Windows Analysis Report
actionplan doc 08.11.doc

Overview

General Information

Sample Name:	actionplan doc 08.11.doc
Analysis ID:	682622
MD5:	933338ca2c25cfda5c124455216d6709
SHA1:	e518d12b7bb4addf1dc041a05575031890c1b4d7
SHA256:	abc8d1097f0249c749f2c7d7058be1b39c88e21d26d45d76985c989289565214
Tags:	docIcedID
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Multi AV Scanner detection for submitted file

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (UrlDownloadToFile)

Machine Learning detection for sample

Potential document exploit detected (unknown TCP traffic)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: actionplan doc 08.11.doc	Virustotal: Detection: 25%			Perma Link
Source: actionplan doc 08.11.doc	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Source: actionplan doc 08.11.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.8.146.139 45.8.146.139

Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139

Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.aadrm.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.office.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.entity.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cr.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://directory.services.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.windows.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://invites.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.local
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://management.azure.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://management.azure.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://osi.office.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://roaming.edog.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://tasks.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" button on W a the top bar, and then click "Enable content'. * W 30 words O Type
Source: Screenshot number: 4	Screenshot OCR: Enable content'. * W 30 words O Type here to search ~ m % - I + 100% Ki E a a g wg sf ^ 7'

Document contains an embedded VBA macro with suspicious strings

Source: actionplan doc 08.11.doc	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("qAzbQdWy"), VbGet, )
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((PtrvEuptBv("k_qlfnX9")), PtrvEuptBv("FobMNFqWtNq6a"), VbGet, PtrvEuptBv("SLkPoakd"))
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("gwno4Ujnar"), VbGet, )
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("qAzbQdWy"), VbGet, )
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((PtrvEuptBv("k_qlfnX9")), PtrvEuptBv("FobMNFqWtNq6a"), VbGet, PtrvEuptBv("SLkPoakd"))
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("gwno4Ujnar"), VbGet, )

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: actionplan doc 08.11.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Private Sub Document_Open()

Document contains embedded VBA macros

Source: actionplan doc 08.11.doc	OLE indicator, VBA macros: true
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DFB9753BB74160ACC2.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: actionplan doc 08.11.doc	Virustotal: Detection: 25%
Source: actionplan doc 08.11.doc	ReversingLabs: Detection: 17%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: actionplan doc 08.11.doc.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\actionplan doc 08.11.doc

Source: actionplan doc 08.11.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{13205001-C936-4608-8D1A-874754E1770F} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal68.expl.winDOC@1/11@0/1

Source: actionplan doc 08.11.doc	OLE document summary: title field not present or empty
Source: actionplan doc 08.11.doc	OLE document summary: author field not present or empty
Source: actionplan doc 08.11.doc	OLE document summary: edited time not present or 0
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: actionplan doc 08.11.doc

Initial sample: OLE zip file path = docProps/custom.xml

Source: actionplan doc 08.11.doc

Static file information: File size 2349822 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.8.146.139	unknown	Russian Federation		44676	VMAGE-ASRU	false

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D87A3441-42E7-470D-8213-35F5C80D216F	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	4582F5FAFB337D9880EE6CC198D3BDE6	AD377A39C53710BAAAD5469225E0405416DF6964	DC19BED1A1ED161E8CEFF63CCED101D42D5EC3DBC5F82296F969BEBD35738D69
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\541FF1C0.png	PNG image data, 440 x 440, 8-bit/color RGBA, non-interlaced	303B22B7FFAF96496093E5DB3938B563	672080C107AACED7AB0D77E5AA3055ECBFA494DC	AEF779CE0BA64FA155A6867374198754FCADABCBEB5C378A67A6B6846B18F0BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C0CEAFFB.png	PNG image data, 636 x 613, 8-bit/color RGB, non-interlaced	E0B30095BE35E9494E5073277D4FC1A1	19D39B036989A331F5389E377FBE565436599894	EA952A68D25232D981CDBE0CD6DA947A9386D4BFFD5D1BE2EF80C4A1246AC3E2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{34D97BE2-6C3D-4A31-9A42-1C2930589F97}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5481821B-5863-4C7A-B07B-A94021ED3E0F}.tmp	data	025EBE58F9C92597094D86E039A32D58	D73979ED793C0A2A5BBB4AE7CBCE87D0D0973F88	8EB62112275DABF61C8A732F94C221C2936FB70C59400691BC7D5033F630CCFA
C:\Users\user\AppData\Local\Temp\~DFB9753BB74160ACC2.TMP	Composite Document File V2 Document, Cannot read section info	BFCAF8C73B6D8C5066D7F24701F0EE46	9AAE0FF40B0D8C153821B78850CEC520B9384252	E7B12BDA7ADA8E9A4986AC19889F0097BA45A55868C3A4412568C11A2DF94D46
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\actionplan doc 08.11.doc.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:51 2022, mtime=Fri Aug 12 01:30:30 2022, atime=Fri Aug 12 01:30:23 2022, length=2255878, window=hide	C30CC9DF59856DA55386307A74B29BFA	C351F45B549A94AF7CE61D1A290EBC60798D6E61	0C639BE5480FAF3DFB60483792E03D6F773BD1491BC15A2365ABB1FA76607603
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	6F46005AE28DCF91A0D2E8B1C5CC2836	576E750FA407E8C607E0EA7D7BCBCECDF870CC8E	D5D7E37F9B82ADDA77309B477841C70E1149867892550D83932EBFAF62838C1D
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	271404C277BE351846F1D2E391194A8A	1659AFB75C2891123C311854DD3B0ED67B128C63	AB3149234C6FC6B172CE41CA125F4D5340F36ECD8DED607F784D7856B5885165
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex	Little-endian UTF-16 Unicode text, with no line terminators	F3B25701FE362EC84616A93A45CE9998	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
C:\Users\user\Desktop\~$tionplan doc 08.11.doc	data	271404C277BE351846F1D2E391194A8A	1659AFB75C2891123C311854DD3B0ED67B128C63	AB3149234C6FC6B172CE41CA125F4D5340F36ECD8DED607F784D7856B5885165

AV Detection

Multi AV Scanner detection for submitted file

Source: actionplan doc 08.11.doc	Virustotal: Detection: 25%			Perma Link
Source: actionplan doc 08.11.doc	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Source: actionplan doc 08.11.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 45.8.146.139:80

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.8.146.139 45.8.146.139

Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139

Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.aadrm.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.office.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.entity.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://cr.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://directory.services.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.windows.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://invites.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.local
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://management.azure.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://management.azure.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://osi.office.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://roaming.edog.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://tasks.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: D87A3441-42E7-470D-8213-35F5C80D216F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" button on W a the top bar, and then click "Enable content'. * W 30 words O Type
Source: Screenshot number: 4	Screenshot OCR: Enable content'. * W 30 words O Type here to search ~ m % - I + 100% Ki E a a g wg sf ^ 7'

Document contains an embedded VBA macro with suspicious strings

Source: actionplan doc 08.11.doc	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("qAzbQdWy"), VbGet, )
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((PtrvEuptBv("k_qlfnX9")), PtrvEuptBv("FobMNFqWtNq6a"), VbGet, PtrvEuptBv("SLkPoakd"))
Source: actionplan doc 08.11.doc	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("gwno4Ujnar"), VbGet, )
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("qAzbQdWy"), VbGet, )
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((PtrvEuptBv("k_qlfnX9")), PtrvEuptBv("FobMNFqWtNq6a"), VbGet, PtrvEuptBv("SLkPoakd"))
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Set = CallByName((), PtrvEuptBv("gwno4Ujnar"), VbGet, )

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: actionplan doc 08.11.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE, VBA macro line: Private Sub Document_Open()

Document contains embedded VBA macros

Source: actionplan doc 08.11.doc	OLE indicator, VBA macros: true
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~DFB9753BB74160ACC2.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: actionplan doc 08.11.doc	Virustotal: Detection: 25%
Source: actionplan doc 08.11.doc	ReversingLabs: Detection: 17%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: actionplan doc 08.11.doc.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\actionplan doc 08.11.doc

Source: actionplan doc 08.11.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{13205001-C936-4608-8D1A-874754E1770F} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal68.expl.winDOC@1/11@0/1

Source: actionplan doc 08.11.doc	OLE document summary: title field not present or empty
Source: actionplan doc 08.11.doc	OLE document summary: author field not present or empty
Source: actionplan doc 08.11.doc	OLE document summary: edited time not present or 0
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFB9753BB74160ACC2.TMP.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: actionplan doc 08.11.doc

Initial sample: OLE zip file path = docProps/custom.xml

Source: actionplan doc 08.11.doc

Static file information: File size 2349822 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

ID:	682622
Product:	CloudBasic
Start time:	19:29:09
Start date:	11.08.2022
Sample:	actionplan doc 08.11.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	933338ca2c25cfda5c124455216d6709
SHA1:	e518d12b7bb4addf1dc041a05575031890c1b4d7
SHA256:	abc8d1097f0249c749f2c7d7058be1b39c88e21d26d45d76985c989289565214
Filetype:	Word Microsoft Office Open XML Format document (49504/1) 49.01%

Windows Analysis Report
actionplan doc 08.11.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report actionplan doc 08.11.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
actionplan doc 08.11.doc