0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Re_ Remittances needed (1).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16371014-b5ca-4efb-876c-dcae9763750a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56965894-3c7d-444a-a784-ac78ae7f64c1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF592eee.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423201613Z-205.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240423201708Z-1928.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.876

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Windows Analysis Report
Re_ Remittances needed (1).eml

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre