Windows Analysis Report
e5#U7248.exe

Source: e5#U7248.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\e5#U7248.exe

File read: C:\Users\user\Desktop\e5#U7248.exe

Source: e5#U7248.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\e5#U7248.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\e5#U7248.exe "C:\Users\user\Desktop\e5#U7248.exe"
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Users\Public\Music\e5#U7248.exe C:\Users\Public\Music\e5#U7248.exe
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Users\Public\Music\e5#U7248.exe C:\Users\Public\Music\e5#U7248.exe	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul	Jump to behavior

Source: C:\Users\user\Desktop\e5#U7248.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\e5#U7248.exe

File created: C:\Users\Public\Music\e5#U7248.exe

Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE

File created: C:\Users\user\AppData\Local\Temp\{6985FED7-5206-4204-9381-2FB0833DA03B} - OProcSessId.dat

Source: classification engine

Classification label: mal76.troj.winEXE@8/6@3/4

Source: C:\Users\user\Desktop\e5#U7248.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6852:120:WilError_01

Source: e5#U7248.exe	String found in binary or memory: id-cmc-addExtensions
Source: e5#U7248.exe	String found in binary or memory: set-addPolicy
Source: e5#U7248.exe	String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectoryR:\vcpkg\buildtrees\curl\src\url-7_82_0-dc87944d3b.clean\lib\system_win32.ch1h2h3R:\vcpkg\buildtrees\curl\src\url-7_82_0-dc87944d3b.clean\lib\altsvc.c%10s %512s %u %10s %512s %u "%64[^"]" %u %u%s %s %u %s %s %u "%d%02d%02d %02d:%02d:%02d" %u %d

Source: C:\Users\user\Desktop\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: e5#U7248.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: e5#U7248.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Self deletion via cmd delete

Source: e5#U7248.exe

Static file information: File size 4937216 > 1048576

Source: e5#U7248.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1d6400
Source: e5#U7248.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x224600

Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: e5#U7248.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: e5#U7248.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\Public\Music\e5#U7248.exe

Code function: 12_2_000001C8CA29012B push eax; ret

12_2_000001C8CA290387

Source: initial sample	Static PE information: section name: .text entropy: 6.83933595182
Source: initial sample	Static PE information: section name: .text entropy: 6.83933595182

Source: C:\Users\user\Desktop\e5#U7248.exe

File created: C:\Users\Public\Music\e5#U7248.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul			Jump to behavior

Deletes itself after installation

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul			Jump to behavior

Source: C:\Users\user\Desktop\e5#U7248.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Yara detected CobaltStrike

Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: e5#U7248.exe, 0000000C.00000002.631524645.000001C8CA129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPM
Source: e5#U7248.exe, 0000000C.00000002.631524645.000001C8CA129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp"
Source: e5#U7248.exe, 00000001.00000003.528325841.00000150D0787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,,\|

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "			Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul			Jump to behavior

Source: C:\Users\user\Desktop\e5#U7248.exe

Code function: 1_2_00007FF6C981CEB0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF6C981CEB0

Remote Access Functionality

Source: Yara match	File source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	12 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 File Deletion	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e5#U7248.exe	9%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
service-ep07djah-1306669097.bj.apigw.tencentcs.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
http://rs.qbox.mehttp://rsf.qbox.mehttp://api.qiniu.comhttp://fusion.qiniuapi.comhttp://uc.qbox.meht	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.js	0%	Avira URL Cloud	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.jsT	0%	Avira URL Cloud	safe
http://upload.qiniup.com	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://curl.se/docs/alt-svc.html	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
http://fusion.qiniuapi.com	0%	Avira URL Cloud	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
1-1.bj.apigwtencent.com	49.233.94.119	true	false		unknown
kodo-elb-z0.qbox.me	115.231.97.60	true	false		high
service-ep07djah-1306669097.bj.apigw.tencentcs.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
rs.qbox.me	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://login.microsoftonline.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://shell.suite.office.com:1443	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1	e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://autodiscover-s.outlook.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://roaming.edog.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://cdn.entity.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://powerlift.acompli.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://api.qiniu.com	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://cortana.ai	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.mehttp://rsf.qbox.mehttp://api.qiniu.comhttp://fusion.qiniuapi.comhttp://uc.qbox.meht	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://entitlement.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.aadrm.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1da	e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.js	e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631506915.000001C8CA111000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.microsoftstream.com/api/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://cr.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://graph.ppe.windows.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://officeci.azurewebsites.net/api/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.jsT	e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://upload.qiniup.com	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://globaldisco.crm.dynamics.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://messaging.engagement.office.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dev0-api.acompli.net/autodetect	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://web.microsoftstream.com/video/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://curl.se/docs/alt-svc.html	e5#U7248.exe, e5#U7248.exe.1.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dataservice.o365filtering.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://ncus.contentsync.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://weather.service.msn.com/data.aspx	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://apis.live.net/v5.0/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://management.azure.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://wus2.contentsync.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/user/v1.0/ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://iovip.qbox.me	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.office.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://incidents.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://fusion.qiniuapi.com	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://entitlement.diagnostics.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1-1000	e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://substrate.office.com/search/api/v2/init	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://webshell.suite.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rsf.qbox.me	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://management.azure.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
115.231.97.60	kodo-elb-z0.qbox.me	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
49.233.94.119	1-1.bj.apigwtencent.com	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
180.101.136.19	unknown	China	23650	CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632999
Start date and time: 24/05/202211:17:13	2022-05-24 11:17:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	e5#U7248.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.winEXE@8/6@3/4
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 44.4% (good quality ratio 22.2%) Quality average: 50% Quality standard deviation: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.109.88.177, 52.109.88.38, 52.109.88.40
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, login.live.com, config.officeapps.live.com, sls.update.microsoft.com, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net
Execution Graph export aborted for target e5#U7248.exe, PID 7116 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
115.231.97.60	05#U7248.exe	Get hash	malicious	Browse
180.101.136.19	05#U7248.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
kodo-elb-z0.qbox.me	05#U7248.exe	Get hash	malicious	Browse	115.231.97.60
1-1.bj.apigwtencent.com	05#U7248.exe	Get hash	malicious	Browse	140.143.115.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CT-HANGZHOU-IDCNo288Fu-chunRoadCN	05#U7248.exe	Get hash	malicious	Browse	115.231.97.60
	Pkbs8NK2gS	Get hash	malicious	Browse	115.221.225.130
	Cff7khwHQF	Get hash	malicious	Browse	115.239.80.252
	qqDppexXZe	Get hash	malicious	Browse	115.227.159.234
	M6rJWN9csy.apk	Get hash	malicious	Browse	183.134.98.111
	M6rJWN9csy.apk	Get hash	malicious	Browse	183.134.98.111
	XQxNgY2G12	Get hash	malicious	Browse	115.238.120.254
	https://lbsp.click.com.cn/05.html	Get hash	malicious	Browse	60.190.243.163
	TCy85nWWyM	Get hash	malicious	Browse	115.236.198.58
	F7ikYHBYz4	Get hash	malicious	Browse	125.125.123.194
	kVTVBlHmt7	Get hash	malicious	Browse	115.239.80.233
	https://honlung.info/wbeqxin/#redacted_email	Get hash	malicious	Browse	115.236.118.136
	z4ehq74vWO	Get hash	malicious	Browse	115.236.201.184
	v7WEmbH8Su	Get hash	malicious	Browse	122.224.221.74
	CRhiCDDqU4	Get hash	malicious	Browse	125.124.181.182
	r284sgFxwT	Get hash	malicious	Browse	125.125.123.181
	ZXEASxwPpt	Get hash	malicious	Browse	115.239.244.96
	X1l9L1Sc5T.exe	Get hash	malicious	Browse	115.231.235.56
	J0O8syCLZb.exe	Get hash	malicious	Browse	115.239.173.159
	4WRYiytdc4	Get hash	malicious	Browse	122.224.85.250
CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	05#U7248.exe	Get hash	malicious	Browse	140.143.115.153
	qK1I45UjfZ	Get hash	malicious	Browse	109.244.173.155
	k1XbG327mS	Get hash	malicious	Browse	152.136.225.66
	hB6xII7txf	Get hash	malicious	Browse	81.70.216.154
	PQ9UVf9sDk	Get hash	malicious	Browse	139.187.242.3
	XukPw5trx0	Get hash	malicious	Browse	129.28.238.255
	EhCzyqLrUk	Get hash	malicious	Browse	129.28.238.227
	G56U7GPUOd	Get hash	malicious	Browse	128.108.78.157
	S6CQEeCtrQ	Get hash	malicious	Browse	118.89.25.37
	miori.arm7-20220522-1600	Get hash	malicious	Browse	129.30.177.73
	e2tPHVCPvZ	Get hash	malicious	Browse	152.137.163.203
	arm	Get hash	malicious	Browse	152.140.233.134
	ABQktqw2vr	Get hash	malicious	Browse	148.70.22.90
	DZ1OA91D1X	Get hash	malicious	Browse	152.137.215.130
	o9flt31Dtm	Get hash	malicious	Browse	175.27.213.138
	sora.arm7	Get hash	malicious	Browse	106.54.63.247
	LD3p9vrw7M	Get hash	malicious	Browse	111.231.170.96
	percarm	Get hash	malicious	Browse	152.136.167.152
	pandora.arm	Get hash	malicious	Browse	119.29.152.61
	BzcZ9DVzeC	Get hash	malicious	Browse	111.229.246.250

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4937216
Entropy (8bit):	7.3137520514707
Encrypted:	false
SSDEEP:	98304:E0+E9G0Iv7XF4UNcQV1wyw6qjw4y6UlDY2l:RX9G0Iv714Q8Ux6U
MD5:	032E7E721DFE5DBC95BB91A3BC2E935C
SHA1:	4A214BECD642F2BF8DF0C118056A217AEC073CC5
SHA-256:	DAC35A874CA47B8DE8103AC84B2DB9DEA4E6B44F9ED2081FCD5BFF1143A66D97
SHA-512:	B0BEAC870FFBBD7F1B3DCB0586CFF81E543350EC97989A20D87029CEB279D089D80A54EF0F96A390334A45907AE0BF256B9CDBCDE5863A48D23DEEBE1E1B8E4D
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~r..:.y.:.y.:.y._u}...y._uz.6.y._u\|...y.:.y.&.y.....=.y.h{z.3.y..z}.J.y._ux.5.y.:.x...y.h{\|...y.h{}...y..z\|.;.y..z..;.y.:...;.y..z{.;.y.Rich:.y.................PE..d....].b.........."......d...>.................@..............................K...........`..................................................Z'......@).HD"...(..$............K.@]....&...............................&..............................................text...$c.......d.................. ..`.rdata...............h..............@..@.data.........'..2...Z'.............@....pdata...$....(..&....'.............@..@.rsrc...HD"..@)..F"...(.............@..@.reloc..@]....K..^....J.............@..B................................................................................................................................................................................................................

C:\Users\Public\Music\e5#U7248.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\335F8B80-9649-4ACE-A711-42A021E2413D

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	147614
Entropy (8bit):	5.359221740812186
Encrypted:	false
SSDEEP:	1536:dcQk/gxgB5B3guw//Q9DQW+zQWk4F77nXmvidQXxFETLKz6e:jHQ9DQW+zIXQI
MD5:	774458080C9198580CF712EE05A4402E
SHA1:	6FBF80AA9C0E9545AB55F1BEB4AB264827DBBFFC
SHA-256:	DD90BA7F848AE754FDEB057DDBE8052F22A5E724E63E5958B8F2FAA7F503579F
SHA-512:	F4ACD6CFC1A33E4F6D2C7BF6248BEC83608621EB665A2F8A8CE1FC7A337ECE74FE322D665481C4C515F06CFAC2AE6B7F1C7706545D42C94E09A7195B5DBFDACE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-05-24T09:19:11">.. Build: 16.0.15315.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\e5.LNK

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue May 24 17:19:07 2022, mtime=Tue May 24 17:19:12 2022, atime=Tue May 24 17:19:07 2022, length=2068461, window=hide
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.707408336825349
Encrypted:	false
SSDEEP:	12:8Z6n19UkWCHo/XsImI+W3actKZijAk/E2m8NySOND8aLbzebzWk44t2Y+xIBjKZm:8ZIPetbAk8kuD3l7aB6m
MD5:	F1BDBB6BC6FDA893D1201A16F5DE6350
SHA1:	51C2BCB3410F422FAF14B6B821EE2A061BD7C9F7
SHA-256:	0A2B16A79A1FC75931BCD7EAC920924D365108F78A317E6011332F930338CDBA
SHA-512:	C3B859615A8047F09D96EBD6A7C15A1EF52CA9BED6F2F31491B6A5DA955D500AF475CE1C269665191F0A5D5C2AAF68C117CD50F5FAA84AB3DBE34CB95AC37BAC
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...O....o..5..o...3..o..............................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...TL.....................:.....Q...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....Z.1.....hTz...user..B.......N...TL......S........................e.n.g.i.n.e.e.r.....~.1......Td...Desktop.h.......N...Te......Y..............>......./.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....h.2.....Td. .E5#U72~1.PPT..L......Td..Td.....N.....................P...e.5.#.U.7.2.4.8...p.p.t.x.......V...............-.......U...........>.S......C:\Users\user\Desktop\e5#U7248.pptx..$.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.e.5.#.U.7.2.4.8...p.p.t.x.........:..,.LB.)...A}...`.......X.......210979...........!a..%.H.VZAj...s.>].........-$..!a..%.H.VZAj...s.>].........-$.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	39
Entropy (8bit):	4.24040510342216
Encrypted:	false
SSDEEP:	3:HLeUm4Wv:HL6
MD5:	CC052D09B391D0854B3541F4821426BE
SHA1:	5C136CE22F57501A7DBCD9DFD01E908C15248C98
SHA-256:	53CABBF3DD7F4576F525C5B43A7A6BEC7A00CA1F7DF21CD33502EFB59090BEBA
SHA-512:	EB514552C627DA42B1E6420FB0C21E34C6E2BD8141ECAB7C9634B3A3BCE3AE2439C21662DB4A8752FE2F5DBED83779633833F6AD9887EA5A6C3CFDB95A270024
Malicious:	false
Reputation:	low
Preview:	[misc]..e5.LNK=0..[folders]..e5.LNK=0..

C:\Users\user\Desktop\e5#U7248.pptx

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	Microsoft PowerPoint 2007+
Category:	modified
Size (bytes):	2068461
Entropy (8bit):	7.8112893691004865
Encrypted:	false
SSDEEP:	49152:uVFtwyfYBMRhxUjw4yTO6yLYO19JKLlooTYF8pl0:u1wyw6qjw4y6UlDY2l0
MD5:	3BBBC2FD0ACA510B778DE111409A3047
SHA1:	670F28428DAD6ACB57093F7A8C1D04DED167CBD1
SHA-256:	8E1F4B3779DC4DF4F7BF624AF91C4ABA042100651A6F2D41081F90BA3664463A
SHA-512:	FA80EFA24E920C89DBFC6107F21665C99AD997A44F96F93F127AEB742527F9CD72771A0192DE4E4647D8E5C074075B4B728B14861891073E7B4ECDB2ACAE9D47
Malicious:	false
Preview:	PK..........!.. H.c...T.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................]o. ...'.?X.N1...n..}\.R........5.~.NZ.rj....(..{.d...yvuW.d..0)2D.)J@.`b.._._'.(1...r) C[0.j....v..$.Z....U.16..JjR.@....%.n..X../].>.N.q...a'..@..gX.5..;w.!Qb..O.U.XY.W.qg....!.Dw..n..P.8.u.x#.G{......z.Y1e..G2T3....~...Y..5...-....J.qq...i..T.X.....K....J~0LK..~..`.w..Sc.ai...d-.AL;.0..!8.N.6:.......G'..Np...Ct.2.....I\|[$.}..7F...I\|k$..7G.....`.5dk0.K....V...k..:...u..GV.^k.L....#.0....^......._..Q..f..9..-.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.3137520514707
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e5#U7248.exe
File size:	4937216
MD5:	032e7e721dfe5dbc95bb91a3bc2e935c
SHA1:	4a214becd642f2bf8df0c118056a217aec073cc5
SHA256:	dac35a874ca47b8de8103ac84b2db9dea4e6b44f9ed2081fcd5bff1143a66d97
SHA512:	b0beac870ffbbd7f1b3dcb0586cff81e543350ec97989a20d87029ceb279d089d80a54ef0f96a390334a45907ae0bf256b9cdbcde5863a48d23deebe1e1b8e4d
SSDEEP:	98304:E0+E9G0Iv7XF4UNcQV1wyw6qjw4y6UlDY2l:RX9G0Iv714Q8Ux6U
TLSH:	2536DF1AAAA508E4DCB6C23886565633E7B1BC15277167EB03E0F6771F33AD11E3A704
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~r..:.y.:.y.:.y._u}...y._uz.6.y._u\|...y.:.y.&.y.....=.y.h{z.3.y..z}.J.y._ux.5.y.:.x...y.h{\|...y.h{}...y..z\|.;.y..z..;.y.:...;.y

File Icon


Icon Hash:	30868c8c8c868830

Static PE Info

General

Entrypoint:	0x14007c5bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x628B5D9D [Mon May 23 10:10:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	62a5dd25af85564e3aeb55c6407225e3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F49B89ACA30h
dec eax
add esp, 28h
jmp 00007F49B89ABFBFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F49B89AC151h
dec eax
mov ecx, ebx
call 00007F49B8A93A2Ah
test eax, eax
je 00007F49B89AC155h
dec eax
mov ecx, ebx
call 00007F49B8A8675Ah
dec eax
test eax, eax
je 00007F49B89AC129h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F49B89AC148h
call 00007F49B89ACDF8h
int3
call 00007F49B89ACE12h
int3
jmp 00007F49B89ACE2Ch
int3
int3
int3
jmp 00007F49B89AC0FCh
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F49B89AC152h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F49B89AC155h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F49B89AC14Dh
movzx eax, byte ptr [ecx+eax+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x275a04	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x294000	0x224448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x281000	0x12498	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b9000	0x5d40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x261b80	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x261ba0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d8000	0x710	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d6324	0x1d6400	False	0.528704499767	data	6.83933595182	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1d8000	0x9f0d4	0x9f200	False	0.43268699676	data	5.72254467214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x278000	0x81b0	0x3200	False	0.236875	DOS executable (block device driver ght (c)	3.22425146815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x281000	0x12498	0x12600	False	0.487417623299	data	6.1747245461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x294000	0x224448	0x224600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b9000	0x5d40	0x5e00	False	0.264710771277	data	5.44086201759	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
FILE_DATA	0x2bc080	0x1f8fed	Microsoft PowerPoint 2007+	Chinese	China
FILE_DATA	0x4b5070	0x31aa	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 285x180, frames 3	Chinese	China
RT_ICON	0x2944b0	0x2e8	data	Chinese	China
RT_ICON	0x294798	0x128	GLS_BINARY_LSB_FIRST	Chinese	China
RT_ICON	0x2948c0	0x1628	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x295ee8	0xea8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x296d90	0x8a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x297638	0x568	GLS_BINARY_LSB_FIRST	Chinese	China
RT_ICON	0x297ba0	0x10ef	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China
RT_ICON	0x298c90	0x94a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2a2138	0x67e8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2a8920	0x5488	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2adda8	0x4228	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b1fd0	0x3a48	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b5a18	0x25a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b7fc0	0x1a68	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b9a28	0x10a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2baad0	0x988	data	Chinese	China
RT_ICON	0x2bb458	0x6b8	data	Chinese	China
RT_ICON	0x2bbb10	0x468	GLS_BINARY_LSB_FIRST	Chinese	China
RT_GROUP_ICON	0x2bbf78	0x102	data	Chinese	China
RT_MANIFEST	0x4b8220	0x224	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
SHELL32.dll	SHGetSpecialFolderPathA, ShellExecuteExW, SHChangeNotify, ShellExecuteA
USER32.dll	SendMessageW, GetProcessWindowStation, GetUserObjectInformationW, MessageBoxW, LoadIconW
KERNEL32.dll	TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, CreateFileA, GetFileInformationByHandle, ReadFile, CloseHandle, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleExW, GetStdHandle, GetFileType, WriteFile, DeleteFiber, ConvertFiberToThread, FreeLibrary, LoadLibraryA, LoadLibraryW, FindClose, FindFirstFileW, FindNextFileW, GetConsoleMode, SetConsoleMode, TlsGetValue, ReadConsoleW, GetDriveTypeW, CreateThread, RtlUnwind, VerifyVersionInfoW, VerSetConditionMask, WaitForMultipleObjects, GetEnvironmentVariableA, WaitForSingleObjectEx, MoveFileExA, GetModuleHandleA, GetSystemDirectoryA, QueryPerformanceFrequency, SleepEx, Sleep, InitializeCriticalSectionEx, SetEndOfFile, WriteConsoleW, HeapSize, GetFullPathNameW, GetCurrentDirectoryW, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, CreateFileW, IsValidCodePage, FindFirstFileExW, GetTimeZoneInformation, HeapReAlloc, SetFilePointerEx, GetFileSizeEx, GetConsoleCP, FlushFileBuffers, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, HeapAlloc, TlsAlloc, SwitchToThread, InitializeCriticalSectionAndSpinCount, SetLastError, DecodePointer, EncodePointer, MultiByteToWideChar, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, WideCharToMultiByte, FormatMessageW, GetLastError, GetConsoleWindow, CopyFileA, lstrcatW, WinExec, lstrcpyW, FindResourceW, SizeofResource, LockResource, LoadResource, GetModuleFileNameW, GetModuleFileNameA, VirtualAlloc, SetPriorityClass, SetThreadPriority, GetCurrentThread, GetCurrentProcess, GetShortPathNameW, GetEnvironmentVariableW, ExitThread, FreeLibraryAndExitThread, GetFileAttributesExW, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadConsoleA, DeleteFileW, RtlPcToFileHeader, RaiseException, RtlUnwindEx, LoadLibraryExW, ExitProcess, SetConsoleCtrlHandler, HeapFree
bcrypt.dll	BCryptGenRandom
WS2_32.dll	WSAIoctl, htons, getpeername, select, __WSAFDIsSet, WSAWaitForMultipleEvents, WSAResetEvent, WSAEnumNetworkEvents, WSACreateEvent, WSACloseEvent, socket, setsockopt, listen, connect, inet_pton, bind, WSAEventSelect, WSASetLastError, send, recv, freeaddrinfo, getaddrinfo, WSAGetLastError, WSACleanup, WSAStartup, ntohs, getsockopt, getsockname, ioctlsocket, ntohl, htonl, recvfrom, sendto, gethostname, closesocket, accept
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertGetCertificateContextProperty, CertFreeCertificateContext, CertDuplicateCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore
ADVAPI32.dll	CryptEncrypt, CryptImportKey, CryptHashData, CryptGenRandom, CryptGetHashParam, CryptAcquireContextA, CryptEnumProvidersW, CryptSignHashW, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptGetUserKey, CryptGetProvParam, CryptSetHashParam, CryptDestroyKey, CryptReleaseContext, CryptAcquireContextW, ReportEventW, RegisterEventSourceW, DeregisterEventSource

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2022 11:18:25.255116940 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:28.353368998 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:34.356031895 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:46.356165886 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:18:49.370821953 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:18:55.371294975 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:11.680466890 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:14.716696024 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:20.717226028 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:32.720256090 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:35.718535900 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:41.718998909 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:56.655518055 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.655560970 CEST	443	49828	49.233.94.119	192.168.2.6
May 24, 2022 11:19:56.655685902 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.828752995 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.828783035 CEST	443	49828	49.233.94.119	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2022 11:18:25.229048014 CEST	56591	53	192.168.2.6	8.8.8.8
May 24, 2022 11:18:25.248784065 CEST	53	56591	8.8.8.8	192.168.2.6
May 24, 2022 11:19:11.638067007 CEST	51194	53	192.168.2.6	8.8.8.8
May 24, 2022 11:19:11.659339905 CEST	53	51194	8.8.8.8	192.168.2.6
May 24, 2022 11:19:55.040888071 CEST	55083	53	192.168.2.6	8.8.8.8
May 24, 2022 11:19:55.348397970 CEST	53	55083	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 24, 2022 11:18:25.229048014 CEST	192.168.2.6	8.8.8.8	0xa156	Standard query (0)	rs.qbox.me	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.638067007 CEST	192.168.2.6	8.8.8.8	0xe907	Standard query (0)	rs.qbox.me	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.040888071 CEST	192.168.2.6	8.8.8.8	0x9872	Standard query (0)	service-ep07djah-1306669097.bj.apigw.tencentcs.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	rs.qbox.me	kodo-elb-z0.qbox.me		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	kodo-elb-z0.qbox.me		115.231.97.60	A (IP address)	IN (0x0001)
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	kodo-elb-z0.qbox.me		180.101.136.19	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	rs.qbox.me	kodo-elb-z0.qbox.me		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	kodo-elb-z0.qbox.me		180.101.136.19	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	kodo-elb-z0.qbox.me		115.231.97.60	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	service-ep07djah-1306669097.bj.apigw.tencentcs.com	1-1.bj.apigwtencent.com		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	1-1.bj.apigwtencent.com		49.233.94.119	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	1-1.bj.apigwtencent.com		140.143.115.153	A (IP address)	IN (0x0001)

Target ID:	1
Start time:	11:18:23
Start date:	24/05/2022
Path:	C:\Users\user\Desktop\e5#U7248.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\e5#U7248.exe"
Imagebase:	0x7ff6c97a0000
File size:	4937216 bytes
MD5 hash:	032E7E721DFE5DBC95BB91A3BC2E935C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	11
Start time:	11:19:09
Start date:	24/05/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Imagebase:	0x1040000
File size:	1849008 bytes
MD5 hash:	68F52CD14C61DDC941769B55AE3F2EE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	12
Start time:	11:19:09
Start date:	24/05/2022
Path:	C:\Users\Public\Music\e5#U7248.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Music\e5#U7248.exe
Imagebase:	0x7ff79e5b0000
File size:	4937216 bytes
MD5 hash:	032E7E721DFE5DBC95BB91A3BC2E935C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64, Description: Detects CobaltStrike payloads, Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64, Description: Detects CobaltStrike payloads, Source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Target ID:	16
Start time:	11:19:41
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Imagebase:	0x7ff6edbd0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	19
Start time:	11:19:45
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6406f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high