Windows Analysis Report
INVOICE.doc

Overview

General Information

Sample Name:	INVOICE.doc
Analysis ID:	635245
MD5:	0ecb6ed891d173443fa3654c31e14320
SHA1:	6867f37817db501ce103813f791899f3cf1bc1e8
SHA256:	f080b3ba979f854761526f4bc6bd5b8210b48d5f91f15b1a1423849107775e11
Tags:	doc
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Office process drops PE file

PE file has nameless sections

Machine Learning detection for dropped file

Found suspicious RTF objects

Found potential equation exploit (CVE-2017-11882)

Yara signature match

PE file contains strange resources

Drops PE files

PE file contains sections with non-standard names

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: INVOICE.doc	Virustotal: Detection: 50%			Perma Link
Source: INVOICE.doc	ReversingLabs: Detection: 19%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Client.exe	ReversingLabs: Detection: 51%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Joe Sandbox ML: detected

Exploits

Found potential equation exploit (CVE-2017-11882)

Source:

Static RTF information: Object: 1 Offset: 00207238h

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: Client.exe.0.dr

Jump to dropped file

Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.office.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.entity.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cr.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://directory.services.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://edu-mathreco-prod.trafficmanager.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://edu-mathsolver-prod.trafficmanager.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.windows.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://invites.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.local
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://management.azure.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://management.azure.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://osi.office.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://roaming.edog.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://tasks.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Malicious sample detected (through community Yara rule)

Source: INVOICE.doc, type: SAMPLE

Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

PE file has nameless sections

Source: Client.exe.0.dr

Static PE information: section name:

Found suspicious RTF objects

Source: Client.exe

Static RTF information: Object: 0 Offset: 0000128Dh Client.exe

Yara signature match

Source: INVOICE.doc, type: SAMPLE	Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: INVOICE.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

PE file contains strange resources

Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file contains executable resources (Code or Archives)

Source: Client.exe.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Client.exe.0.dr

Static PE information: Section: VU3rezH ZLIB complexity 1.00032784598

Source: INVOICE.doc	Virustotal: Detection: 50%
Source: INVOICE.doc	ReversingLabs: Detection: 19%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{391F884A-0DF2-4CC0-811D-5EA2088E6DC9} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.expl.winDOC@1/9@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INVOICE.doc

Static file information: File size 4073082 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

PE file contains sections with non-standard names

Source: Client.exe.0.dr	Static PE information: section name: VU3rezH
Source: Client.exe.0.dr	Static PE information: section name:

Source: initial sample	Static PE information: section name: VU3rezH entropy: 7.99954491412
Source: initial sample	Static PE information: section name: .text entropy: 6.88898241318

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\55500104-7BA4-450F-B5B6-9FAE4E02D958	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	E6E619CAC3C39DDB4DF743FBB9E139B8	F0328034164567F1678649AA8011D8CB0148FA43	97C06E65DEDC51DC2BEE938FD6EDA3686C703A8D2B426651126407E9BA05EFCF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{182A308B-3928-43D2-96AF-DFBDDED8FBB8}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E6ECC2FB-A299-4715-927D-C678F6A7F37A}.tmp	data	2508CC81F5E9247B80C4FB3781394285	453AC54E5038EF8D30A585EB885652468B0992A4	5A1936A4E61EFDCA38F71EE6AE93A7537F589F2A2B2B71D898B2877ECE3374FC
C:\Users\user\AppData\Local\Temp\Client.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	75C0471CCE805B589FDAF81D8D1D646C	28D5C23AB236A28376A64446EECC4B8068E71F51	8C867636633BAB72230AB4F4123B1B37244A8325B40230947CDFD7EC3CC0C686
C:\Users\user\AppData\Local\Temp\Client.exe:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\INVOICE.doc.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:48 2022, mtime=Fri May 27 23:50:46 2022, atime=Fri May 27 23:50:35 2022, length=4073082, window=hide	3EA0F315A0A439B5E34C51407CD469C5	37D2487C125033E60E48C1267FACF8AB67D7DEC5	2133D5285C52293619238103AC07FE60A8EDD1AA9B73DB4DC4265BE33CB46F68
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	5F789C623A9E8963E95B26CF07AFF5BF	7CD0106ECA31151951F4ADF9AFDB882DA0844F7B	ACB5F625725B1D77B6E7C1466E32D4227A4A5925BD1B6AB9458B6D3BD9F113F3
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	47F4DEA953CAF4684FDC3334445ACB04	C73E8ABB4806188C2DDF6FA5197CCD10E0743EAB	EF91A0506BBAA9010B05BAAE67FD1165A83FD2705907EE01B67E3675279EF930
C:\Users\user\Desktop\~$NVOICE.doc	data	47F4DEA953CAF4684FDC3334445ACB04	C73E8ABB4806188C2DDF6FA5197CCD10E0743EAB	EF91A0506BBAA9010B05BAAE67FD1165A83FD2705907EE01B67E3675279EF930

AV Detection

Multi AV Scanner detection for submitted file

Source: INVOICE.doc	Virustotal: Detection: 50%			Perma Link
Source: INVOICE.doc	ReversingLabs: Detection: 19%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Client.exe	Metadefender: Detection: 31%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Client.exe	ReversingLabs: Detection: 51%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Joe Sandbox ML: detected

Exploits

Found potential equation exploit (CVE-2017-11882)

Source:

Static RTF information: Object: 1 Offset: 00207238h

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: Client.exe.0.dr

Jump to dropped file

Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.office.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.entity.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://cr.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://directory.services.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://edu-mathreco-prod.trafficmanager.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://edu-mathsolver-prod.trafficmanager.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.windows.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://invites.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.local
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://management.azure.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://management.azure.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://osi.office.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://roaming.edog.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://tasks.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 55500104-7BA4-450F-B5B6-9FAE4E02D958.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Malicious sample detected (through community Yara rule)

Source: INVOICE.doc, type: SAMPLE

Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

PE file has nameless sections

Source: Client.exe.0.dr

Static PE information: section name:

Found suspicious RTF objects

Source: Client.exe

Static RTF information: Object: 0 Offset: 0000128Dh Client.exe

Yara signature match

Source: INVOICE.doc, type: SAMPLE	Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: INVOICE.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

PE file contains strange resources

Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Client.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file contains executable resources (Code or Archives)

Source: Client.exe.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Client.exe.0.dr

Static PE information: Section: VU3rezH ZLIB complexity 1.00032784598

Source: INVOICE.doc	Virustotal: Detection: 50%
Source: INVOICE.doc	ReversingLabs: Detection: 19%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{391F884A-0DF2-4CC0-811D-5EA2088E6DC9} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.expl.winDOC@1/9@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INVOICE.doc

Static file information: File size 4073082 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

PE file contains sections with non-standard names

Source: Client.exe.0.dr	Static PE information: section name: VU3rezH
Source: Client.exe.0.dr	Static PE information: section name:

Source: initial sample	Static PE information: section name: VU3rezH entropy: 7.99954491412
Source: initial sample	Static PE information: section name: .text entropy: 6.88898241318

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

ID:	635245
Product:	CloudBasic
Start time:	17:49:26
Start date:	27.05.2022
Sample:	INVOICE.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0ecb6ed891d173443fa3654c31e14320
SHA1:	6867f37817db501ce103813f791899f3cf1bc1e8
SHA256:	f080b3ba979f854761526f4bc6bd5b8210b48d5f91f15b1a1423849107775e11
Filetype:	Rich Text Format (5005/1) 55.56%

Windows Analysis Report
INVOICE.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report INVOICE.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
INVOICE.doc