Source: acceptable_use_policy.docm |
Virustotal: Detection: 59% |
Perma Link |
Source: acceptable_use_policy.docm |
ReversingLabs: Detection: 48% |
Source: acceptable_use_policy.docm |
Joe Sandbox ML: detected |
Source: global traffic |
DNS query: name: intergalacticaeronautic.space |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 91.195.240.13:443 |
Source: global traffic |
TCP traffic: 192.168.2.22:49167 -> 91.195.240.13:443 |
Source: Joe Sandbox View |
JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{73217C9D-FA20-48C4-87C4-17800DB89026}.tmp |
Jump to behavior |
Source: unknown |
DNS traffic detected: queries for: intergalacticaeronautic.space |
Source: ~WRS{F7C72BCE-A594-453E-9048-97C10E531855}.tmp.0.dr |
String found in binary or memory: http://www.sans.org/security-resources/glossary-of-terms/ |
Source: vbaProject.bin |
String found in binary or memory: https://intergalacticaeronautic.space/lsass.exe |
Source: vbaProject.bin |
String found in binary or memory: https://intergalacticaeronautic.space/win32.exe |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49167 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49167 -> 443 |
Source: acceptable_use_policy.docm |
OLE, VBA macro line: z = Shell(l, 0) |
|
Source: acceptable_use_policy.docm |
Stream path 'VBA/ThisDocument' : found possibly 'ADODB.Stream' functions open, savetofile, write |
|
Source: acceptable_use_policy.docm |
Stream path 'VBA/ThisDocument' : found possibly 'XMLHttpRequest' functions response, responsebody, status, open, send |
|
Source: acceptable_use_policy.docm |
OLE, VBA macro line: Private Sub Document_Open() |
|
Source: acceptable_use_policy.docm |
OLE indicator, VBA macros: true |
Source: acceptable_use_policy.docm |
OLE indicator has summary info: false |
Source: acceptable_use_policy.docm |
OLE indicator application name: unknown |
Source: classification engine |
Classification label: mal64.winDOCM@1/8@1/1 |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
File created: C:\Users\user\Desktop\~$ceptable_use_policy.docm |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
File created: C:\Users\user\AppData\Local\Temp\CVRBF1A.tmp |
Jump to behavior |
Source: acceptable_use_policy.docm |
OLE document summary: title field not present or empty |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA |
Jump to behavior |
Source: acceptable_use_policy.docm |
Virustotal: Detection: 59% |
Source: acceptable_use_policy.docm |
ReversingLabs: Detection: 48% |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: acceptable_use_policy.docm |
Initial sample: OLE zip file path = word/_rels/header1.xml.rels |
Source: acceptable_use_policy.docm |
Initial sample: OLE zip file path = docProps/custom.xml |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |