Edit tour

Windows Analysis Report
e5#U7248.exe

Overview

General Information

Sample Name:	e5#U7248.exe
Analysis ID:	632999
MD5:	032e7e721dfe5dbc95bb91a3bc2e935c
SHA1:	4a214becd642f2bf8df0c118056a217aec073cc5
SHA256:	dac35a874ca47b8de8103ac84b2db9dea4e6b44f9ed2081fcd5bff1143a66d97
Tags:	CobaltStrikeexe
Infos:

Detection

CobaltStrike

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Self deletion via cmd delete

Deletes itself after installation

C2 URLs / IPs found in malware configuration

Yara signature match

Uses code obfuscation techniques (call, push, ret)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

e5#U7248.exe (PID: 7116 cmdline: "C:\Users\user\Desktop\e5#U7248.exe" MD5: 032E7E721DFE5DBC95BB91A3BC2E935C)

POWERPNT.EXE (PID: 3256 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou " MD5: 68F52CD14C61DDC941769B55AE3F2EE9)

e5#U7248.exe (PID: 6884 cmdline: C:\Users\Public\Music\e5#U7248.exe MD5: 032E7E721DFE5DBC95BB91A3BC2E935C)

cmd.exe (PID: 820 cmdline: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp	Cobaltbaltstrike_RAW_Payload_https_stager_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x6fb0:$h01: FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52
0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp	Cobaltbaltstrike_RAW_Payload_https_stager_x64	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52
0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"C2Server": "http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)\r\n"}

Multi AV Scanner detection for submitted file

Source: e5#U7248.exe

Virustotal: Detection: 9%

Perma Link

Source: e5#U7248.exe, 00000001.00000002.534938519.00007FF6C9978000.00000002.00000001.01000000.00000005.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: e5#U7248.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: powerpnt.exe

Memory has grown: Private usage: 5MB later: 117MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828

Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://api.qiniu.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://fusion.qiniuapi.com
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://iovip.qbox.me
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://rs.qbox.me
Source: e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1
Source: e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1-1000
Source: e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1da
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://rs.qbox.mehttp://rsf.qbox.mehttp://api.qiniu.comhttp://fusion.qiniuapi.comhttp://uc.qbox.meht
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://rsf.qbox.me
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://uc.qbox.me
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: http://upload.qiniup.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.aadrm.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.aadrm.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.cortana.ai
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.office.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.onedrive.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://augloop.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cdn.entity.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://config.edge.skype.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cortana.ai
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cortana.ai/api
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://cr.office.com
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: e5#U7248.exe, e5#U7248.exe.1.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dev.cortana.ai
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://devnull.onenote.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://directory.services.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://edu-mathreco-prod.trafficmanager.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://edu-mathsolver-prod.trafficmanager.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://graph.windows.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://graph.windows.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://invites.office.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://lifecycle.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://login.windows.local
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://management.azure.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://management.azure.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://messaging.office.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ncus.contentsync.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://officeapps.live.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://onedrive.live.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://osi.office.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office365.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office365.com/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://roaming.edog.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/
Source: e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631506915.000001C8CA111000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.js
Source: e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.jsT
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://settings.outlook.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://staging.cortana.ai
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://tasks.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://wus2.contentsync.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown

DNS traffic detected: queries for: rs.qbox.me

Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc

Source: e5#U7248.exe, 00000001.00000002.534376130.00000150D0A25000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemsi.dllX vs e5#U7248.exe

Source: e5#U7248.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e5#U7248.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e5#U7248.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e5#U7248.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e5#U7248.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: e5#U7248.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\e5#U7248.exe

Section loaded: sfc.dll

Source: e5#U7248.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\e5#U7248.exe

File read: C:\Users\user\Desktop\e5#U7248.exe

Jump to behavior

Source: e5#U7248.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\e5#U7248.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\e5#U7248.exe "C:\Users\user\Desktop\e5#U7248.exe"
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Users\Public\Music\e5#U7248.exe C:\Users\Public\Music\e5#U7248.exe
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Users\Public\Music\e5#U7248.exe C:\Users\Public\Music\e5#U7248.exe
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul

Source: C:\Users\user\Desktop\e5#U7248.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\e5#U7248.exe

File created: C:\Users\Public\Music\e5#U7248.exe

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE

File created: C:\Users\user\AppData\Local\Temp\{6985FED7-5206-4204-9381-2FB0833DA03B} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal76.troj.winEXE@8/6@3/4

Source: C:\Users\user\Desktop\e5#U7248.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6852:120:WilError_01

Source: e5#U7248.exe	String found in binary or memory: id-cmc-addExtensions
Source: e5#U7248.exe	String found in binary or memory: set-addPolicy
Source: e5#U7248.exe	String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectoryR:\vcpkg\buildtrees\curl\src\url-7_82_0-dc87944d3b.clean\lib\system_win32.ch1h2h3R:\vcpkg\buildtrees\curl\src\url-7_82_0-dc87944d3b.clean\lib\altsvc.c%10s %512s %u %10s %512s %u "%64[^"]" %u %u%s %s %u %s %s %u "%d%02d%02d %02d:%02d:%02d" %u %d

Source: C:\Users\user\Desktop\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Music\e5#U7248.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: e5#U7248.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: e5#U7248.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source: e5#U7248.exe

Static file information: File size 4937216 > 1048576

Source: e5#U7248.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1d6400
Source: e5#U7248.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x224600

Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: e5#U7248.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: e5#U7248.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: e5#U7248.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: e5#U7248.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\Public\Music\e5#U7248.exe

Code function: 12_2_000001C8CA29012B push eax; ret

Source: initial sample	Static PE information: section name: .text entropy: 6.83933595182
Source: initial sample	Static PE information: section name: .text entropy: 6.83933595182

Source: C:\Users\user\Desktop\e5#U7248.exe

File created: C:\Users\Public\Music\e5#U7248.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd delete

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul

Deletes itself after installation

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul

Source: C:\Users\user\Desktop\e5#U7248.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\e5#U7248.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: e5#U7248.exe, 0000000C.00000002.631524645.000001C8CA129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPM
Source: e5#U7248.exe, 0000000C.00000002.631524645.000001C8CA129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp"
Source: e5#U7248.exe, 00000001.00000003.528325841.00000150D0787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,,\|

Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Source: C:\Users\user\Desktop\e5#U7248.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul

Source: C:\Users\user\Desktop\e5#U7248.exe

Code function: 1_2_00007FF6C981CEB0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	12 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 File Deletion	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e5#U7248.exe	9%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
service-ep07djah-1306669097.bj.apigw.tencentcs.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
http://rs.qbox.mehttp://rsf.qbox.mehttp://api.qiniu.comhttp://fusion.qiniuapi.comhttp://uc.qbox.meht	0%	Avira URL Cloud	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.js	0%	Avira URL Cloud	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.jsT	0%	Avira URL Cloud	safe
http://upload.qiniup.com	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://curl.se/docs/alt-svc.html	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
http://fusion.qiniuapi.com	0%	Avira URL Cloud	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
1-1.bj.apigwtencent.com	49.233.94.119	true	false		unknown
kodo-elb-z0.qbox.me	115.231.97.60	true	false		high
service-ep07djah-1306669097.bj.apigw.tencentcs.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
rs.qbox.me	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://service-ep07djah-1306669097.bj.apigw.tencentcs.com:443/bootstrap-2.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://login.microsoftonline.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://shell.suite.office.com:1443	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1	e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://autodiscover-s.outlook.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://roaming.edog.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://cdn.entity.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://powerlift.acompli.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://api.qiniu.com	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://cortana.ai	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.mehttp://rsf.qbox.mehttp://api.qiniu.comhttp://fusion.qiniuapi.comhttp://uc.qbox.meht	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://entitlement.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.aadrm.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1da	e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.js	e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631506915.000001C8CA111000.00000004.00000020.00020000.00000000.sdmp, e5#U7248.exe, 0000000C.00000002.631431570.000001C8CA0A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.microsoftstream.com/api/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://cr.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://graph.ppe.windows.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://officeci.azurewebsites.net/api/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://service-ep07djah-1306669097.bj.apigw.tencentcs.com/bootstrap-2.min.jsT	e5#U7248.exe, 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://upload.qiniup.com	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://globaldisco.crm.dynamics.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://messaging.engagement.office.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dev0-api.acompli.net/autodetect	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://web.microsoftstream.com/video/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://curl.se/docs/alt-svc.html	e5#U7248.exe, e5#U7248.exe.1.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://dataservice.o365filtering.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://ncus.contentsync.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://weather.service.msn.com/data.aspx	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://apis.live.net/v5.0/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://management.azure.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://wus2.contentsync.	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/user/v1.0/ios	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://iovip.qbox.me	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://api.office.net	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://incidents.diagnosticssdf.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://fusion.qiniuapi.com	e5#U7248.exe, e5#U7248.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://entitlement.diagnostics.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rs.qbox.me/chtype/RGJhay9jaGRiOnFpbml1LnBuZw==/type/1-1000	e5#U7248.exe, 00000001.00000002.534004828.00000150D073B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://substrate.office.com/search/api/v2/init	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://outlook.office365.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://webshell.suite.office.com	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
http://rsf.qbox.me	e5#U7248.exe, e5#U7248.exe.1.dr	false		high
https://management.azure.com/	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	335F8B80-9649-4ACE-A711-42A021E2413D.11.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
115.231.97.60	kodo-elb-z0.qbox.me	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
49.233.94.119	1-1.bj.apigwtencent.com	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
180.101.136.19	unknown	China	23650	CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632999
Start date and time: 24/05/202211:17:13	2022-05-24 11:17:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	e5#U7248.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.winEXE@8/6@3/4
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 44.4% (good quality ratio 22.2%) Quality average: 50% Quality standard deviation: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.109.88.177, 52.109.88.38, 52.109.88.40
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, login.live.com, config.officeapps.live.com, sls.update.microsoft.com, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net
Execution Graph export aborted for target e5#U7248.exe, PID 7116 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4937216
Entropy (8bit):	7.3137520514707
Encrypted:	false
SSDEEP:	98304:E0+E9G0Iv7XF4UNcQV1wyw6qjw4y6UlDY2l:RX9G0Iv714Q8Ux6U
MD5:	032E7E721DFE5DBC95BB91A3BC2E935C
SHA1:	4A214BECD642F2BF8DF0C118056A217AEC073CC5
SHA-256:	DAC35A874CA47B8DE8103AC84B2DB9DEA4E6B44F9ED2081FCD5BFF1143A66D97
SHA-512:	B0BEAC870FFBBD7F1B3DCB0586CFF81E543350EC97989A20D87029CEB279D089D80A54EF0F96A390334A45907AE0BF256B9CDBCDE5863A48D23DEEBE1E1B8E4D
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~r..:.y.:.y.:.y._u}...y._uz.6.y._u\|...y.:.y.&.y.....=.y.h{z.3.y..z}.J.y._ux.5.y.:.x...y.h{\|...y.h{}...y..z\|.;.y..z..;.y.:...;.y..z{.;.y.Rich:.y.................PE..d....].b.........."......d...>.................@..............................K...........`..................................................Z'......@).HD"...(..$............K.@]....&...............................&..............................................text...$c.......d.................. ..`.rdata...............h..............@..@.data.........'..2...Z'.............@....pdata...$....(..&....'.............@..@.rsrc...HD"..@)..F"...(.............@..@.reloc..@]....K..^....J.............@..B................................................................................................................................................................................................................

C:\Users\Public\Music\e5#U7248.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\335F8B80-9649-4ACE-A711-42A021E2413D

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	147614
Entropy (8bit):	5.359221740812186
Encrypted:	false
SSDEEP:	1536:dcQk/gxgB5B3guw//Q9DQW+zQWk4F77nXmvidQXxFETLKz6e:jHQ9DQW+zIXQI
MD5:	774458080C9198580CF712EE05A4402E
SHA1:	6FBF80AA9C0E9545AB55F1BEB4AB264827DBBFFC
SHA-256:	DD90BA7F848AE754FDEB057DDBE8052F22A5E724E63E5958B8F2FAA7F503579F
SHA-512:	F4ACD6CFC1A33E4F6D2C7BF6248BEC83608621EB665A2F8A8CE1FC7A337ECE74FE322D665481C4C515F06CFAC2AE6B7F1C7706545D42C94E09A7195B5DBFDACE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-05-24T09:19:11">.. Build: 16.0.15315.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\e5.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue May 24 17:19:07 2022, mtime=Tue May 24 17:19:12 2022, atime=Tue May 24 17:19:07 2022, length=2068461, window=hide
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.707408336825349
Encrypted:	false
SSDEEP:	12:8Z6n19UkWCHo/XsImI+W3actKZijAk/E2m8NySOND8aLbzebzWk44t2Y+xIBjKZm:8ZIPetbAk8kuD3l7aB6m
MD5:	F1BDBB6BC6FDA893D1201A16F5DE6350
SHA1:	51C2BCB3410F422FAF14B6B821EE2A061BD7C9F7
SHA-256:	0A2B16A79A1FC75931BCD7EAC920924D365108F78A317E6011332F930338CDBA
SHA-512:	C3B859615A8047F09D96EBD6A7C15A1EF52CA9BED6F2F31491B6A5DA955D500AF475CE1C269665191F0A5D5C2AAF68C117CD50F5FAA84AB3DBE34CB95AC37BAC
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...O....o..5..o...3..o..............................P.O. .:i.....+00.../C:\...................x.1......N....Users.d......L...TL.....................:.....Q...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....Z.1.....hTz...user..B.......N...TL......S........................e.n.g.i.n.e.e.r.....~.1......Td...Desktop.h.......N...Te......Y..............>......./.D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....h.2.....Td. .E5#U72~1.PPT..L......Td..Td.....N.....................P...e.5.#.U.7.2.4.8...p.p.t.x.......V...............-.......U...........>.S......C:\Users\user\Desktop\e5#U7248.pptx..$.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.e.5.#.U.7.2.4.8...p.p.t.x.........:..,.LB.)...A}...`.......X.......210979...........!a..%.H.VZAj...s.>].........-$..!a..%.H.VZAj...s.>].........-$.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	39
Entropy (8bit):	4.24040510342216
Encrypted:	false
SSDEEP:	3:HLeUm4Wv:HL6
MD5:	CC052D09B391D0854B3541F4821426BE
SHA1:	5C136CE22F57501A7DBCD9DFD01E908C15248C98
SHA-256:	53CABBF3DD7F4576F525C5B43A7A6BEC7A00CA1F7DF21CD33502EFB59090BEBA
SHA-512:	EB514552C627DA42B1E6420FB0C21E34C6E2BD8141ECAB7C9634B3A3BCE3AE2439C21662DB4A8752FE2F5DBED83779633833F6AD9887EA5A6C3CFDB95A270024
Malicious:	false
Reputation:	low
Preview:	[misc]..e5.LNK=0..[folders]..e5.LNK=0..

C:\Users\user\Desktop\e5#U7248.pptx

Download File

Process:	C:\Users\user\Desktop\e5#U7248.exe
File Type:	Microsoft PowerPoint 2007+
Category:	modified
Size (bytes):	2068461
Entropy (8bit):	7.8112893691004865
Encrypted:	false
SSDEEP:	49152:uVFtwyfYBMRhxUjw4yTO6yLYO19JKLlooTYF8pl0:u1wyw6qjw4y6UlDY2l0
MD5:	3BBBC2FD0ACA510B778DE111409A3047
SHA1:	670F28428DAD6ACB57093F7A8C1D04DED167CBD1
SHA-256:	8E1F4B3779DC4DF4F7BF624AF91C4ABA042100651A6F2D41081F90BA3664463A
SHA-512:	FA80EFA24E920C89DBFC6107F21665C99AD997A44F96F93F127AEB742527F9CD72771A0192DE4E4647D8E5C074075B4B728B14861891073E7B4ECDB2ACAE9D47
Malicious:	false
Preview:	PK..........!.. H.c...T.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................]o. ...'.?X.N1...n..}\.R........5.~.NZ.rj....(..{.d...yvuW.d..0)2D.)J@.`b.._._'.(1...r) C[0.j....v..$.Z....U.16..JjR.@....%.n..X../].>.N.q...a'..@..gX.5..;w.!Qb..O.U.XY.W.qg....!.Dw..n..P.8.u.x#.G{......z.Y1e..G2T3....~...Y..5...-....J.qq...i..T.X.....K....J~0LK..~..`.w..Sc.ai...d-.AL;.0..!8.N.6:.......G'..Np...Ct.2.....I\|[$.}..7F...I\|k$..7G.....`.5dk0.K....V...k..:...u..GV.^k.L....#.0....^......._..Q..f..9..-.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.3137520514707
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e5#U7248.exe
File size:	4937216
MD5:	032e7e721dfe5dbc95bb91a3bc2e935c
SHA1:	4a214becd642f2bf8df0c118056a217aec073cc5
SHA256:	dac35a874ca47b8de8103ac84b2db9dea4e6b44f9ed2081fcd5bff1143a66d97
SHA512:	b0beac870ffbbd7f1b3dcb0586cff81e543350ec97989a20d87029ceb279d089d80a54ef0f96a390334a45907ae0bf256b9cdbcde5863a48d23deebe1e1b8e4d
SSDEEP:	98304:E0+E9G0Iv7XF4UNcQV1wyw6qjw4y6UlDY2l:RX9G0Iv714Q8Ux6U
TLSH:	2536DF1AAAA508E4DCB6C23886565633E7B1BC15277167EB03E0F6771F33AD11E3A704
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~r..:.y.:.y.:.y._u}...y._uz.6.y._u\|...y.:.y.&.y.....=.y.h{z.3.y..z}.J.y._ux.5.y.:.x...y.h{\|...y.h{}...y..z\|.;.y..z..;.y.:...;.y

File Icon


Icon Hash:	30868c8c8c868830

Static PE Info

General

Entrypoint:	0x14007c5bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x628B5D9D [Mon May 23 10:10:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	62a5dd25af85564e3aeb55c6407225e3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F49B89ACA30h
dec eax
add esp, 28h
jmp 00007F49B89ABFBFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F49B89AC151h
dec eax
mov ecx, ebx
call 00007F49B8A93A2Ah
test eax, eax
je 00007F49B89AC155h
dec eax
mov ecx, ebx
call 00007F49B8A8675Ah
dec eax
test eax, eax
je 00007F49B89AC129h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F49B89AC148h
call 00007F49B89ACDF8h
int3
call 00007F49B89ACE12h
int3
jmp 00007F49B89ACE2Ch
int3
int3
int3
jmp 00007F49B89AC0FCh
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F49B89AC152h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F49B89AC155h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F49B89AC14Dh
movzx eax, byte ptr [ecx+eax+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x275a04	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x294000	0x224448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x281000	0x12498	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b9000	0x5d40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x261b80	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x261ba0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d8000	0x710	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d6324	0x1d6400	False	0.528704499767	data	6.83933595182	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1d8000	0x9f0d4	0x9f200	False	0.43268699676	data	5.72254467214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x278000	0x81b0	0x3200	False	0.236875	DOS executable (block device driver ght (c)	3.22425146815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x281000	0x12498	0x12600	False	0.487417623299	data	6.1747245461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x294000	0x224448	0x224600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b9000	0x5d40	0x5e00	False	0.264710771277	data	5.44086201759	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
FILE_DATA	0x2bc080	0x1f8fed	Microsoft PowerPoint 2007+	Chinese	China
FILE_DATA	0x4b5070	0x31aa	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 285x180, frames 3	Chinese	China
RT_ICON	0x2944b0	0x2e8	data	Chinese	China
RT_ICON	0x294798	0x128	GLS_BINARY_LSB_FIRST	Chinese	China
RT_ICON	0x2948c0	0x1628	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x295ee8	0xea8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x296d90	0x8a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x297638	0x568	GLS_BINARY_LSB_FIRST	Chinese	China
RT_ICON	0x297ba0	0x10ef	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China
RT_ICON	0x298c90	0x94a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2a2138	0x67e8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2a8920	0x5488	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2adda8	0x4228	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b1fd0	0x3a48	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b5a18	0x25a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b7fc0	0x1a68	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2b9a28	0x10a8	dBase III DBT, version number 0, next free block index 40	Chinese	China
RT_ICON	0x2baad0	0x988	data	Chinese	China
RT_ICON	0x2bb458	0x6b8	data	Chinese	China
RT_ICON	0x2bbb10	0x468	GLS_BINARY_LSB_FIRST	Chinese	China
RT_GROUP_ICON	0x2bbf78	0x102	data	Chinese	China
RT_MANIFEST	0x4b8220	0x224	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
SHELL32.dll	SHGetSpecialFolderPathA, ShellExecuteExW, SHChangeNotify, ShellExecuteA
USER32.dll	SendMessageW, GetProcessWindowStation, GetUserObjectInformationW, MessageBoxW, LoadIconW
KERNEL32.dll	TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, CreateFileA, GetFileInformationByHandle, ReadFile, CloseHandle, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleExW, GetStdHandle, GetFileType, WriteFile, DeleteFiber, ConvertFiberToThread, FreeLibrary, LoadLibraryA, LoadLibraryW, FindClose, FindFirstFileW, FindNextFileW, GetConsoleMode, SetConsoleMode, TlsGetValue, ReadConsoleW, GetDriveTypeW, CreateThread, RtlUnwind, VerifyVersionInfoW, VerSetConditionMask, WaitForMultipleObjects, GetEnvironmentVariableA, WaitForSingleObjectEx, MoveFileExA, GetModuleHandleA, GetSystemDirectoryA, QueryPerformanceFrequency, SleepEx, Sleep, InitializeCriticalSectionEx, SetEndOfFile, WriteConsoleW, HeapSize, GetFullPathNameW, GetCurrentDirectoryW, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, CreateFileW, IsValidCodePage, FindFirstFileExW, GetTimeZoneInformation, HeapReAlloc, SetFilePointerEx, GetFileSizeEx, GetConsoleCP, FlushFileBuffers, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, HeapAlloc, TlsAlloc, SwitchToThread, InitializeCriticalSectionAndSpinCount, SetLastError, DecodePointer, EncodePointer, MultiByteToWideChar, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, WideCharToMultiByte, FormatMessageW, GetLastError, GetConsoleWindow, CopyFileA, lstrcatW, WinExec, lstrcpyW, FindResourceW, SizeofResource, LockResource, LoadResource, GetModuleFileNameW, GetModuleFileNameA, VirtualAlloc, SetPriorityClass, SetThreadPriority, GetCurrentThread, GetCurrentProcess, GetShortPathNameW, GetEnvironmentVariableW, ExitThread, FreeLibraryAndExitThread, GetFileAttributesExW, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadConsoleA, DeleteFileW, RtlPcToFileHeader, RaiseException, RtlUnwindEx, LoadLibraryExW, ExitProcess, SetConsoleCtrlHandler, HeapFree
bcrypt.dll	BCryptGenRandom
WS2_32.dll	WSAIoctl, htons, getpeername, select, __WSAFDIsSet, WSAWaitForMultipleEvents, WSAResetEvent, WSAEnumNetworkEvents, WSACreateEvent, WSACloseEvent, socket, setsockopt, listen, connect, inet_pton, bind, WSAEventSelect, WSASetLastError, send, recv, freeaddrinfo, getaddrinfo, WSAGetLastError, WSACleanup, WSAStartup, ntohs, getsockopt, getsockname, ioctlsocket, ntohl, htonl, recvfrom, sendto, gethostname, closesocket, accept
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertGetCertificateContextProperty, CertFreeCertificateContext, CertDuplicateCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore
ADVAPI32.dll	CryptEncrypt, CryptImportKey, CryptHashData, CryptGenRandom, CryptGetHashParam, CryptAcquireContextA, CryptEnumProvidersW, CryptSignHashW, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptGetUserKey, CryptGetProvParam, CryptSetHashParam, CryptDestroyKey, CryptReleaseContext, CryptAcquireContextW, ReportEventW, RegisterEventSourceW, DeregisterEventSource

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2022 11:18:25.255116940 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:28.353368998 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:34.356031895 CEST	49753	80	192.168.2.6	115.231.97.60
May 24, 2022 11:18:46.356165886 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:18:49.370821953 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:18:55.371294975 CEST	49774	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:11.680466890 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:14.716696024 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:20.717226028 CEST	49789	80	192.168.2.6	180.101.136.19
May 24, 2022 11:19:32.720256090 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:35.718535900 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:41.718998909 CEST	49794	80	192.168.2.6	115.231.97.60
May 24, 2022 11:19:56.655518055 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.655560970 CEST	443	49828	49.233.94.119	192.168.2.6
May 24, 2022 11:19:56.655685902 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.828752995 CEST	49828	443	192.168.2.6	49.233.94.119
May 24, 2022 11:19:56.828783035 CEST	443	49828	49.233.94.119	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2022 11:18:25.229048014 CEST	56591	53	192.168.2.6	8.8.8.8
May 24, 2022 11:18:25.248784065 CEST	53	56591	8.8.8.8	192.168.2.6
May 24, 2022 11:19:11.638067007 CEST	51194	53	192.168.2.6	8.8.8.8
May 24, 2022 11:19:11.659339905 CEST	53	51194	8.8.8.8	192.168.2.6
May 24, 2022 11:19:55.040888071 CEST	55083	53	192.168.2.6	8.8.8.8
May 24, 2022 11:19:55.348397970 CEST	53	55083	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 24, 2022 11:18:25.229048014 CEST	192.168.2.6	8.8.8.8	0xa156	Standard query (0)	rs.qbox.me	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.638067007 CEST	192.168.2.6	8.8.8.8	0xe907	Standard query (0)	rs.qbox.me	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.040888071 CEST	192.168.2.6	8.8.8.8	0x9872	Standard query (0)	service-ep07djah-1306669097.bj.apigw.tencentcs.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	rs.qbox.me	kodo-elb-z0.qbox.me		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	kodo-elb-z0.qbox.me		115.231.97.60	A (IP address)	IN (0x0001)
May 24, 2022 11:18:25.248784065 CEST	8.8.8.8	192.168.2.6	0xa156	No error (0)	kodo-elb-z0.qbox.me		180.101.136.19	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	rs.qbox.me	kodo-elb-z0.qbox.me		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	kodo-elb-z0.qbox.me		180.101.136.19	A (IP address)	IN (0x0001)
May 24, 2022 11:19:11.659339905 CEST	8.8.8.8	192.168.2.6	0xe907	No error (0)	kodo-elb-z0.qbox.me		115.231.97.60	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	service-ep07djah-1306669097.bj.apigw.tencentcs.com	1-1.bj.apigwtencent.com		CNAME (Canonical name)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	1-1.bj.apigwtencent.com		49.233.94.119	A (IP address)	IN (0x0001)
May 24, 2022 11:19:55.348397970 CEST	8.8.8.8	192.168.2.6	0x9872	No error (0)	1-1.bj.apigwtencent.com		140.143.115.153	A (IP address)	IN (0x0001)

Target ID:	1
Start time:	11:18:23
Start date:	24/05/2022
Path:	C:\Users\user\Desktop\e5#U7248.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\e5#U7248.exe"
Imagebase:	0x7ff6c97a0000
File size:	4937216 bytes
MD5 hash:	032E7E721DFE5DBC95BB91A3BC2E935C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: POWERPNT.EXEPID: 3256, Parent PID: 7116

General

Target ID:	11
Start time:	11:19:09
Start date:	24/05/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\e5#U7248.pptx" /ou "
Imagebase:	0x1040000
File size:	1849008 bytes
MD5 hash:	68F52CD14C61DDC941769B55AE3F2EE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: e5#U7248.exePID: 6884, Parent PID: 7116

General

Target ID:	12
Start time:	11:19:09
Start date:	24/05/2022
Path:	C:\Users\Public\Music\e5#U7248.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Music\e5#U7248.exe
Imagebase:	0x7ff79e5b0000
File size:	4937216 bytes
MD5 hash:	032E7E721DFE5DBC95BB91A3BC2E935C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64, Description: Detects CobaltStrike payloads, Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000C.00000002.631477810.000001C8CA0EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x64, Description: Detects CobaltStrike payloads, Source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000C.00000002.631567397.000001C8CA290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: cmd.exePID: 820, Parent PID: 7116

General

Target ID:	16
Start time:	11:19:41
Start date:	24/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\e5#U7248.exe > nul
Imagebase:	0x7ff6edbd0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 6852, Parent PID: 820

General

Target ID:	19
Start time:	11:19:45
Start date:	24/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6406f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e5#U7248.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Music\e5#U7248.exe

C:\Users\Public\Music\e5#U7248.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\335F8B80-9649-4ACE-A711-42A021E2413D

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\e5.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\Desktop\e5#U7248.pptx

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
e5#U7248.exe