Windows Analysis Report
SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf
Analysis ID:	680530
MD5:	a5b0c571197ee2931e12f11caf138eff
SHA1:	a4355fe45e321b99274f8000c5ac9c08f7146b28
SHA256:	00915bcbff87b2e195e1547df8e1944cadcdc6aa46beb130bd5a960dff01c7e3
Tags:	rtf
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Malicious sample detected (through community Yara rule)

Office process drops PE file

PE file has nameless sections

Machine Learning detection for dropped file

Found suspicious RTF objects

Found potential equation exploit (CVE-2017-11882)

PE file contains section with special chars

Yara signature match

Drops PE files

PE file contains sections with non-standard names

Found dropped PE file which has not been started or loaded

Classification

Signatures

AV Detection

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Joe Sandbox ML: detected

Exploits

Found potential equation exploit (CVE-2017-11882)

Source:

Static RTF information: Object: 1 Offset: 001E86A2h

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: Client.exe.0.dr

Jump to dropped file

Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.aadrm.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.office.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.onedrive.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.entity.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cortana.ai/api
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cr.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://directory.services.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.windows.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.windows.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://invites.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.local
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://management.azure.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://management.azure.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officeapps.live.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://osi.office.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://roaming.edog.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://settings.outlook.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://tasks.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Malicious sample detected (through community Yara rule)

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE

Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

PE file has nameless sections

Source: Client.exe.0.dr

Static PE information: section name:

Found suspicious RTF objects

Source: Client.exe

Static RTF information: Object: 0 Offset: 0000129Ah Client.exe

PE file contains section with special chars

Source: Client.exe.0.dr

Static PE information: section name: sn=><v

Yara signature match

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE	Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: Client.exe.0.dr

Static PE information: Section: sn=><v ZLIB complexity 1.000335151627219

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{4B604896-050E-40FE-8028-EE011E929FDA} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal88.expl.winRTF@1/9@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Static file information: File size 2920194 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

PE file contains sections with non-standard names

Source: Client.exe.0.dr	Static PE information: section name: sn=><v
Source: Client.exe.0.dr	Static PE information: section name:

Source: initial sample

Static PE information: section name: sn=><v entropy: 7.999482172506492

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F79DE4CE-3D38-4A51-B300-A0A52CA0A936	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	524DEB669CBD12BFA0E862F9FB78CCDC	4FAC81AE9AD7B129C238661E0E4F781E9ABC91B3	BDD825B56D52BE60C4D50616B97EB23E3DE3BCB9D883AF7ED68395685AF4507B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C94F2438-4712-4EDB-BA13-F546C0F4C19F}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D3E63778-DEB8-4D19-866C-1D5344BC51ED}.tmp	data	2508CC81F5E9247B80C4FB3781394285	453AC54E5038EF8D30A585EB885652468B0992A4	5A1936A4E61EFDCA38F71EE6AE93A7537F589F2A2B2B71D898B2877ECE3374FC
C:\Users\user\AppData\Local\Temp\Client.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	599BB05227A88A5C83E36E05D67DA0EA	663EBDC243BDF990D2950A0BCAB08CF316BDFF50	2D63CA0053F446B5531AA5703C136586CEC0635994FD5DEE51DF7FE51DF58EB4
C:\Users\user\AppData\Local\Temp\Client.exe:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:46 2022, mtime=Tue Aug 9 00:52:12 2022, atime=Tue Aug 9 00:52:07 2022, length=2920194, window=hide	1F66D0046017517FBB298B785E458174	0763BC76E9899DEC36D8826F7F3292883DF62A87	D7D8FD1FD7E7918E65B21C3DE6BC78E74E0B01154E28815821D2184C47A0333D
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	3E8AC3467A1477A539CDEA8189236AAB	B66B713170E5B6356C249C6B0FDDBA263BA536C8	F3DAE50CE58EF48DA30BD29C3450F9E9F6A9D86DBD807630025B85F767A3CC3B
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	667567BDE1E565AE3CCC8C2482092094	701815E43A23F2B76A9ED83E489BCA8EB3616D86	FD5B9F8A37DB674A9EBE5D295443329E72DD1EA9F9B37E41A724652FF6F74C84
C:\Users\user\Desktop\~$curiteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf	data	667567BDE1E565AE3CCC8C2482092094	701815E43A23F2B76A9ED83E489BCA8EB3616D86	FD5B9F8A37DB674A9EBE5D295443329E72DD1EA9F9B37E41A724652FF6F74C84

AV Detection

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Client.exe

Joe Sandbox ML: detected

Exploits

Found potential equation exploit (CVE-2017-11882)

Source:

Static RTF information: Object: 1 Offset: 001E86A2h

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: Client.exe.0.dr

Jump to dropped file

Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.aadrm.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.office.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.onedrive.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.entity.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cortana.ai/api
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://cr.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://directory.services.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.windows.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://graph.windows.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://invites.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.local
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://management.azure.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://management.azure.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://messaging.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officeapps.live.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://osi.office.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://roaming.edog.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://settings.outlook.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://tasks.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: F79DE4CE-3D38-4A51-B300-A0A52CA0A936.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Malicious sample detected (through community Yara rule)

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE

Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

PE file has nameless sections

Source: Client.exe.0.dr

Static PE information: section name:

Found suspicious RTF objects

Source: Client.exe

Static RTF information: Object: 0 Offset: 0000129Ah Client.exe

PE file contains section with special chars

Source: Client.exe.0.dr

Static PE information: section name: sn=><v

Yara signature match

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE	Matched rule: MAL_RTF_Embedded_OLE_PE date = 2018-01-22, author = Florian Roth, description = Detects a suspicious string often used in PE files in a hex encoded object stream, reference = https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: Client.exe.0.dr

Static PE information: Section: sn=><v ZLIB complexity 1.000335151627219

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{4B604896-050E-40FE-8028-EE011E929FDA} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal88.expl.winRTF@1/9@0/0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Static file information: File size 2920194 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

PE file contains sections with non-standard names

Source: Client.exe.0.dr	Static PE information: section name: sn=><v
Source: Client.exe.0.dr	Static PE information: section name:

Source: initial sample

Static PE information: section name: sn=><v entropy: 7.999482172506492

Drops PE files

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Client.exe

Jump to dropped file

ID:	680530
Product:	CloudBasic
Start time:	18:51:07
Start date:	08.08.2022
Sample:	SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a5b0c571197ee2931e12f11caf138eff
SHA1:	a4355fe45e321b99274f8000c5ac9c08f7146b28
SHA256:	00915bcbff87b2e195e1547df8e1944cadcdc6aa46beb130bd5a960dff01c7e3
Filetype:	Rich Text Format (5005/1) 55.56%

Windows Analysis Report
SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2764.rtf