Loading ...

Play interactive tourEdit tour

Analysis Report legal agreement,08.20.doc

Overview

General Information

Sample Name:legal agreement,08.20.doc
Analysis ID:269489
MD5:6fae6562fb93fb6848e1dc8c11f923a5
SHA1:f7db511164a55577acbea14d8ab5407884dc2201
SHA256:6d99e3416c4997109d61988308b24565f6627ecd9f0700f4a29a9b41b55ba7d1

Most interesting Screenshot:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to HTTP operations
Machine Learning detection for sample
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document contains no OLE stream with summary information
Document has an unknown application name
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (unknown TCP traffic)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

Startup

  • System is w10x64
  • WINWORD.EXE (PID: 7136 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Machine Learning detection for sampleShow sources
Source: legal agreement,08.20.docJoe Sandbox ML: detected
Source: global trafficDNS query: name: g7hu923.com
Source: global trafficTCP traffic: 192.168.2.6:49733 -> 45.12.4.12:80
Source: global trafficTCP traffic: 192.168.2.6:49733 -> 45.12.4.12:80
Source: unknownDNS traffic detected: queries for: g7hu923.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.aadrm.com/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.onedrive.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://augloop.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cdn.entity.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://clients.config.office.net/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://config.edge.skype.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cortana.ai
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://cr.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://devnull.onenote.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://directory.services.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://graph.windows.net
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://graph.windows.net/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://lifecycle.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.microsoftonline.com/common
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.windows.local
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://management.azure.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://management.azure.com/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://messaging.office.com/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://officeapps.live.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://onedrive.live.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://settings.outlook.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://tasks.office.com
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 3B5698EA-1E2F-4D36-94A4-C999303847B8.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Document contains an embedded VBA macro with suspicious stringsShow sources
Source: legal agreement,08.20.docOLE, VBA macro line: Set e9caa989 = CreateObject("wscript.shell")
Source: VBA code instrumentationOLE, VBA macro: Module d3f27ff0, Function adc36ab1, String wscript: Set e9caa989 = CreateObject("wscript.shell")Name: adc36ab1
Document contains an embedded VBA with functions possibly related to HTTP operationsShow sources
Source: legal agreement,08.20.docStream path 'VBA/d3f27ff0' : found possibly 'XMLHttpRequest' functions response, responsebody, open, send
Source: VBA code instrumentationOLE, VBA macro: Module d3f27ff0, Function c0074137, found possibly 'XMLHttpRequest' functions response, responsebody, open, sendName: c0074137
Source: legal agreement,08.20.docOLE, VBA macro line: Sub AutoOpen()
Source: VBA code instrumentationOLE, VBA macro: Module e74a858f, Function AutoOpenName: AutoOpen
Source: legal agreement,08.20.docOLE indicator, VBA macros: true
Source: legal agreement,08.20.docOLE indicator has summary info: false
Source: legal agreement,08.20.docOLE indicator application name: unknown
Source: classification engineClassification label: mal52.expl.winDOC@1/19@1/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\BibliographyJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{4A8AF760-EC8D-4E6B-8C35-79B0E338E80E} - OProcSessId.datJump to behavior
Source: legal agreement,08.20.docOLE document summary: title field not present or empty
Source: legal agreement,08.20.docOLE document summary: edited time not present or 0
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\Desktop\~$gal agreement,08.20.docJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting22Path InterceptionPath InterceptionMasquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsExploitation for Client Execution2Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsScripting22LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.