Play interactive tour

Edit tour

Analysis Report Current-Status-062021-81197.xlsb

Overview

General Information

Sample Name:	Current-Status-062021-81197.xlsb
Analysis ID:	432839
MD5:	1ac719c744d22f42e4978e7b55828435
SHA1:	4ddc7358f615987bf92ed9192430693db65b097c
SHA256:	d9be275feff4b3383821b1483ba93424fb27aa40e138da41a91511193d9538cb
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (drops PE files)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Contains functionality to create processes via WMI

Creates processes via WMI

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found abnormal large hidden Excel 4.0 Macro sheet

Machine Learning detection for dropped file

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara detected Xls With Macro 4.0

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 7076 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

WMIC.exe (PID: 2460 cmdline: wmic process call create 'C:/Users/Public/SettingSyncHost' MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SettingSyncHost (PID: 1808 cmdline: C:/Users/Public/SettingSyncHost MD5: 526D56017EF5105277FE0D366C95C39D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
app.xml	JoeSecurity_XlsWithMacro4	Yara detected Xls With Macro 4.0	Joe Security

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: wmic process call create 'C:/Users/Public/SettingSyncHost', CommandLine: wmic process call create 'C:/Users/Public/SettingSyncHost', CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7076, ProcessCommandLine: wmic process call create 'C:/Users/Public/SettingSyncHost', ProcessId: 2460

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: injuryless.com

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\Public\SettingSyncHost	ReversingLabs: Detection: 17%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	ReversingLabs: Detection: 17%

Multi AV Scanner detection for submitted file

Show sources

Source: Current-Status-062021-81197.xlsb

Virustotal: Detection: 8%

Perma Link

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	Joe Sandbox ML: detected
Source: C:\Users\Public\SettingSyncHost	Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 95.142.44.93:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.178.169.243:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.178.169.243:443 -> 192.168.2.4:49739 version: TLS 1.2

Source:	Binary string: C:\Work\Downloader\Downloader\Release\Downloader.pdb source: SettingSyncHost
Source:	Binary string: C:\Work\Downloader\Downloader\Release\Downloader.pdb5 source: SettingSyncHost, 00000005.00000002.1526209189.00000000003C8000.00000040.00020000.sdmp

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003CCEB0 FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003EA7D5 FindFirstFileExW,

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: logo[1].png.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wbem\WMIC.exe

Source: global traffic

DNS query: name: pigeonious.com

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 95.142.44.93:443

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 95.142.44.93:443

Source: Joe Sandbox View

ASN Name: VDSINA-ASRU VDSINA-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003D7CF0 InternetReadFile,

Source: unknown

DNS traffic detected: queries for: pigeonious.com

Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.office.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://augloop.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cdn.entity.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cortana.ai
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://cr.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://directory.services.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://graph.windows.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/.7.3.11.3.6.1.5.5.7.3.22.23.140.1.2.11.3.6.1.4.1.44947.1.1.11.3.6.1.5.5.7.3.
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/11.10.3.41.3.6.1.4.1.311.10.3.12
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp, SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588.
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588/3
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA15881
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA15887
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588G
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588I3
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588Z
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588id=124406_ECF4BBEA1588
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588m
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588m2
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/?id=124406_ECF4BBEA1588z2
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/X
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/icies
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/id=124406_ECF4BBEA1588
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/id=124406_ECF4BBEA1588p
Source: SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	String found in binary or memory: https://injuryless.com/rosoft
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://login.windows.local
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://management.azure.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://management.azure.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: hats.xml	String found in binary or memory: https://pigeonious.com/img/logo.png
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://store.office.com/addinstemplate
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://tasks.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://templatelogging.office.com/client/log
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 95.142.44.93:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.178.169.243:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.178.169.243:443 -> 192.168.2.4:49739 version: TLS 1.2

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 8	Screenshot OCR: Enable Editing" " and then "Enable Content" button. 22 23 24 25 26 27 28 " " 29 30 31 32
Source: Screenshot number: 8	Screenshot OCR: Enable Content" button. 22 23 24 25 26 27 28 " " 29 30 31 32 33 34 ConMecmal j 2021 US

Contains functionality to create processes via WMI

Show sources

Source: WMIC.exe, 00000003.00000002.671294038.0000000002DB0000.00000004.00000020.sdmp

Binary or memory string: C:\Users\user\Documents\C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create 'C:/Users/Public/SettingSyncHost'C:\Windows\System32\Wbem\wmic.exeWinSta0\Default=::=::\=C:=C:\Users\user\DocumentsALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=QFAPOWPUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows

Found abnormal large hidden Excel 4.0 Macro sheet

Show sources

Source: Current-Status-062021-81197.xlsb

Initial sample: Sheet size: 480182

Office process drops PE file

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\SettingSyncHost			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png			Jump to dropped file

Source: C:\Users\Public\SettingSyncHost

Process Stats: CPU usage > 98%

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003E40F0
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039D0D3
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003AA133
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003E7204
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039D4A5
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A9526
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D8570
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003CE5D0
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003F170D
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003ED7BE
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003B17A0
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A57E8
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039C8A0
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039D88D
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003F4883
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003AA8DB
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003F49A3
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A8A86
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D3AC0
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A9BB9
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A7C9A
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039CD35
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003DBD60
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003DED5B
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D8D40
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A9E34
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_00395E1E
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003EFE99
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003A8FD5

Source: Joe Sandbox View	Dropped File: C:\Users\Public\SettingSyncHost 28F2FA4F9AC95C3FC906E201B758D56C6A888B657DCF57C351A4F34FFB3E0FE2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png 28F2FA4F9AC95C3FC906E201B758D56C6A888B657DCF57C351A4F34FFB3E0FE2

Source: C:\Users\Public\SettingSyncHost	Code function: String function: 0039A560 appears 45 times
Source: C:\Users\Public\SettingSyncHost	Code function: String function: 003D9730 appears 55 times

Source: classification engine

Classification label: mal100.expl.evad.winXLSB@5/8@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:352:120:WilError_01

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{3950737C-20D7-4D17-885E-2145A276803C} - OProcSessId.dat

Jump to behavior

Source: C:\Users\Public\SettingSyncHost

Command line argument: P(:

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\Public\SettingSyncHost	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\Public\SettingSyncHost	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Current-Status-062021-81197.xlsb

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create 'C:/Users/Public/SettingSyncHost'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\SettingSyncHost C:/Users/Public/SettingSyncHost
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create 'C:/Users/Public/SettingSyncHost'

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Current-Status-062021-81197.xlsb

Initial sample: OLE zip file path = xl/media/image1.png

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Source:	Binary string: C:\Work\Downloader\Downloader\Release\Downloader.pdb source: SettingSyncHost
Source:	Binary string: C:\Work\Downloader\Downloader\Release\Downloader.pdb5 source: SettingSyncHost, 00000005.00000002.1526209189.00000000003C8000.00000040.00020000.sdmp

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_00391070 LoadLibraryA,GetProcAddress,GetProcAddress,

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003FC0E5 push esi; ret
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003C8149 push eax; ret
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003C81C8 push eax; ret
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_0039A5A5 push ecx; ret
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003F5CA5 push ecx; ret
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003FAF39 pushad ; iretd

Persistence and Installation Behavior:

Creates processes via WMI

Show sources

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\SettingSyncHost			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\Public\SettingSyncHost

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\SettingSyncHost			Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\Public\SettingSyncHost

Jump to dropped file

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003DAAF8 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\Public\SettingSyncHost

Code function: GetAdaptersInfo,GetAdaptersInfo,

Source: C:\Users\Public\SettingSyncHost

API coverage: 7.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003CCEB0 FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindClose,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003EA7D5 FindFirstFileExW,

Source: WMIC.exe, 00000003.00000002.672546333.0000000003280000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW/
Source: SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: WMIC.exe, 00000003.00000002.672546333.0000000003280000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WMIC.exe, 00000003.00000002.672546333.0000000003280000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WMIC.exe, 00000003.00000002.672546333.0000000003280000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\Public\SettingSyncHost

Process information queried: ProcessInformation

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_00399082 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_00391070 LoadLibraryA,GetProcAddress,GetProcAddress,

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003E105A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_00391FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003EA4CE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_00391FE0 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003A045E VirtualQuery,GetModuleFileNameW,GetPdbDll,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D9ABA SetUnhandledExceptionFilter,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_00399082 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003DE083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003B024E SetUnhandledExceptionFilter,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D94F2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_003D9957 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\Public\SettingSyncHost	Code function: 5_2_00393C21 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: Yara match

File source: app.xml, type: SAMPLE

Source: SettingSyncHost, 00000005.00000002.1526637809.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: SettingSyncHost, 00000005.00000002.1526637809.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SettingSyncHost, 00000005.00000002.1526637809.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SettingSyncHost, 00000005.00000002.1526637809.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003D9776 cpuid

Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,
Source: C:\Users\Public\SettingSyncHost	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\SettingSyncHost	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\Public\SettingSyncHost	Code function: EnumSystemLocalesA,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,
Source: C:\Users\Public\SettingSyncHost	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: __crtGetLocaleInfoA_stat,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,
Source: C:\Users\Public\SettingSyncHost	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,
Source: C:\Users\Public\SettingSyncHost	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\Public\SettingSyncHost	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoA,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\Public\SettingSyncHost	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,
Source: C:\Users\Public\SettingSyncHost	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,
Source: C:\Users\Public\SettingSyncHost	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoA,___ascii_strnicmp,__tolower_l,__tolower_l,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,
Source: C:\Users\Public\SettingSyncHost	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,
Source: C:\Users\Public\SettingSyncHost	Code function: GetLocaleInfoA,
Source: C:\Users\Public\SettingSyncHost	Code function: EnumSystemLocalesW,
Source: C:\Users\Public\SettingSyncHost	Code function: EnumSystemLocalesW,

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003930E0 GetLocalTime,@_RTC_CheckStackVars@8,

Source: C:\Users\Public\SettingSyncHost

Code function: 5_2_003CBF90 SHGetFolderPathA,GetUserNameA,GetComputerNameExA,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	Application Shimming1	Application Shimming1	Disable or Modify Tools1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting1	Boot or Logon Initialization Scripts	Process Injection2	Deobfuscate/Decode Files or Information1	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Scripting1	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution33	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery24	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Command and Scripting Interpreter2	Network Logon Script	Network Logon Script	Masquerading121	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection2	Cached Domain Credentials	Security Software Discovery121	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Network Configuration Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Current-Status-062021-81197.xlsb	8%	Virustotal		Browse
Current-Status-062021-81197.xlsb	2%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	100%	Joe Sandbox ML
C:\Users\Public\SettingSyncHost	100%	Joe Sandbox ML
C:\Users\Public\SettingSyncHost	17%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	17%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
injuryless.com	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Virustotal		Browse
https://ofcrecsvcapi-int.azurewebsites.net/	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588/3	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588z2	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://injuryless.com/rosoft	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588I3	0%	Avira URL Cloud	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://injuryless.com/?id=124406_ECF4BBEA1588.	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA15881	0%	Avira URL Cloud	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://injuryless.com/?id=124406_ECF4BBEA15887	0%	Avira URL Cloud	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://injuryless.com/	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588G	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://injuryless.com/icies	0%	Avira URL Cloud	safe
https://injuryless.com/11.10.3.41.3.6.1.4.1.311.10.3.12	0%	Avira URL Cloud	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	Avira URL Cloud	safe
https://injuryless.com/?id=124406_ECF4BBEA1588Z	0%	Avira URL Cloud	safe
https://injuryless.com/id=124406_ECF4BBEA1588p	0%	Avira URL Cloud	safe
https://injuryless.com/X	0%	Avira URL Cloud	safe
https://injuryless.com/id=124406_ECF4BBEA1588	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
https://injuryless.com/?id=124406_ECF4BBEA1588m	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://injuryless.com/?id=124406_ECF4BBEA1588m2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
injuryless.com	193.178.169.243	true	true	8%, Virustotal, Browse	unknown
pigeonious.com	95.142.44.93	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://login.microsoftonline.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://shell.suite.office.com:1443	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://autodiscover-s.outlook.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://cdn.entity.	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://powerlift.acompli.net	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://cortana.ai	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://api.aadrm.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://api.microsoftstream.com/api/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588/3	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://cr.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://portal.office.com/account/?ref=ClientMeControl	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588z2	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://graph.ppe.windows.net	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tasks.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
http://cps.root-x1.letsencrypt.org0	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://store.office.cn/addinstemplate	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.letsencrypt.org0	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://injuryless.com/rosoft	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://injuryless.com/?id=124406_ECF4BBEA1588I3	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://globaldisco.crm.dynamics.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://store.officeppe.com/addinstemplate	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.odwebp.svc.ms	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://web.microsoftstream.com/video/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://graph.windows.net	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://dataservice.o365filtering.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588.	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://injuryless.com/?id=124406_ECF4BBEA15881	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://ncus.contentsync.	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA15887	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
http://weather.service.msn.com/data.aspx	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://apis.live.net/v5.0/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://injuryless.com/	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://management.azure.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp, SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://injuryless.com/?id=124406_ECF4BBEA1588G	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://wus2.contentsync.	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/icies	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/11.10.3.41.3.6.1.4.1.311.10.3.12	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://o365auditrealtimeingestion.manage.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://api.office.net	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://incidents.diagnosticssdf.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://entitlement.diagnostics.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588Z	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://injuryless.com/id=124406_ECF4BBEA1588p	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/X	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
https://outlook.office.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/id=124406_ECF4BBEA1588	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://templatelogging.office.com/client/log	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://outlook.office365.com/	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://webshell.suite.office.com	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	091AD497-E671-4FDF-8396-74EDF92EBBCF.0.dr	false		high
https://injuryless.com/?id=124406_ECF4BBEA1588m	SettingSyncHost, 00000005.00000002.1526534901.0000000000D68000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://x1.i.lencr.org/0	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://injuryless.com/?id=124406_ECF4BBEA1588m2	SettingSyncHost, 00000005.00000002.1526548221.0000000000D83000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.178.169.243	injuryless.com	unknown		48282	VDSINA-ASRU	true
95.142.44.93	pigeonious.com	Russian Federation		210079	EUROBYTEEurobyteLLCMoscowRussiaRU	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432839
Start date:	10.06.2021
Start time:	20:29:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Current-Status-062021-81197.xlsb
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.expl.evad.winXLSB@5/8@2/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 35.3% (good quality ratio 32.5%) Quality average: 82.1% Quality standard deviation: 30.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsb Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 184.30.21.144, 104.43.139.144, 52.109.32.63, 52.109.8.22, 52.109.76.33, 40.88.32.150, 52.255.188.83, 20.50.102.62, 2.20.142.210, 2.20.142.209, 92.122.213.194, 92.122.213.247, 20.75.105.140, 20.54.26.129, 20.72.88.19, 20.190.160.75, 20.190.160.2, 20.190.160.71, 20.190.160.4, 20.190.160.134, 20.190.160.69, 20.190.160.73, 20.190.160.132, 51.11.168.232, 20.49.150.241, 51.124.78.146 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, login.live.com, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, www.tm.a.prd.aadg.akadns.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, skypedataprdcolcus15.cloudapp.net, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:30:52	API Interceptor	1x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
193.178.169.243	logo.png.exe	Get hash	malicious	Browse
	3F97s4aQjB.xlsx	Get hash	malicious	Browse
	tmp_Client-Status-062021-952177.vbs	Get hash	malicious	Browse
95.142.44.93	3F97s4aQjB.xlsx	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
pigeonious.com	3F97s4aQjB.xlsx	Get hash	malicious	Browse	95.142.44.93
injuryless.com	logo.png.exe	Get hash	malicious	Browse	193.178.169.243
	3F97s4aQjB.xlsx	Get hash	malicious	Browse	193.178.169.243
	tmp_Client-Status-062021-952177.vbs	Get hash	malicious	Browse	193.178.169.243

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VDSINA-ASRU	logo.png.exe	Get hash	malicious	Browse	193.178.169.243
	3F97s4aQjB.xlsx	Get hash	malicious	Browse	193.178.169.243
	uew5jAHqCT.exe	Get hash	malicious	Browse	109.234.38.213
	APPkj4zf3F.exe	Get hash	malicious	Browse	94.103.93.224
	tmp_Client-Status-062021-952177.vbs	Get hash	malicious	Browse	193.178.169.243
	N1LUjx76rV.exe	Get hash	malicious	Browse	109.234.35.229
	0izHwHXyfm.exe	Get hash	malicious	Browse	109.234.35.229
	gtJl8IPauk.exe	Get hash	malicious	Browse	109.234.35.229
	tAL6n3gs6p.exe	Get hash	malicious	Browse	109.234.35.229
	f1GoI1S7Qi.exe	Get hash	malicious	Browse	94.103.93.224
	SecuriteInfo.com.Troj.Kryptik-TR.10844.exe	Get hash	malicious	Browse	193.178.170.41
	SecuriteInfo.com.Troj.Kryptik-TR.30930.exe	Get hash	malicious	Browse	193.178.170.41
	S5.exe	Get hash	malicious	Browse	62.113.114.79
	A5A2471193648C16E45C9C053C8672A3F71F21862388C.exe	Get hash	malicious	Browse	94.103.85.106
	PZ33n8HQNu.exe	Get hash	malicious	Browse	62.113.119.33
	VofcOsB5QO.exe	Get hash	malicious	Browse	94.103.86.101
	8vH1bonSn8.exe	Get hash	malicious	Browse	94.103.86.101
	87PLLTuhpG.exe	Get hash	malicious	Browse	178.208.83.27
	AC09B75D9728CEA73319605AEE734B0B776E2D1677914.exe	Get hash	malicious	Browse	195.2.78.227
	file3.exe	Get hash	malicious	Browse	62.113.117.9
EUROBYTEEurobyteLLCMoscowRussiaRU	3F97s4aQjB.xlsx	Get hash	malicious	Browse	95.142.44.93
	template-jn02b3.dot	Get hash	malicious	Browse	95.142.40.220
	PREMIUM FINANCE AGREEMENT.docx	Get hash	malicious	Browse	95.142.40.241
	PREMIUM FINANCE AGREEMENT.docx	Get hash	malicious	Browse	95.142.40.220
	l8Cu5Vky6C.xls	Get hash	malicious	Browse	185.154.52.100
	l8Cu5Vky6C.xls	Get hash	malicious	Browse	185.154.52.100
	PooYhdlQZY.xls	Get hash	malicious	Browse	185.154.52.100
	PooYhdlQZY.xls	Get hash	malicious	Browse	185.154.52.100
	sUeyYgEiCb.xls	Get hash	malicious	Browse	185.154.52.100
	794c5aa1_by_Libranalysis.exe	Get hash	malicious	Browse	185.105.109.19
	njAzoIkDJu.exe	Get hash	malicious	Browse	185.105.109.19
	U92T8qzIbi.exe	Get hash	malicious	Browse	185.105.109.19
	rUUR0qQI22.exe	Get hash	malicious	Browse	185.105.109.19
	scan_DHL39382493.exe	Get hash	malicious	Browse	185.105.109.34
	3UiiwuZ4YR.exe	Get hash	malicious	Browse	95.142.44.135
	5WIxZYV73V.exe	Get hash	malicious	Browse	185.105.109.19
	0anROWjIhR.exe	Get hash	malicious	Browse	185.105.109.19
	fast.exe	Get hash	malicious	Browse	185.105.109.19
	kinsing2	Get hash	malicious	Browse	185.154.53.140
	kinsing	Get hash	malicious	Browse	185.154.53.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	logo.png.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	3F97s4aQjB.xlsx	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	WcCEh3daIE.xls	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	ATT00005.htm	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	kxjeAvsg1v.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	VSA75RUmYZ.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	iX22xMeXIc.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	QWkt5w3cO2.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	vTtOheCXBQ.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	6b6zVfqxbk.xlsb	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	Check 57549.Html	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	audit-78958169.xlsb	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	Docc.html	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	askinstall39.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	Lista e porosive.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	askinstall39.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	SecuriteInfo.com.Trojan.GenericKD.46459351.411.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	Yl6482CO6U.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243
	ZmZvKByoew.exe	Get hash	malicious	Browse	95.142.44.93 193.178.169.243

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\Public\SettingSyncHost	3F97s4aQjB.xlsx	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png	3F97s4aQjB.xlsx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\Public\SettingSyncHost Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	511488
Entropy (8bit):	7.3404073760047375
Encrypted:	false
SSDEEP:	12288:cyLjvFCsHOFO7t8BmzXiDm/znL2wOhlYuGUoPavYWIJdvrQoDptkYIN:BLDFTHOF0anwGYuGDQ2vQoDk5N
MD5:	526D56017EF5105277FE0D366C95C39D
SHA1:	78A40D523F4B887B2383681FECE447EF911C24EF
SHA-256:	28F2FA4F9AC95C3FC906E201B758D56C6A888B657DCF57C351A4F34FFB3E0FE2
SHA-512:	F2DC53598455B422B6B53108E94229B0F5791AC25188F0ED73FB4BFF1DF018B745F1F73714E97CF4E1C52475473326C1C91DC6070D331080F1FAAF696D58841E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: 3F97s4aQjB.xlsx, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p....,...,...,..,...,...,...,...,...,...,...,...,...,.).,...,..,...,...,...,Rich...,........................PE..L......`.....................~......#.............@..........................P............@.....................................(.......6.................... .......................................................................................text...9........................... ..`.rdata..............................@..@.data...\|....p.......X..............@....idata...............r..............@....rsrc...6............~..............@..@.reloc...#... ...$..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\091AD497-E671-4FDF-8396-74EDF92EBBCF Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	134922
Entropy (8bit):	5.369119258003808
Encrypted:	false
SSDEEP:	1536:4cQIKNEeBXA3gBwlpQ9DQW+z7534ZliKWXboOilX5ENLWME9:gEQ9DQW+ziXOe
MD5:	042D3F746892226A7BE71431B6635EBD
SHA1:	A171A408788DD9EE855D4C87E960E98CF4C43ED0
SHA-256:	F0FF8798D6B5E8D85FADFF08F7A9974F0843DF23BE340F28B886C9E84F0BB6FC
SHA-512:	9AAF01336D99A1754C9C1B5AB6AEA9402CC2FB9B821656FBF4FBDF8DD9912BB805526D6974AB4F650D293A2D33779B9C16BEAB621E404CE8EF2A29E7AD9F8E40
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-10T18:30:47">.. Build: 16.0.14209.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\49018F97.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 2186 x 1539, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	462772
Entropy (8bit):	7.968569347884841
Encrypted:	false
SSDEEP:	12288:yycQMfTEzs+VfqjROL5bgSj86X/5ARknBqrZsNAdee:yQMfYBVf1xBARkgaNyr
MD5:	5D1C907B7A28ED91D8A704A7CE928FAF
SHA1:	FA56635F0C2A6D93DABE3E0636DADEAECDFCE804
SHA-256:	AD72EF87E54764A13E87BBD446029F48D70114B120E6DA7025947B1D51554486
SHA-512:	52A22A801395A467AABC02B4C24236FCAC4197407FC0F5C4B0D9C79C8DFB9A5DD0D935C67A7730B7EBFCD80013967F392D48D6E697A09E684BCDC62F7DBB6376
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............I.\....sRGB.........gAMA......a.....pHYs..!...!..........IDATx^...W.Y.7~...o=.33..&+..9.q.H..1..1.b..9+.P0G.E...T..$%.wk.......i..Y{.r.S....s..................!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z...............V!=.............UH.............h..3............Z..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo[1].png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	511488
Entropy (8bit):	7.3404073760047375
Encrypted:	false
SSDEEP:	12288:cyLjvFCsHOFO7t8BmzXiDm/znL2wOhlYuGUoPavYWIJdvrQoDptkYIN:BLDFTHOF0anwGYuGDQ2vQoDk5N
MD5:	526D56017EF5105277FE0D366C95C39D
SHA1:	78A40D523F4B887B2383681FECE447EF911C24EF
SHA-256:	28F2FA4F9AC95C3FC906E201B758D56C6A888B657DCF57C351A4F34FFB3E0FE2
SHA-512:	F2DC53598455B422B6B53108E94229B0F5791AC25188F0ED73FB4BFF1DF018B745F1F73714E97CF4E1C52475473326C1C91DC6070D331080F1FAAF696D58841E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: 3F97s4aQjB.xlsx, Detection: malicious, Browse
Reputation:	low
IE Cache URL:	https://pigeonious.com/img/logo.png
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p....,...,...,..,...,...,...,...,...,...,...,...,...,.).,...,..,...,...,...,Rich...,........................PE..L......`.....................~......#.............@..........................P............@.....................................(.......6.................... .......................................................................................text...9........................... ..`.rdata..............................@..@.data...\|....p.......X..............@....idata...............r..............@....rsrc...6............~..............@..@.reloc...#... ...$..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A6B40000 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1041070
Entropy (8bit):	7.855884638864563
Encrypted:	false
SSDEEP:	12288:Qp4WH4vcCRa6p1RtTycQMfTEzs+VfqjROL5bgSj86X/5ARknBqrZsNAde5:O4vdRa6p1Rt/QMfYBVf1xBARkgaNys
MD5:	A6832F006ECA34E5E7495F7A3B5ADC6B
SHA1:	801FE0D57B16BFF66056840CD47BEED33B4ABB5C
SHA-256:	8DE78336A3BD486ABFE0B3DF88EFC9AD8BF2A64BF309C7107565F16BF838F757
SHA-512:	F7CC6E711DB08682BF125388C1395696A9073A236BB8196647DA27A4B53F450373D3BC52A1EAFCDB017108845450A469FFA14E1859DA419FE18135E3C7FD0EBF
Malicious:	false
Reputation:	low
Preview:	.T.n.0....?..........C....I?`M.%.\|..$..w);n..V.....;3;...f.l...L.jf.B..6.k.....QQ......."......6"U...}...zt@M..9...A.....j......T.g....C,..q.O6W..^.)Y./.o.}.....5.2...^.!..je...C7.....1;..d.1=`.\..y.3....qEsY?....4.{....J..D.d.N0..i..y?....X.C.w..-...%..2.us.....B...5.T.....9..*<.4..RI...)...GhJASY.......DG.k.rx........B.[...O.T...c.!.~..@....7.....H.......:....>.H<..Nw...Kv...S6x..c.t`.i....2N5.#.r..........PK..........!..j0.............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................M

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	Little-endian UTF-16 Unicode text, with CR line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	2.9808259362290785
Encrypted:	false
SSDEEP:	3:QAlX0Gn:QKn
MD5:	7962B839183642D3CDC2F9CEBDBF85CE
SHA1:	2BE8F6F309962ED367866F6E70668508BC814C2D
SHA-256:	5EB8655BA3D3E7252CA81C2B9076A791CD912872D9F0447F23F4C4AC4A6514F6
SHA-512:	2C332AC29FD3FAB66DBD918D60F9BE78B589B090282ED3DBEA02C4426F6627E4AAFC4C13FBCA09EC4925EAC3ED4F8662FDF1D7FA5C9BE714F8A7B993BECB3342
Malicious:	false
Reputation:	high, very likely benign file
Preview:	....p.r.a.t.e.s.h.....

C:\Users\user\Desktop\~$Current-Status-062021-81197.xlsb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.6081032063576088
Encrypted:	false
SSDEEP:	3:RFXI6dtt:RJ1
MD5:	7AB76C81182111AC93ACF915CA8331D5
SHA1:	68B94B5D4C83A6FB415C8026AF61F3F8745E2559
SHA-256:	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
SHA-512:	A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	.pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.083203110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1Mgjd330qJQAiveyzr:Yw7gJGWMXJXKSOdYiygKkXe/eg1deAin
MD5:	C62814DB19512E50685CCD10C45F4557
SHA1:	91CB5A204B91F9F81D791B07AACBE4CB2A79CC85
SHA-256:	FBDC5DD1D2DA5FEACF83F4FF1781A49DEDA141E18E33326B92B66D8D49C6725F
SHA-512:	7608BF46F85343150B8B4BD37FD994EEE0CE3D61BF5613A8D1DD3C93DD2B11E63190D419140DFE5A7AFED08E88C8B3C592E5241E4C048E6D670747A522B1D4FD
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 1808;...ReturnValue = 0;..};....

Static File Info

General
File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.994144310692157
TrID:	Excel Microsoft Office Binary workbook document (47504/1) 49.73% Excel Microsoft Office Open XML Format document (40004/1) 41.88% ZIP compressed archive (8000/1) 8.38% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	Current-Status-062021-81197.xlsb
File size:	468533
MD5:	1ac719c744d22f42e4978e7b55828435
SHA1:	4ddc7358f615987bf92ed9192430693db65b097c
SHA256:	d9be275feff4b3383821b1483ba93424fb27aa40e138da41a91511193d9538cb
SHA512:	736bcf96ca99c893c535c555133a092400e1dbc5f5143500d152c537bccc9d3faf7d541b3b11be82b68bbf4c7a1528c5fa3b45394d5b2b958c4d1d4d024e7d22
SSDEEP:	12288:ag+iWCVTHlJFnI6TDEeTSH/NJDjXcXdeanuxZ2:4iVVTHxNcoSJDK1nuxA
File Content Preview:	PK...........R................docProps/PK..........!.,...............docProps/app.xml.S.N.0.....`.N...Zu.#T.XQ.....u&.EbG.......m.ZNp{3o........"-8....x.Q.F.\.ML......x.&..5...xz-...Kg.p... a\|LK.f..W%....m.SXWK...0[.Z..U.5.d.Qt.`.`r./.^..)N[..hn.....vM...

File Icon


Icon Hash:	74f0d0d2c6d6d0f4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Current-Status-062021-81197.xlsb"

Indicators
Has Summary Info:
Application Name:
Encrypted Document:
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:

Macro 4.0 Code

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 20:30:50.656872988 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.735166073 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.736341953 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.736397028 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.814826012 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.814945936 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.814997911 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.815037012 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.815064907 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.815098047 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.815139055 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.815151930 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.816432953 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.817647934 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.830462933 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.909135103 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.909990072 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.910018921 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.988725901 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988765955 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988782883 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988800049 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988817930 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988842964 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988866091 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988888025 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988903046 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.988912106 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988934994 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.988936901 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:50.988950968 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:50.989264965 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067203045 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067236900 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067260981 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067274094 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067286015 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067308903 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067311049 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067337990 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067342997 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067352057 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067358017 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067363977 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067377090 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067389011 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067404985 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067413092 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067440033 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067456007 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067465067 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067481995 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067490101 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067514896 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067539930 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067542076 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067553997 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067562103 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067569971 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067586899 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067595005 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067610025 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067617893 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067629099 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067645073 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067660093 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067672968 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067697048 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.067706108 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067724943 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.067734957 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.145869017 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.145936966 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.145956993 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.145986080 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.145993948 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146038055 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146055937 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146079063 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146085978 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146117926 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146135092 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146159887 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146181107 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146198988 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146203995 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146248102 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146251917 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146291971 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146305084 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146333933 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146348953 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146374941 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146390915 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146415949 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146434069 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146455050 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146466970 CEST	49734	443	192.168.2.4	95.142.44.93
Jun 10, 2021 20:30:51.146495104 CEST	443	49734	95.142.44.93	192.168.2.4
Jun 10, 2021 20:30:51.146512032 CEST	49734	443	192.168.2.4	95.142.44.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 20:30:34.206564903 CEST	49714	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:34.265006065 CEST	53	49714	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:36.034472942 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:36.094928980 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:36.527556896 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:36.579847097 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:37.512619972 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:37.565578938 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:38.587871075 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:38.640319109 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:39.676168919 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:39.729420900 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:43.873945951 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:43.926970005 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:45.612584114 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:45.663584948 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:46.848140001 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:46.941303015 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:47.008368969 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:47.061393023 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:47.385363102 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:47.463027000 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:48.405050993 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:48.463570118 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:49.474627018 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:49.547060013 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:50.261271954 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:50.311780930 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:50.593030930 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:50.654596090 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:51.202831030 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:51.262556076 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:51.513902903 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:51.572402000 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:52.146414995 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:52.196537971 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:53.110058069 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:53.168947935 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:53.953429937 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:54.003418922 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:54.151655912 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:54.212208986 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:55.563076019 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:55.622031927 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:58.565296888 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:58.615401983 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 10, 2021 20:30:59.352473021 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:30:59.405525923 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:00.807920933 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:00.858035088 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:01.786041021 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:01.839013100 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:02.582092047 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:02.635498047 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:05.022397041 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:05.084589005 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:28.078067064 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:28.155484915 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 10, 2021 20:31:44.279566050 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:31:44.342488050 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:02.298568010 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:02.362150908 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:18.171941042 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:18.308784962 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:19.322381973 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:19.384074926 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:20.658437967 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:20.725275040 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:21.333220959 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:21.402667046 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:21.532211065 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:21.592154980 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:22.647661924 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:22.706135035 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:23.740199089 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:23.885641098 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:24.785346031 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:24.845444918 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:26.169083118 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:26.227855921 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:27.690294981 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:27.750433922 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:28.589855909 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:28.648789883 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:39.751075983 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:39.820959091 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 10, 2021 20:32:42.083051920 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:32:42.149908066 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 10, 2021 20:35:24.917782068 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:35:24.996901989 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 10, 2021 20:35:25.490921974 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:35:25.565099001 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 10, 2021 20:35:31.229485989 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:35:31.299700975 CEST	53	57525	8.8.8.8	192.168.2.4
Jun 10, 2021 20:35:35.154139042 CEST	53814	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:35:35.204423904 CEST	53	53814	8.8.8.8	192.168.2.4
Jun 10, 2021 20:35:35.470817089 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 10, 2021 20:35:35.539988041 CEST	53	53418	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 10, 2021 20:30:50.593030930 CEST	192.168.2.4	8.8.8.8	0xf09c	Standard query (0)	pigeonious.com	A (IP address)	IN (0x0001)
Jun 10, 2021 20:30:54.151655912 CEST	192.168.2.4	8.8.8.8	0xc717	Standard query (0)	injuryless.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 10, 2021 20:30:50.654596090 CEST	8.8.8.8	192.168.2.4	0xf09c	No error (0)	pigeonious.com		95.142.44.93	A (IP address)	IN (0x0001)
Jun 10, 2021 20:30:54.212208986 CEST	8.8.8.8	192.168.2.4	0xc717	No error (0)	injuryless.com		193.178.169.243	A (IP address)	IN (0x0001)
Jun 10, 2021 20:35:24.996901989 CEST	8.8.8.8	192.168.2.4	0x725c	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 10, 2021 20:30:50.816432953 CEST	95.142.44.93	443	192.168.2.4	49734	CN=pigeonious.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 08 15:19:13 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 06 15:19:13 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 10, 2021 20:30:54.346164942 CEST	193.178.169.243	443	192.168.2.4	49739	CN=injuryless.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu May 27 15:42:29 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Wed Aug 25 15:42:29 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 7076 Parent PID: 800

General

Start time:	20:30:45
Start date:	10/06/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Imagebase:	0x1150000
File size:	27110184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WMIC.exe PID: 2460 Parent PID: 7076

General

Start time:	20:30:51
Start date:	10/06/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic process call create 'C:/Users/Public/SettingSyncHost'
Imagebase:	0x60000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exe PID: 352 Parent PID: 2460

General

Start time:	20:30:51
Start date:	10/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: SettingSyncHost PID: 1808 Parent PID: 5060

General

Start time:	20:30:52
Start date:	10/06/2021
Path:	C:\Users\Public\SettingSyncHost
Wow64 process (32bit):	true
Commandline:	C:/Users/Public/SettingSyncHost
Imagebase:	0x390000
File size:	511488 bytes
MD5 hash:	526D56017EF5105277FE0D366C95C39D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 17%, ReversingLabs
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Current-Status-062021-81197.xlsb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "Current-Status-062021-81197.xlsb"

Indicators

Macro 4.0 Code

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: EXCEL.EXE PID: 7076 Parent PID: 800

General

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre