IOCReport

Coronavirus pandemic.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A354DBD0-A08D-422F-90A3-E85F18D7B7BE

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{099D4456-906F-4297-A267-395210B4A021}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B6869D89-96E9-49F0-B15B-63F168951986}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\mso6491.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Coronavirus pandemic.docx.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:41 2020, mtime=Wed Apr 7 16:44:32 2021, atime=Wed Apr 7 16:44:30 2021, length=15421, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\Desktop\~$ronavirus pandemic.docx

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B4CD7CC3-97C0-4A14-814E-1968BCE52029}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FDB545E2-A1F4-4D0B-9DE9-98A3C665B689}.tmp

data

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

}36

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

~36

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

e56

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Properties