Edit tour

Windows Analysis Report
sipari#U015f listem05.08.2022.docx

Overview

General Information

Sample Name:	sipari#U015f listem05.08.2022.docx
Analysis ID:	679326
MD5:	578f0e48afff4fa6927f146b2c6c1cf3
SHA1:	112b4c96c4f74e5ef7c89110e59a499068cfcad9
SHA256:	c26c99eeb30da221f74dd0951f4b8de0207e5801b64cd8d2a1abf1f906668096
Tags:	doc

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Document contains OLE streams which likely are hidden ActiveX objects

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 5648 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sipari#U015f listem05.08.2022.docx

Avira: detected

Multi AV Scanner detection for submitted file

Source: sipari#U015f listem05.08.2022.docx

Virustotal: Detection: 11%

Perma Link

Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.aadrm.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.cortana.ai
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.office.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.onedrive.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://augloop.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cdn.entity.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cortana.ai
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cortana.ai/api
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://cr.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://directory.services.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://graph.windows.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://graph.windows.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://invites.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://login.windows.local
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://management.azure.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://management.azure.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://messaging.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://officeapps.live.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://onedrive.live.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://osi.office.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office365.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://roaming.edog.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://settings.outlook.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://tasks.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Document contains OLE streams which likely are hidden ActiveX objects

Source: sipari#U015f listem05.08.2022.docx

Stream path '\x1Ole10Native' : }....LWIUYVBDKUVBFDRISCAUKOOOQJFJFEMOPLYGCTLMWKNTJ

Source: sipari#U015f listem05.08.2022.docx

Virustotal: Detection: 11%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{9919F576-CC7F-4662-A8CF-06F49BA3F72D} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: classification engine

Classification label: mal64.winDOCX@1/4@0/0

Source: sipari#U015f listem05.08.2022.docx

OLE document summary: title field not present or empty

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: sipari#U015f listem05.08.2022.docx

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: sipari#U015f listem05.08.2022.docx

Initial sample: OLE zip file path = word/media/image3.emf

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source: sipari#U015f listem05.08.2022.docx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Source: sipari#U015f listem05.08.2022.docx

Stream path '\x1Ole10Native' entropy: 7.99551584633 (max. 8.0)

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sipari#U015f listem05.08.2022.docx	11%	Virustotal		Browse
sipari#U015f listem05.08.2022.docx	100%	Avira	EXP/JAVA.Banload.VPDV.Gen

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://roaming.edog.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://ncus.pagecontentsync.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://login.microsoftonline.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://shell.suite.office.com:1443	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://autodiscover-s.outlook.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://roaming.edog.	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://cdn.entity.	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://powerlift.acompli.net	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://cortana.ai	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.aadrm.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.microsoftstream.com/api/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://cr.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://graph.ppe.windows.net	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://officeci.azurewebsites.net/api/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://my.microsoftpersonalcontent.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://globaldisco.crm.dynamics.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://messaging.engagement.office.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://dev0-api.acompli.net/autodetect	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://web.microsoftstream.com/video/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://dataservice.o365filtering.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://ncus.contentsync.	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
http://weather.service.msn.com/data.aspx	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://apis.live.net/v5.0/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://messaging.lifecycle.office.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://management.azure.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://outlook.office365.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://wus2.contentsync.	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.office.net	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://incidents.diagnosticssdf.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://entitlement.diagnostics.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://substrate.office.com/search/api/v2/init	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://outlook.office.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://outlook.office365.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://webshell.suite.office.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://management.azure.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://messaging.lifecycle.office.com/getcustommessage16	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://devnull.onenote.com	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://messaging.action.office.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://ncus.pagecontentsync.	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false	URL Reputation: safe	unknown
https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://messaging.office.com/	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high
https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	FEE1FF08-6372-4F5E-B77E-8B1036D21086.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679326
Start date and time: 05/08/202215:36:46	2022-08-05 15:36:46 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	sipari#U015f listem05.08.2022.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.winDOCX@1/4@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Errors

Corrupt sample or wrongly selected analyzer.

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 52.109.88.191, 52.109.88.40, 52.109.88.37
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, config.officeapps.live.com, sls.update.microsoft.com, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FEE1FF08-6372-4F5E-B77E-8B1036D21086

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	148061
Entropy (8bit):	5.358160448370312
Encrypted:	false
SSDEEP:	1536:mcQW/gxgB5BQguwN/Q9DQe+zQTk4F77nXmvid3XxVETLKz61:51Q9DQe+zuXYr
MD5:	89DD65D17C922D42CC79EDCFF4E69BCF
SHA1:	D36F4C52EAF15AFD69D1618385A5EA7661D59BE9
SHA-256:	1E4FA482027F0E3DD76E55C519C451FD8B628959EBE00170D6B2C0C780F76DDA
SHA-512:	72C861E04396A989E5E1E26D01D26B4502EA5F0C1761A6FD2517106B15C53F4539272313F788F50014052EAC2F374B387BB88D00ED80D6CCC057574B97909C7D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-08-05T13:37:47">.. Build: 16.0.15601.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C4A0D4C5-C5DA-4A24-9991-AB9B5D1C0938}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.1323987084273686
Encrypted:	false
SSDEEP:	3:Rl/ZdN6XMltv96HYvttlt6Xzl2v/n:RtZP6X86HYH6Xzlq
MD5:	5968B23EC3B7FB576B56890A8D8FDCB7
SHA1:	6349CDDE4C2DAF04E33788A3F9A204EFC3358793
SHA-256:	22F33ABD70C2ED1E3434D4DFEA5CB897C225EDFEC5AF1FFEF482A84944D8A0FD
SHA-512:	6BEE21BA6C6553BB7FDB313A2E347295EA41D3A416755117470B241CD19CAD3214BFD406834C3E1A57EA1B0289B3E61FF056D9C01AB7705180D3B127DD683F9C
Malicious:	false
Reputation:	low
Preview:	.pratesh................................................p.r.a.t.e.s.h.........y_j.F)..........................u_n.3*..........................q_r..+..............

C:\Users\user\Desktop\~$pari#U015f listem05.08.2022.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.1323987084273686
Encrypted:	false
SSDEEP:	3:Rl/ZdN6XMltv96HYvttlt6Xzl2v/n:RtZP6X86HYH6Xzlq
MD5:	5968B23EC3B7FB576B56890A8D8FDCB7
SHA1:	6349CDDE4C2DAF04E33788A3F9A204EFC3358793
SHA-256:	22F33ABD70C2ED1E3434D4DFEA5CB897C225EDFEC5AF1FFEF482A84944D8A0FD
SHA-512:	6BEE21BA6C6553BB7FDB313A2E347295EA41D3A416755117470B241CD19CAD3214BFD406834C3E1A57EA1B0289B3E61FF056D9C01AB7705180D3B127DD683F9C
Malicious:	false
Reputation:	low
Preview:	.pratesh................................................p.r.a.t.e.s.h.........y_j.F)..........................u_n.3*..........................q_r..+..............

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.981533951389543
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	sipari#U015f listem05.08.2022.docx
File size:	313830
MD5:	578f0e48afff4fa6927f146b2c6c1cf3
SHA1:	112b4c96c4f74e5ef7c89110e59a499068cfcad9
SHA256:	c26c99eeb30da221f74dd0951f4b8de0207e5801b64cd8d2a1abf1f906668096
SHA512:	eea66103dc92fb676d983b06e98fdde25c70d25e14e2618d533d0a1e1ea2989f7e97219a670a348bee4ac95c5e67443366c5212d9ceae8c8fc843cc1bed9ebaf
SSDEEP:	6144:ssqlRSPLKGm5u5acjKnkk/DiQ3kKibOopOaxCJ9cOIbo03:7+GLqqjKnkvQ3Jib94aIJ9cOS3
TLSH:	EE642263D0240BADF4666E3CC76C1522E35AD4B3A99193053A86BEFDD702FFA46C084D
File Content Preview:	PK..........!.........T.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	74fcd0d2d6d6d0cc

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/679326/sample/sipari#U015f listem05.08.2022.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	MICROSOFT
Template:	Normal.dotm
Last Saved By:	MICROSOFT
Revion Number:	1
Total Edit Time:	1
Create Time:	2022-08-05T07:47:00Z
Last Saved Time:	2022-08-05T07:48:00Z
Number of Pages:	1
Number of Words:	3
Number of Characters:	21
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	14.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 72

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	72
Entropy:	3.8231129765226823
Base64 Encoded:	False
Data ASCII:	. . . . . . . / . { . . . Z @ . . . . P a c k a g e . . . . . . . . . P a c k a g e . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 a7 0d f2 2f c0 ce 11 92 7b 08 00 09 5a e3 40 08 00 00 00 50 61 63 6b 61 67 65 00 00 00 00 00 08 00 00 00 50 61 63 6b 61 67 65 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 173953

General
Stream Path:	\x1Ole10Native
File Type:	data
Stream Size:	173953
Entropy:	7.995515846329769
Base64 Encoded:	True
Data ASCII:	} . . . . L W I U Y V B D K U V B F D R I S C A U K O O O Q J F J F E M O P L Y G C T L M W K N T J Q K D . J A R . C : \\ U s e r s \\ M I C R O S O F T \\ A p p D a t a \\ L o c a l \\ M i c r o s o f t \\ W i n d o w s \\ I N e t C a c h e \\ C o n t e n t . W o r d \\ L W I U Y V B D K U V B F D R I S C A U K O O O Q J F J F E M O P L Y G C T L M W K N T J Q K D . J A R . . . . . . . . C : \\ U s e r s \\ M I C R O S ~ 1 \\ A p p D a t a \\ L o c a l \\ T e m p \\ { E F 6 6 F A 5 B - F 6 8 5 - 4 C 2 B - 8 C 3 2 - A 9
Data Raw:	7d a7 02 00 02 00 4c 57 49 55 59 56 42 44 4b 55 56 42 46 44 52 49 53 43 41 55 4b 4f 4f 4f 51 4a 46 4a 46 45 4d 4f 50 4c 59 47 43 54 4c 4d 57 4b 4e 54 4a 51 4b 44 2e 4a 41 52 00 43 3a 5c 55 73 65 72 73 5c 4d 49 43 52 4f 53 4f 46 54 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 49 4e 65 74 43 61 63 68 65 5c 43 6f 6e 74 65 6e 74 2e

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
File Type:	data
Stream Size:	6
Entropy:	1.7924812503605778
Base64 Encoded:	False
Data ASCII:	@ . . . . .
Data Raw:	40 00 03 00 01 00

Network Behavior

⊘No network behavior found

Statistics

⊘No statistics

System Behavior

Analysis Process: WINWORD.EXEPID: 5648, Parent PID: 756

General

Target ID:	0
Start time:	15:37:45
Start date:	05/08/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x1260000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sipari#U015f listem05.08.2022.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FEE1FF08-6372-4F5E-B77E-8B1036D21086

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C4A0D4C5-C5DA-4A24-9991-AB9B5D1C0938}.tmp

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\Desktop\~$pari#U015f listem05.08.2022.docx

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/679326/sample/sipari#U015f listem05.08.2022.docx"

Indicators

Summary

Document Summary

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 72

General

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 173953

General

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General

Network Behavior

Statistics

System Behavior

Analysis Process: WINWORD.EXEPID: 5648, Parent PID: 756

General

Disassembly

Windows Analysis Report
sipari#U015f listem05.08.2022.docx