Analysis Report ACH WIRE PAYMENT ADVICE..xlsx

Overview

General Information

Sample Name:	ACH WIRE PAYMENT ADVICE..xlsx
Analysis ID:	339280
MD5:	a66a202e970df086cc265cb646127bfb
SHA1:	c8986173e16bb9b0703490afba594ec5eef08a4a
SHA256:	e29c6206512f1f778f1af9a1ff2af2bb82107271e00c873930398b703294d75e
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish_25

Phishing site detected (based on image similarity)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Steals Internet Explorer cookies

Classification

Signatures

Phishing:

Yara detected HtmlPhish_25

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ZlFRrg5s[1].htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ZlFRrg5s[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://images.typeform.com/images/nXkRcNPp6wtg/background/large

Matcher: Found strong image similarity, brand: Microsoft

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.16:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.16:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.194.82:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.194.82:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.117:443 -> 192.168.2.22:49186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49195 -> 143.204.99.83:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49202 version: TLS 1.2

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 162.247.242.19 162.247.242.19
Source: Joe Sandbox View	IP Address: 143.204.99.83 143.204.99.83
Source: Joe Sandbox View	IP Address: 162.247.242.21 162.247.242.21

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FD9543EC.jpeg

Jump to behavior

Source: unknown

DNS traffic detected: queries for: 24mbw17feyn.typeform.com

Source: vendors~form.965f5dedbb854e83c6c8[1].js.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vendors~form.965f5dedbb854e83c6c8[1].js.3.dr	String found in binary or memory: http://www.jacklmoore.com/autosize
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/oembed?url=https%3A%2F%2F24mbw17feyn.typeform.com%2Fto%2FZlFRrg5s
Source: ZlFRrg5s[1].htm.3.dr, {2F918E46-561B-11EB-ADCF-ECF4BBB5915B}.dat.6.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/to/ZlFRrg5s
Source: {2A5BAC65-561B-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/to/ZlFRrg5s6MlCR0S0FT
Source: ~DFAAE8432BB923397E.TMP.6.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/to/ZlFRrg5sNUMBER_OF_PROCESSORS=4OS=Windows_NTPath=C:
Source: {2A5BAC65-561B-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/to/ZlFRrg5sRoot
Source: {2A5BAC65-561B-11EB-ADCF-ECF4BBB5915B}.dat.2.dr	String found in binary or memory: https://24mbw17feyn.typeform.com/to/ZlFRrg5sz
Source: renderer.0f5a683b381b67dbbf89[1].js.3.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: vendors~form.965f5dedbb854e83c6c8[1].js.3.dr	String found in binary or memory: https://github.com/kof/animationFrame
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://images.typeform.com/images/CJr828dpN5yQ/image/default
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://images.typeform.com/images/FYUps4mFKPYK/image/default
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://images.typeform.com/images/nXkRcNPp6wtg/background/large
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://images.typeform.com/images/nXkRcNPp6wtg/background/large);background-position:top
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/apple-touch-icon.png
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/browserconfig.xml
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/favicon-16x16.png
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/favicon-32x32.png
Source: imagestore.dat.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/favicon-32x32.png-
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/favicon.ico
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/safari-pinned-tab.svg
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://public-assets.typeform.com/public/favicon/site.webmanifest
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/blocks-matrix.0544beec0e1a4e11a24a.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/form.9cd5d6381506e5950fe0.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/modern-renderer.36eec26e0148023415c0.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/phonenumber.6ea5ec50b9fa21e816ff.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/renderer.0f5a683b381b67dbbf89.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~attachment.6e37d3fcdf703c1517e1.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~blocks-ranking.f8aee16223a106724ea1.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~form.965f5dedbb854e83c6c8.js
Source: ZlFRrg5s[1].htm.3.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~phonenumber.32d788474b661d4d3074.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.16:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.16:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.194.82:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.194.82:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.117:443 -> 192.168.2.22:49186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.93.100:443 -> 192.168.2.22:49190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.22:49195 -> 143.204.99.83:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.99.83:443 -> 192.168.2.22:49196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.218.160.124:443 -> 192.168.2.22:49198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.22:49202 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winXLSX@8/81@17/8

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$ACH WIRE PAYMENT ADVICE..xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD9EA.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2792 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://24mbw17feyn.typeform.com/to/ZlFRrg5s
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1336 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://24mbw17feyn.typeform.com/to/ZlFRrg5s	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2792 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1336 CREDAT:275457 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Stealing of Sensitive Information:

Steals Internet Explorer cookies

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\SOERHJ3M.txt			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\NT7KOKIT.txt			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.247.242.19	unknown	United States	23467	NEWRELIC-AS-1US	false
143.204.93.117	unknown	United States	16509	AMAZON-02US	false
143.204.93.100	unknown	United States	16509	AMAZON-02US	false
143.204.99.83	unknown	United States	16509	AMAZON-02US	false
162.247.242.21	unknown	United States	23467	NEWRELIC-AS-1US	false
13.224.194.82	unknown	United States	16509	AMAZON-02US	false
143.204.93.16	unknown	United States	16509	AMAZON-02US	false
34.218.160.124	unknown	United States	16509	AMAZON-02US	false

Contacted Domains

Name	IP	Active
d296je7bbdd650.cloudfront.net	143.204.99.83	true
api.segment.io	34.218.160.124	true
d2citsn5wf4j9j.cloudfront.net	143.204.93.100	true
d2nvsmtq2poimt.cloudfront.net	143.204.93.16	true
bam.nr-data.net	162.247.242.21	true
d2p6vz8nayi9a3.cloudfront.net	13.224.194.82	true
cdn.segment.com	unknown	unknown
renderer-assets.typeform.com	unknown	unknown
public-assets.typeform.com	unknown	unknown
js-agent.newrelic.com	unknown	unknown
images.typeform.com	unknown	unknown
24mbw17feyn.typeform.com	unknown	unknown

ID:	339280
Product:	CloudBasic
Start time:	19:45:47
Start date:	13.01.2021
Sample:	ACH WIRE PAYMENT ADVICE..xlsx
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	a66a202e970df086cc265cb646127bfb
SHA1:	c8986173e16bb9b0703490afba594ec5eef08a4a
SHA256:	e29c6206512f1f778f1af9a1ff2af2bb82107271e00c873930398b703294d75e
Filetype:	Excel Microsoft Office Open XML Format document (40004/1) 83.33%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MP98E46N\24mbw17feyn.typeform[1].xml	ASCII text, with very long lines, with no line terminators	0FEB2730BB671D5959C08F77BE66CF4A	5DB7D7C9EC5C5DB931FA6624482E08FB69037555	19CFA51B3B6934D53C847533DF49139D0C5AF5C1B4A1351B4255E2549AECCC7C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2A5BAC63-561B-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	9B65C8D0A9768FA070A9310B193973B4	C055021A3B92C23BD3F1649DE805173E4DF336C6	8A835104B4F77374BB30A85C0CA91CB7F9A14F7263157122DE2EDE76D55C469F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2F918E44-561B-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	2BF59D33A5BA926E2C81A2CAA3B5BBB6	BAC8C76A79EC5B834DBB4BD810CD615B818345AD	998E2E1AB325CCDCCF5659DFABF7DDB846E46D662FBA7C22E045AB172DCF99A8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2A5BAC65-561B-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	BCF9F322A70538FDFE44872D215EFC6B	C1E07B54867CBBEEEC03699996C19AD421C9ABBA	BAAE2DE265BD159D5AAB71AE0B63F4E78F05D466C971D623FE5F26E3DEE4BD41
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F918E46-561B-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	9D6D01F21F4B29D80E786D71B4A33863	762E9128F2B956E336BD0A67E964A5C347A06437	1858D45662FA489CF10AFC103939F36529F39E4DA1BC32402E41C93D449AE069
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F918E47-561B-11EB-ADCF-ECF4BBB5915B}.dat	Microsoft Word Document	4D84A24BCC58710983A8E4CD00046710	3FAF8FBF99524A026365F5F1B1DB686A820D121E	9FF5E9A1A023722C752D423D78058E5BCFFC7E5F866AEF11AF78CB555E6E0BD9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat	data	0452FFCA235E91B4C6683ABAD06495D0	0E14A20E117844570CE8F9707D1E81489C4BA382	B2849FCAB4A321D2833821D319F039A8567CB2E89C315559C4D45AEA70463AEC
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\analytics.min[1].js	ASCII text, with very long lines	C972CB2152B4CA69E1AD84AD369E5D49	2D408DC4AA2394089E145D4619793835A5745AB4	18FBDEDB7C4B401C5FFA1A76F429FEECEC9928679D485A0CE3F2EA90F709B61E
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\favicon-32x32[1].png	PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced	4A35A27936C43081F0865E2E603DF15D	A6D584D829C87EFF74C08F770CD2EF78EE75742E	DCAE3697C63FCB6AE03D2FD99FB96AF8B14848B71A259ED2E05DBCF5CEDEA5B2
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\form.9cd5d6381506e5950fe0[1].js	ASCII text, with very long lines, with no line terminators	DD7F1393ACBF039DA8D9970914488D42	6471C4824923D895CCE1D956F1D93CC6C57AB9EF	3DF9AAE60EBE3300471A343673C3771D554934DDA473CE495CD0539AEF8872A0
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ZlFRrg5s[1].htm	HTML document, UTF-8 Unicode text, with very long lines	92BFEB5A4D6E58793D2F220ED20BC99A	C40D4F3B5C3F9E1EE3F70C2B36D4575F4169C49D	BCC18DE8D008052D6BAD19E7EAF441443387FC0328A235901E3A337402607D7A
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\aa6e0ec721[1].js	ASCII text, with no line terminators	06DD80AEB628C60DC680BC7A4BEE6651	8C86EB7DDFF5E1E5D527BD7A41C9D3F6767E23E0	5E864C2E3F674C60970513411EAEEEAFD2D615D842E65EC01D09CCFCB4A7B38D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\favicon[1].ico	PNG image data, 16 x 16, 4-bit colormap, non-interlaced	9FB559A691078558E77D6848202F6541	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\large[1].jpg	JPEG image data, baseline, precision 8, 1920x1080, frames 3	0554F0D0A177ACFFDF74BD226B654D77	DB298AA8FA59397323F8ABC0D91E12F64E298988	FF6D65827CC40A27DCAE15A090D56D3FB38536A3B76A3ED62732C86EC6F05AB0
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\renderer.0f5a683b381b67dbbf89[1].js	UTF-8 Unicode text, with very long lines, with LF, NEL line terminators	0D4FA25B79D12FA4DFF120ACB7069AF8	A28C700592908992B0489B6CE9B269DDEC2860CC	BC722206827BE6DA76A00C5B6362D0663B14264B9AFD0AFA672FED1E7E20DA85
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ZlFRrg5s[1].htm	HTML document, UTF-8 Unicode text, with very long lines	92BFEB5A4D6E58793D2F220ED20BC99A	C40D4F3B5C3F9E1EE3F70C2B36D4575F4169C49D	BCC18DE8D008052D6BAD19E7EAF441443387FC0328A235901E3A337402607D7A
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\aa6e0ec721[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\aa6e0ec721[1].js	ASCII text, with no line terminators	06DD80AEB628C60DC680BC7A4BEE6651	8C86EB7DDFF5E1E5D527BD7A41C9D3F6767E23E0	5E864C2E3F674C60970513411EAEEEAFD2D615D842E65EC01D09CCFCB4A7B38D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\default-firstframe[1].png	PNG image data, 158 x 48, 8-bit/color RGBA, non-interlaced	7EDA9EC93D911B48A77B18FFAD77F7DC	1678B6CC7973C764289783D63A7797E1AE85DA99	00BAB0371C61890A7EEEF86A0C1F0E4F037861C02E78EB1BE127CA00288F91E4
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nr-1123.min[1].js	ASCII text, with very long lines, with no line terminators	7FFB242072196E9DB5F4F1BFBFA2ED7D	6CFD443F06C2D4E96E14765E045277B67DA0EEC5	94CDF5B7F868883DE0E1248CD80B42DD84E3F38685F2B234747550C02190DC82
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\LnkQ4hGmxTTD[1].png	PNG image data, 131 x 109, 8-bit/color RGBA, non-interlaced	9936A0F33BBE88F448A1E166B8CCD4A9	EBBE8544383B73EB0C8BA6733B3588F7781B5B23	B0CF2B3D20750F69559365B1926CA243502BE1E58EFBCB45E8315C943BE1BCDF
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\aa6e0ec721[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\default[1].png	PNG image data, 158 x 48, 8-bit/color RGBA, non-interlaced	7EDA9EC93D911B48A77B18FFAD77F7DC	1678B6CC7973C764289783D63A7797E1AE85DA99	00BAB0371C61890A7EEEF86A0C1F0E4F037861C02E78EB1BE127CA00288F91E4
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\urlblockindex[1].bin	data	FA518E3DFAE8CA3A0E495460FD60C791	E4F30E49120657D37267C0162FD4A08934800C69	775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vendors~form.965f5dedbb854e83c6c8[1].js	UTF-8 Unicode text, with very long lines	6F33B62669DF8B6E094E941BB2F1BB39	D2A46B58E82E30176BDAF55CD018FC89AB9F0C23	645A6486495927D9FC72EDF35C46B50C990F3DCED2101C79F753F6FA8EC11E16
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FD9543EC.jpeg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 816x1056, frames 3	89776C76604B8117DFD73CA3604286AB	097D88821166432D9C8EF52CF807353BCC34952F	5F43444269E5E9E7D1B94660AD93B9CCFED6622A1D415BDE414D478526A3F5D2
C:\Users\user\AppData\Local\Temp\~DF1438C06CD593C8C1.TMP	data	D6C02A79454EFEBF6F998C62FA1F44B8	24B1B3BBB9E9B8ADC27CCA3C47E73CD8B26BA2F3	F3AF504CDCFA3AA0DFA4DBE2CEC0197B09E1290F2C56DD7CF675321D8CB8A7FC
C:\Users\user\AppData\Local\Temp\~DF758405FF2DB93ED8.TMP	data	A55AE6B83B3E42D9033DB8941262BACE	15AFCFCC3891BAECADA47E88C2ECE126AF158E33	76C606B494E2F1784A624854F8AB255DDFE027332AD23976B0C00E4F9E1BCA68
C:\Users\user\AppData\Local\Temp\~DFAAE8432BB923397E.TMP	data	C3B66F74B903273FB75AB4EFB7EEFAEF	2CF9F5BA973CA1C7E9004DFA47B4115E26B5C950	31AC6AFEC3A95D167A123B808F12BBA8E38B0B1CD4CCB273EE154591B27374FC
C:\Users\user\AppData\Local\Temp\~DFB61A021F64F16CCB.TMP	data	652AC7B0CE5C73E17290B0727B4603D8	377B6BA360853D3EE6FEFE5159DC48B610AC01FC	5724AFF98E1686A857129639B03113869A0A3DE0606ED70EA2275964FD52C8BA
C:\Users\user\AppData\Local\Temp\~DFED3B607D918E1FC7.TMP	data	77CDC0D2A7A1E84FF61BA20E42DCA57A	BBF427D46B837C882D3448FA49E9ED01CD4415BE	F29BCA4AE8E70FE16FFF04D1D70BFF2A7ADE8EB1DF3AF0FE00A4E11CF250F77A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\0IVJZWGF.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\0M389YWH.txt	ASCII text	DB41E8AD01B95F42697D13A2A2CFA4FF	BB2594B78C16035820310432C75AD7458F246D14	4F94A7E3C52DDBEEC53B7E6EB61BBD1766067CDD1EE8886D9F8AAD3BDA3D63A0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\0ZAK4VQK.txt	ASCII text	0922553DB55B875A35E5BB6636D35680	38D37260B6566EE745CDF0DBCFF0E3A3C745F165	FB61D86BD124EC3850957D026C3B71DEFA0E987BCF056E9759C26ED386F54BD3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\20VGRT90.txt	ASCII text	40C1920BA013673688039D6EAE82C6E3	61324E4193F75471A29F591C12E141793FA87D75	3D159707EF26F226857520AE889EE6FE0338891B3F307D3BCBF8272885E3AEFB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\20ZR2Y7K.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\2JSRVNIO.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\3I7TV12Q.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\3TOYTGUQ.txt	ASCII text	D555E1AD74D72DB2A2D19179673CEA99	1009ED6DA8B48B52C9839FB2C2F61DCF16691B71	407A1B3CFEBC0D8BA56B5DF4D03C5E08B956C14E85DF04351B74A9C9B7969B10
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\61WDY4FD.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6JXJQNR2.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6OV9DG0T.txt	ASCII text	0AD62076DA5374AF0B01C8CC93EA4DF6	16F7A5FCB39F95A66FD6D3CE8608B34DCBB30AE4	B3ABC6C2AE3A694CF11FE827AFBBCD9217655C5BAC48B290EEDE91B71B5EC9FF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\8KKQ3SO9.txt	ASCII text	801603A0070532B2201FDC45343A2337	0454A868C6EBCC43966345C9058C241B252BCE50	A4131791D476D56A571D93F52BE1D4E2EB43E593828879DB1090AE7123C75661
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\8TA4U5CQ.txt	ASCII text	88CF2B5F9EB402F5AE1772BBAA2E97CC	5183725DDCF59A0DCBB08EFB1518BFA238059899	F03D57E2FC6DB2C949FE31833FE7B8D3F974F504D3BC6691F7C685ED02B52295
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\CDYV1254.txt	ASCII text	C89EB5CE2CB90FA694F8F801A66D0A6C	3B2504C547FAACC09081036E1EA098FBD9EEE209	34CD01677BD830188A0500C3D6A76DBC586B232A80562C1B5142C9406B71A8B1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\CJCZ07BY.txt	ASCII text	30A11F812167CDA15D41435790E280A5	E30AF84CEF31E8A9659F28517E24020B3B9856AE	ABDB8DA7C1392D7E5CC952DED660D8F10394B00CAB8D276D36063FABC2B80661
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\DFX1YDJF.txt	ASCII text	B5A4C720F4C2CE34E28E41543F889DF6	B7D8C8E323032F85D8FFD5E51901B0F6750CE9E9	61108A610490B749211B5ECEC8FC0A09219CD4100C2FE9F522A339F8510A1B94
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\EUI3WW1C.txt	ASCII text	4C544802ED616B137FFA4686ADC427D5	3400FC82D955020C60DDD7A801C3BCF50E9A20B0	3D568AF31C8DF45853CF78BD512820E1378EC124C28C79BAA447946B88E4068E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FO0K0RAI.txt	ASCII text	95EDA434ED981A9197227DE82435E323	6F81601EC4DF276EFC88EA8FED79E83C4DC92ACA	181B3644BB8D88004157BD701E9D77F177E6B9F8013AA34F2CFD30A0D3E8CF71
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\HGL2IKT9.txt	ASCII text	6CAA692953BF0C8F2CDF6B8B6402190E	837A1F2A30116612C5738FA6017CA5574D92699C	901271A3EFC68EDA24E691957BD8C6A61CA4ABCD259DF1FE54A1850CC1D4E543
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IDC3M5RT.txt	ASCII text	D2E58225E79F0EBACBB7CD7D511F2BF7	087B765055F1ADBB4735EA0A5EEC970F1B0F3884	025F65F057D476E03035D34A4404D6D10E6650F8D712A9B154FEF274A4288F0A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IK6H81ZK.txt	ASCII text	68E0E2F3A41400708B15B8FE09419B57	45FA50F6F46126B4117E70E99F7E8AA25752DF64	924DA37A89EA34F37788F531A365DB7ED3C6BA548C8E9368AE6BCA1F6B60164B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IL8SJ34U.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IPFZMVJQ.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IT4P7ORN.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\J1D31LDS.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\KG6F2H5K.txt	ASCII text	650317DE8FA8710007CD91445B6BF873	DE995C9C175F0969096DE0F3E4ACAE68C013BADD	AD303F135E4D77FFC15E0184AD85636CED956675D158128D2CAD36EAC7C24E78
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\LFP879B1.txt	ASCII text	45CBEE475BDBBD880681109858D83994	F99C804EB5FCCEDB2ABA7AB9EA8564BC332E2817	84CF9DBCA2B7544B54D0F91BA2E7E59568F0133247D8B9E0D30F21D300B2B56A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\MOMILS89.txt	ASCII text	06C3FD56EC18A7E05E4CC459BD6E631F	571DFA2D95FB17C4E9A78919EEC6F0477071B3ED	8B982FFEA4270BC3A996F0CE5DFA0B9C0B8C9BBA94F7398CC605232AC5D8692C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\MTREOOEZ.txt	ASCII text	8DE66F3A726934A10B7755CCB5D67670	D8D4D9CF1307CA728E865E16E0624A0D413249F1	9D2E86ED8A6DA5E6662C5CA4AB675323C658A0B90BDFE84485D7C24806F2D6EA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\NRHJVC8T.txt	ASCII text	E81D734B1FCBDFE55507D930748AECFF	2D5E93066F521D149385E516A155A847678E4207	EE9C70EEC2D6D993DFF3B4E4DCD4B184A31F1D626E37D2A482BB61515186FEF5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\NT7KOKIT.txt	ASCII text	144F167F8140D782EEDCAC5AD7986EBB	3972297227497D63BF1873E7D6643202C3CD87CA	997FA2BBEF23350325C03CEB3D4B46C428D59ECA277D013297CF34CB2222997E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\NXN0QX3L.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\O325M35W.txt	ASCII text	1A14E55B8CA406624DEC70B1F98EC3B8	93898C5433EC0652968B69741E029BF145FCD700	D5F5AC97BD8F98F77FA81A3B226453CAEE69DDF63CB8DFF3AD68B85C1B8E7F4C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\O5WLZZI9.txt	ASCII text	EB33756BC4FC7CDBEF016A7E562003DB	4DC0A0FC0D315B6C855A5103C06DC4D42E946766	367AB5B0512907D1D16B6EF6C1BF4F99E029884AB7B4E97FC8C683B2EDBEC42E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\PJ2O3HFW.txt	ASCII text	5F8A4B5C600E6D1690A3B4D16E1A355C	8FEE60E6D59A7BDE8D4CCC538D23EFC8A117E52C	3E643CDF576F0548AA6CB8094AF8A64B250F0BDC03AA6AF5669D1BA9D1D072F6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\QBDTY3Q9.txt	ASCII text	3EF0339F03A4425295164DDA3DDE1368	FC51C7C6507F1D16C1EBB6C8FE7FDF769FE2ACCC	85C9EFFDEBEEE1748FBBD2ABDAEA75D3829C54A994C918C613B9B85C5C83AFBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\QCLD38DA.txt	ASCII text	CC7CF5FC648D0D1598ADA57A94434AA5	9468812ECA51CE66D876144B14DB5A46CDE34FF6	5BE4D947522CB9A23CE114D9BBB51967610EDEEE748685FFC1446352A3A1633C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\SBLHQOIP.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\SOERHJ3M.txt	ASCII text	97A8EF10C7F9DC9D25DDE34BEDDCEDF9	8344C01FD0CF93A10E6EC8C502AFC4D28A57DDB5	57889D868D75B6C3F2C3299190D46F6803AEA9626226E117332310D17DD3333F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\T3CDDEHF.txt	ASCII text	9AC6374B69A83CBFC51587D9D4F2076B	51E784F69944965EE559D967132050EFE29DD8D0	F154CF5DB3D7931ED46B50488ED7569FDA1ED1210811017AC29F18B5EB4E8760
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\U74ZC1PI.txt	ASCII text	2BFF1F65355783A1531F2C4DC19F8DA7	914850697BE1AA8D7743414EED9BD35F8D49EC77	913E31FBEFEC5B23E5A8141BC20083168B06296A30CAF3E313142F7FBB20C4EC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\UX73PCEA.txt	ASCII text	90F2935C33A6FA3DC44213C761D40BF4	1A0E0E7ED14913B5AF3CCB497F8F310083142258	C8F156C7DC5AF032A4B7FC3A263570713AF835721DC7F739D6DFCF320AE85E7F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\W26Z2KXF.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\XFXUYCDI.txt	ASCII text	A2A35411BD766F80A28E513D79EE0924	28681FD35C19C7ABE930227711C09299CA41DA88	17A467F744B342D256DA03BF4D260A63B974220D1A99235A8E38B95F2127AF07
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Y04L61FE.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\YV9AB3P8.txt	ASCII text	E1162312D687B46C9B53B353DE16E301	E78B37F7DE9DC22A46CC6DDACDA895DE5D178BD3	B5E571F7AD99AB715E44509F09F6AF8298BADB5A1ABC7A33929F5E5E88E926B5
C:\Users\user\Desktop\~$ACH WIRE PAYMENT ADVICE..xlsx	data	797869BB881CFBCDAC2064F92B26E46F	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185

Analysis Report ACH WIRE PAYMENT ADVICE..xlsx

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Stealing of Sensitive Information:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains