Analysis Report http://covid19vaccine.hopto.org/new.xlsx

ID:	365417
Product:	CloudBasic
Start time:	15:12:26
Start date:	09.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{03D92598-812D-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	BFA61E073A013D54B2999FAD41FCCBAC	9E55604BBE8CDEA698E5DA3E60D6D36562484751	14655D6E4E9069FE350DDC9B23346FCBA5C870400BD00DD1C0519B7DD7C38217
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{03D9259A-812D-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	8C5B67F49F8E3D245F69B88EFCEC8FE4	38932AF71DE479E4692FCFA115A38C0C74835536	8DD105833017ABD7C01519E284AC128C38E73277BBAF213C6E8832A883625E0C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0DBE67A1-812D-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	B25EB353F675B1CCC977ED941E5F378E	346E95A5C84359D67614F364AE1CBDDB1B157F98	AA537E0D2A7B9616A6D28850784931316C72B6E60DED872DB5CC44609E23166E
C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb	data	E1A2214070C982E66B59D8F94CF48888	ADA7D6F3EB3BD9F7B0E37D5DE9D34597ECB0030A	29B6D254733F8EB3B2547CABD6E864CE50845BA33B648B4886A905E62C777C91
C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini	data	1F830B53CA33A1207A86CE43177016FA	BDF230E1F33AFBA5C9D5A039986C6505E8B09665	EAF9CDC741596275E106DDDCF8ABA61240368A8C7B0B58B08F74450D162337EF
C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb	data	3244B7E4BBA73F22865AA7A2C4DFEFE3	DF369D2C17D9B4A4AE2E0168DB2DF20F8C28D4B7	D1DE38D56CD5D71F94105AA8B52CF5A2AA1FB224F8C531DE3D8DD569183A9896
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E74F5F17-DC91-4EA1-89CD-4C485BA65FE2	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	1A5A63A8A853308DE67F78413C71E377	3C0FFD99AA18E3D86F4011CDCAB0AEA7F5FDC978	931BAC6D40A811748C9FA54B5D0A10C6C7BC7740EE37E06F0E06F56491854865
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1734685F.png	PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced	208FD40D2F72D9AED77A86A44782E9E2	216B99E777ED782BDC3BFD1075DB90DFDDABD20F	CBFDB963E074C150190C93796163F3889165BF4471CA77C39E756CF3F6F703FF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1A3C9969.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	052BC85A55B7568EF566115374AC8389	35EAA71579443E84C22F301B20CC9054E2C2C457	2BB630453D0F8AF075AF719E2A498875E82E66A9BB93410B3F9D91A49A379A16
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\408626D4.jpeg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 433x116, frames 3	60CD11F234818D75CC569B1729C45695	01449AFC0887AB133764C84EA9C5CC9A1C67BEA7	4559DD7CA810FC9C12B9D3FB4958867E2CAA399661EDC0CA7F8EB1B01B51C274
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\58FD3802.tmp	CDFV2 Encrypted	3E4C88072D1B2BE5FB2B8798569E12A4	57B6810605996A7476E01428BC1CF2B1D078C129	11E061E90A3EBAC7A4478EAF00941612355D7C10A510C5100F3D5A6689950787
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\705DCD08.xlsx	CDFV2 Encrypted	3E4C88072D1B2BE5FB2B8798569E12A4	57B6810605996A7476E01428BC1CF2B1D078C129	11E061E90A3EBAC7A4478EAF00941612355D7C10A510C5100F3D5A6689950787
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7574A056.png	PNG image data, 1686 x 725, 8-bit/color RGBA, non-interlaced	16925690E9B366EA60B610F517789AF1	9F3FE15AE44644F9ED8C2CA668B7020DF726426B	C3D7308B11E8C1EFD9C0A7F6EC370A13EC2C87123811865ED372435784579C1F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\84FC70C5.png	PNG image data, 712 x 712, 8-bit/color RGBA, non-interlaced	5ACDB72AF63832D23CED937B6B976471	BC754ECEF3BEC86C6AFCC1AF644190AAFC34D9B7	6D73F61D9E2A5E01DEE491E4E1F8600E0409879B86DB69B193CCF31CFD517DF3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\navcancl[1]	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	4BCFE9F8DB04948CDDB5E31FE6A7F984	42464C70FC16F3F361C2419751ACD57D51613CDF	BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\new[1].xlsx	CDFV2 Encrypted	3E4C88072D1B2BE5FB2B8798569E12A4	57B6810605996A7476E01428BC1CF2B1D078C129	11E061E90A3EBAC7A4478EAF00941612355D7C10A510C5100F3D5A6689950787
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	7D6293CE6E6EEED8EB71759FEF988094	59BBEC78A66D1A907E884F9EBEB4F9923FA74DED	C0F15722C10506DE67CBE81B49630BD90C2EAFFACBD9C9F307D746414F1133C8
C:\Users\user\AppData\Local\Temp\~DF1D7596480EE11CB0.TMP	data	0952478B45F3C900D8EE31DD93A65603	445544934E9F0CFCAB41E000F4A10A79D534EDFC	C2C82F8963E96B5BFD17709770CB2FEF2712CB3FCB1BB231A06BA0BC6A78A3A4
C:\Users\user\AppData\Local\Temp\~DFBF46033416D08F0A.TMP	data	E52C3997C88D5A02E777116EF77FA728	5A4CA19E4D345ADDCE22E84215395F387CF5CBB3	2726227E3CEE58E145761454F7EDA4C0CD4A4A30842A3015D22C39A345190B37
C:\Users\user\AppData\Local\Temp\~DFEEFA64FCDCD02473.TMP	data	FB84E74C5861C33D808C729E9C664DEB	6DFE1B0ADBF07035FD18B8B6306759F58E60E934	7EE577F7A9AD22B32C317EFB2C684B1CF74CBC767D9E3A03B49AD0061E3E7C18
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\covid19vaccine.hopto.org.url	MS Windows 95 Internet shortcut text (URL=<http://covid19vaccine.hopto.org/>), ASCII text, with CRLF line terminators	F071EDABDD1FDC6466EA784E0563F42E	D4EEE08C4E9F6BE2D684B4A7A89F8714A7F96F16	C6C7E1E94AA2C512BC2920B4773AEFE6F9C94533B27F3B674D74DC373ABABA28
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	A9E5A9076BCF310606B680DE5502451F	8B409C7717FE6FE267217CC3C6141042303ACFBA	9FF0496E02D1FFA4413A8431EE925C58F43DF6E8AFDF1235B847F7A61C508E93
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\new.xlsx.url	MS Windows 95 Internet shortcut text (URL=<http://covid19vaccine.hopto.org/new.xlsx>), ASCII text, with CRLF line terminators	2B5E2F2288C7D8D8520B92E91938FD92	1380300B6AED00DF3DBBEA189FDB354118609E1A	B7728753F9F7F990FE9FD3CCF4849BF4458C31FDEC1344D869CFBB1C74C7D03D

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: http://covid19vaccine.hopto.org/new.xlsx

Avira URL Cloud: detection malicious, Label: malware

Multi AV Scanner detection for domain / URL

Source: covid19vaccine.hopto.org	Virustotal: Detection: 13%			Perma Link
Source: http://covid19vaccine.hopto.org/	Virustotal: Detection: 13%			Perma Link

Multi AV Scanner detection for submitted file

Source: http://covid19vaccine.hopto.org/new.xlsx

Virustotal: Detection: 15%

Perma Link

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Software Vulnerabilities:

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 1MB later: 102MB

Networking:

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /new.xlsx HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: covid19vaccine.hopto.orgConnection: Keep-Alive

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: covid19vaccine.hopto.org

Urls found in memory or binary data

Source: covid19vaccine.hopto.org.url.4.dr	String found in binary or memory: http://covid19vaccine.hopto.org/
Source: ~DFEEFA64FCDCD02473.TMP.2.dr, new.xlsx.url.4.dr	String found in binary or memory: http://covid19vaccine.hopto.org/new.xlsx
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 1A3C9969.emf.4.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.aadrm.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.cortana.ai
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.office.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.onedrive.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://augloop.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cdn.entity.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://clients.config.office.net/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://config.edge.skype.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cortana.ai
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cortana.ai/api
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://cr.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dev.cortana.ai
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://devnull.onenote.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://directory.services.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://graph.windows.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://graph.windows.net/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://lifecycle.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://login.windows.local
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://management.azure.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://management.azure.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://messaging.office.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ncus.contentsync.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://officeapps.live.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://onedrive.live.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://outlook.office.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://outlook.office365.com/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://settings.outlook.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://staging.cortana.ai
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://tasks.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://wus2.contentsync.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E74F5F17-DC91-4EA1-89CD-4C485BA65FE2.4.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Tries to load missing DLLs

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE

Section loaded: sfc.dll

Jump to behavior

Classification label

Source: classification engine

Classification label: mal64.win@8/24@3/2

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBF46033416D08F0A.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads the hosts file

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4868 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4868 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe			Jump to behavior

Writes ini files

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE

Registry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation			Jump to behavior