Analysis Report http://documentacion.60dias.es/lnk/AVIAACm_cEQAAAAAAAAAAB6ZWikAAAAAgOgAAAAAABJ-HQBgbHJFvpOzd7scSXmYtVyi79wxlgASfcc/1/hBWVctP4hxzhfBA9nSlUsA/aHR0cDovL2Nsb3VkLjYwZGlhcy5lcy8xMTIwMDI0X0VTRC56aXA

ID:	383854
Product:	CloudBasic
Start time:	11:15:54
Start date:	08.04.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{92649B59-9896-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	BAFD8CE7F977A127DC8DF7735B1FA0C6	8EBCA182E78BDB7ED3464EC451BE93039DE349E3	9CE7CC4D97F8975D382421392E41BBAA21916CCAD99FEE0312E4B1BE921590C5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{92649B5B-9896-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	55408A616D032EC2BAEBC67F8A46B1BC	5C5BFA2BE177EB83FE16BB8D1298E15651583CD9	8EFB6611392217B99A0130C2E26A5BBEC212CB5439BB1A07A8D7ED389F206953
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\375DF51C-7AC3-4B35-ADE9-1C422A5A55E3	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	C35AD0D78A2E5A001BE2183BA5E728F0	23A7BF04785B54A19496C7ED5BAB49DEFE4B71EE	C00A40FE675BB59EEA14C338C3378A18DE0F7291F18A19BFAB1CEBEA9C57A39C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip.cseatb3.partial	Zip archive data, at least v2.0 to extract	82A8C1FEDF90AE88314025CFFE5B7C8D	196CBE3301460F6801D0B1E9838A4CB8A4D637BB	FB60A4714CCFDD1A695C195EBFDC08020BA2D7362FEAC1C11024E20855440B7E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip.cseatb3.partial:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip:Zone.Identifier	very short file (no magic)	ECCBC87E4B5CE2FE28308FD9F2A7BAF3	77DE68DAECD823BABBB58EDB1C8E14D7106E83BB	4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\1120024_ESD[1].zip	Zip archive data, at least v2.0 to extract	82A8C1FEDF90AE88314025CFFE5B7C8D	196CBE3301460F6801D0B1E9838A4CB8A4D637BB	FB60A4714CCFDD1A695C195EBFDC08020BA2D7362FEAC1C11024E20855440B7E
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	AA006BDBC1A45FFB85C77EFC79115611	0DE7130D603D2FE2089BA8F35BD3B135AE0D85A4	49804E9D6724495103C54688B2A3B0B43AC0D67FF39A7AD52CF0C9562C0FE985
C:\Users\user\AppData\Local\Temp\hygsnpb1.55n\unarchiver.log	ASCII text, with CRLF line terminators	06EED8AE46D17A9E0F69C1918F9AC38D	CAF8FE2484123EFAF19E1458D7563C28CE53DFD1	5DB24CB3455BD5041E61D87D7F03358EDE5D9B672999D585EE927F4FFB795805
C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\Factures\1 Factures COCA-COLA EUROPEAN PARTNERS FRANCE SAS.pdf	PDF document, version 1.7	AE1942278A9A157EF66F5599BB3E4AC8	52F3B2101E313977B4D0F8027A68BCC5FC2ECCD8	160E8A4F9122E9B5CD1EA71174FD42F0393DA4CEE781DB5E7E6E0628F7EA1EDC
C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx	Microsoft Excel 2007+	EC6A2AB4335324D9AC84A48D727AF309	F60016CE04AD0A7E8424170DE3C8BFD2BC56014A	BBF7DC3A26976F24A7B0AAB134C731A0BF8C07D5A832F754030B28318B1ACE79
C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\~$Resumen.xlsx	data	7AB76C81182111AC93ACF915CA8331D5	68B94B5D4C83A6FB415C8026AF61F3F8745E2559	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
C:\Users\user\AppData\Local\Temp\~DF7E4AA346A5DB6382.TMP	data	DA1E54D46190105455BAC95FB7226435	36533109E5D1CC8989ED9D81EBF19E9F7CE83131	861F5A0ED1849D46C2CFC083DD1EB1F25367DA6FCFB23EFC73AF87F933FC56C2
C:\Users\user\AppData\Local\Temp\~DFDAD61727858C742C.TMP	data	275256C01F1FC6727BC4EB35F5B5972D	D49F08ED06579E00F5670B3DB939661805959E4F	0EA5F9BDAC03F56134C811D35981FA7F6DA7A12B94CACC8923B54A302938BA3E

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Spreading:

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\			Jump to behavior

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0296099Bh		6_2_029602A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 0296099Ah		6_2_029602A8

Potential browser exploit detected (process start blacklist hit)

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\SysWOW64\unarchiver.exe

Networking:

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /lnk/AVIAACm_cEQAAAAAAAAAAB6ZWikAAAAAgOgAAAAAABJ-HQBgbHJFvpOzd7scSXmYtVyi79wxlgASfcc/1/hBWVctP4hxzhfBA9nSlUsA/aHR0cDovL2Nsb3VkLjYwZGlhcy5lcy8xMTIwMDI0X0VTRC56aXA HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: documentacion.60dias.esConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: GET /1120024_ESD.zip HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: cloud.60dias.es

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: documentacion.60dias.es

URLs found in memory or binary data

Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.aadrm.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.cortana.ai
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.office.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.onedrive.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://augloop.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cdn.entity.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://clients.config.office.net/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://config.edge.skype.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cortana.ai
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cortana.ai/api
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://cr.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dev.cortana.ai
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://devnull.onenote.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://directory.services.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://graph.windows.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://graph.windows.net/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://lifecycle.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://login.windows.local
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://management.azure.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://management.azure.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://messaging.office.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ncus.contentsync.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://officeapps.live.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://onedrive.live.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://outlook.office.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://outlook.office365.com/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://settings.outlook.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://staging.cortana.ai
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://tasks.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://wus2.contentsync.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 375DF51C-7AC3-4B35-ADE9-1C422A5A55E3.12.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 6_2_029602A8

6_2_029602A8

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\cmd.exe

Section loaded: sfc.dll

Jump to behavior

Classification label

Source: classification engine

Classification label: sus25.evad.win@14/14@2/2

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1968:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_01

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFDAD61727858C742C.TMP

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4272 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip'
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip'
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4272 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip'			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip'			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Run

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\cmd.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Source: C:\Windows\SysWOW64\cmd.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3564	Thread sleep count: 177 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3564	Thread sleep time: -88500s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Contains functionality to query system information

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 6_2_00E9B042 GetSystemInfo,

6_2_00E9B042

Enumerates the file system

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\			Jump to behavior

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects files into Windows application

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Injected file: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx was created by C:\Windows\SysWOW64\7za.exe			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Injected file: C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx was created by C:\Windows\SysWOW64\7za.exe			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1120024_ESD.zip'			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\zk1enajm.gxo\1120024_ESD\xls\Resumen.xlsx'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /dde			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: unarchiver.exe, 00000006.00000002.476739953.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: unarchiver.exe, 00000006.00000002.476739953.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: unarchiver.exe, 00000006.00000002.476739953.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: unarchiver.exe, 00000006.00000002.476739953.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior