Loading ...

Play interactive tourEdit tour

Analysis Report contact1.vcf

Overview

General Information

Sample Name:contact1.vcf
Analysis ID:299749
MD5:5d4cd4fd8c7d6af67ea89c936ef16b58
SHA1:cf27d2482b4fc5d23b85041ff82f7a9ee518f6c7
SHA256:7d69bcee8b7502a21c633224fde0951c1ff06d02248a98395af7538222fc847e

Most interesting Screenshot:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder

Classification

Startup

  • System is w10x64
  • OUTLOOK.EXE (PID: 6464 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE' /v 'C:\Users\user\Desktop\contact1.vcf' MD5: 7DD935BA9B57D9D7EFF63C67653E70B5)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.aadrm.com/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.diagnostics.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.office.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.onedrive.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://augloop.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://augloop.office.com/v2
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cdn.entity.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://clients.config.office.net/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://config.edge.skype.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cortana.ai
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://cr.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://devnull.onenote.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://directory.services.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://graph.ppe.windows.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://graph.windows.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://graph.windows.net/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://lifecycle.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.microsoftonline.com/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.microsoftonline.com/common
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.windows.local
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://management.azure.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://management.azure.com/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://messaging.office.com/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ncus-000.contentsync.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ncus-000.pagecontentsync.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://officeapps.live.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://onedrive.live.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://powerlift.acompli.net
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://settings.outlook.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://store.office.com/addinstemplate
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://tasks.office.com
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://templatelogging.office.com/client/log
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://wus2-000.contentsync.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://wus2-000.pagecontentsync.
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 64C4A4AC-5ABE-4904-B1D8-FDBBFC3DB4D6.2.drString found in binary or memory: https://www.odwebp.svc.ms
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile created: C:\Windows\inf\Outlook\Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile deleted: C:\Windows\SysWOW64\PerfStringBackup.TMPJump to behavior
Source: classification engineClassification label: clean1.winVCF@1/9@0/0
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Microsoft\OutlookJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\{EEF9F0FC-11AB-4C40-8A8E-11C3250D9DC9} - OProcSessId.datJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEFile written: C:\Windows\INF\Outlook\outlperf.iniJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEAutomated click: Next >
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEAutomated click: Next >
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXERegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Outlook\PerformanceJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationWindows Service1Windows Service1Masquerading11OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsFile Deletion1LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerRemote System Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.