Edit tour

Windows Analysis Report
Client Query.docx

Overview

General Information

Sample Name:	Client Query.docx
Analysis ID:	751349
MD5:	24f52154d5888129af9de7636294c421
SHA1:	0a33d2b45723fafe57bc673c0637c563cb851918
SHA256:	772018897f11e02786891d354839b2574fffc98bfa69afccd295b2620536c80f
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 2560 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)

chrome.exe (PID: 128 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,11372630972955660951,662453779972926978,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

AcroRd32.exe (PID: 6876 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\modern-slavery-reporting-entities.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 7108 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

chrome.exe (PID: 2148 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0 HTTP/1.1Host: nam04.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /criminal-justice/files/modern-slavery-reporting-entities.pdf HTTP/1.1Host: www.homeaffairs.gov.auConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,11372630972955660951,662453779972926978,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\modern-slavery-reporting-entities.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,11372630972955660951,662453779972926978,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\modern-slavery-reporting-entities.pdf	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Client Query.docx	Initial sample: OLE zip file path = docProps/thumbnail.emf
Source: Client Query.docx	Initial sample: OLE zip file path = docProps/custom.xml

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	13 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
accounts.google.com	172.217.168.45	true	false		high
nam04.safelinks.protection.outlook.com	104.47.73.28	true	false		high
www.google.com	172.217.168.68	true	false		high
clients.l.google.com	142.250.203.110	true	false		high
www.homeaffairs.gov.au	164.97.249.143	true	false	0%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://login.microsoftonline.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://shell.suite.office.com:1443	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://autodiscover-s.outlook.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://cdn.entity.	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://powerlift.acompli.net	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://cortana.ai	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.aadrm.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.microsoftstream.com/api/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://cr.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://graph.ppe.windows.net	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://officeci.azurewebsites.net/api/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.scheduler.	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://globaldisco.crm.dynamics.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://messaging.engagement.office.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-	~WRS{6A93DE8D-0FE7-472F-B8E0-F8E7B50E70D9}.tmp.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://dev0-api.acompli.net/autodetect	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://web.microsoftstream.com/video/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://dataservice.o365filtering.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://ncus.contentsync.	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
http://weather.service.msn.com/data.aspx	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://apis.live.net/v5.0/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://messaging.lifecycle.office.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://management.azure.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://outlook.office365.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://wus2.contentsync.	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.office.net	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://incidents.diagnosticssdf.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://entitlement.diagnostics.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://substrate.office.com/search/api/v2/init	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://outlook.office.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://outlook.office365.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://webshell.suite.office.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://management.azure.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://messaging.lifecycle.office.com/getcustommessage16	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://devnull.onenote.com	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high
https://messaging.action.office.com/	4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	false		high

Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.office.net
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://api.scheduler.
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 4785E8DB-383B-4743-AC9F-61E164EEB144.0.dr	String found in binary or memory: https://augloop.office.com

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
104.47.73.28	nam04.safelinks.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
164.97.249.143	www.homeaffairs.gov.au	Australia	38470	DIBP-AS-APDIBPAU	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	751349
Start date and time:	2022-11-22 05:32:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Client Query.docx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.winDOCX@38/58@6/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0 Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	ATT28136.html	Get hash	malicious	Browse
	http://etac-roinx.co-jp.butterbean.com.cn	Get hash	malicious	Browse
	https://smartsafetygroup.com/	Get hash	malicious	Browse
	ATT03674.html	Get hash	malicious	Browse
	070 (2).html	Get hash	malicious	Browse
	https://email.franchisedirect.com/Prod/link-tracker?redirectUrl=aHR0cDovL3B0LjhlYW1pLmpoYndkaWYuY28vdXMvYnJvZ2Vyc0Bjb21mb3J0ZWNoLmNvbQ==&sig=3xdB8e6J4pnNd8YNaMuk2BQtsg3xZRbEsZ9B7zrxCaDe&iat=1667571426&a=%7C%7C649518235%7C%7C&account=https%3A%2F%2Fwww.google.com&email=gyRMXpx%2BKJbHl%2BXq5LNC5w%2FoAQY7wIKwevAKcx2CvIo%3D&s=be72a29c71989238fcc9e3727911b5ee&i=10601A11048A16A13442	Get hash	malicious	Browse
	payment.html	Get hash	malicious	Browse
	https://email.franchisedirect.com/prod/link-tracker?redirectUrl=aHR0cDovL3B0LjhlYW1pLmpoYndkaWYuY28vdXMvYnJvZ2Vyc0Bjb21mb3J0ZWNoLmNvbQ==&sig=3xdB8e6J4pnNd8YNaMuk2BQtsg3xZRbEsZ9B7zrxCaDe&iat=1667571426&a=%7C%7C649518235%7C%7C&account=https%3A%2F%2Fwww.google.com&email=gyRMXpx%2BKJbHl%2BXq5LNC5w%2FoAQY7wIKwevAKcx2CvIo%3D&s=be72a29c71989238fcc9e3727911b5ee&i=10601A11048A16A13442	Get hash	malicious	Browse
	#U266c voice0989876_3-2(4).hTm	Get hash	malicious	Browse
	http://tiktok.o3v45.top/1TjTEwq	Get hash	malicious	Browse
	tmp381D.vbs	Get hash	malicious	Browse
	https://bit.ly/3AlHcU6	Get hash	malicious	Browse
	https://sherlock.scribblelive.com/r?u=https://pollongq.world/zt/htzpsnag1117h5/e/z/x/%3Fdragoness%3Dks&monuments=xx&episcopacy=p	Get hash	malicious	Browse
	https://softtouch.se/sluss.asp?sou=123456&med=5&typ=1&tar=http://04ildd.codesandbox.io?af=U2hhaWsuRmFpemFsQGhlc3MuY29t	Get hash	malicious	Browse
	https://bafybeih3dy7w65mldsqiyfma6jiydfiwwrwsyddcwrjrdlj5ckou4v65vm.ipfs.w3s.link/vosm.html	Get hash	malicious	Browse
	https://firebasestorage.googleapis.com/v0/b/assycompley.appspot.com/o/to8gx2vknjuca5k78f82.html?alt=media&token=72a430fd-e9c7-4932-8cf0-a213a64254df#name@gmail.com	Get hash	malicious	Browse
	https://xhdtsb3f.proventtus.com/#eWF2dXouemFtYW5AZGlnaXR1cmsuY29tLnRy	Get hash	malicious	Browse
	https://us-west-2.protection.sophos.com/?d=gingrapp.com&u=aHR0cDovL2VtYWlsLm1haWxndW4uZ2luZ3JhcHAuY29tL2MvZUp4VXpFOVBnekFZZ1BGUFUyNlEwZ0tGQXdkMVlZa3hHbzNMbHQzZXZuM0xjT1dQTGJETlQyOTI4T0Q5ZVg2bUJzcEZYa1JVcDBWUmNWa1ZQSXRPZFpXcFFtZFNZeVUwbGtxVnFTV3JVc3FGaFZTQ2lycWFTeVdrUklxdEZpck9DNEZ4bVJzVjI5SVl3eXVORWkzTGVBLWRhNWNoYWJ1aDlUQk5DWTU5NU9yVFBFOU1QakRSTU5GUTRzRjBTMEFZd01DOVlLTDVvREF1SG1rWG9LVUV3blJsc2xtOFkzTHpiNVpQT185endPSHktWFpPZXBwaEpSOW9HZzFDbUVNU19qd201SEhfdk9yaHZPaXQ0Mlo3ZGNnZnYyRl83T2xnVnV5djU1Zi1kZFh2bk1sTjVHdlM0M0JMWERmUGpnTEwtRmRuN2UweWVtZnU0RzhBQUFEX18xVXJaWXM=&i=NjBlN2U0YjcyYzU4ZjEwZjVlMTAxOGEw&t=REpubjFoRjROWXdoaWZPRktrS0dXSWN5R3l3N0IvNDFSSUdaZmk1KzdvYz0=&h=c48938bfb13e497e8706340db09941a4&s=AVNPUEhUT0NFTkNSWVBUSVY7uy5ifmEVJg80a0a5KrC1bMbgSP5ZWgOuGGz--wPrL_2DpnmRxkU2uRIOtWRYzs3sFvyJ8ESaRm6Tz-d67nZMJv1hgw7CQOVESxq3uFSAtQ	Get hash	malicious	Browse
	VoiceVM Audio Transcription.htm	Get hash	malicious	Browse
	Notification of ACH payment On Monday November 21 2022.msg	Get hash	malicious	Browse
104.47.73.28	https://nam04.safelinks.protection.outlook.com/ap/b-59584e83/?url=https%3A%2F%2Fnetorg3439085-my.sharepoint.com%2F%3Ab%3A%2Fg%2Fpersonal%2Ferik_lclus_com%2FEbbgJpcXbPFPlp-fRbLltSsB0cVNwfAMIER1Ku0MD0h4iw%3Fe%3D4%253avTrNvg%26at%3D9&data=05%7C01%7Cjcoburn%40appliedi.net%7Cc4a066acaedd41e5d0ae08da39041a60%7Cda28472f8ac44cc6b221371d17bee970%7C0%7C0%7C637884987775822734%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=qQR4A7jPf4QYmJ2%2Fwiy9c2uh3L4ArqkqLPDcxHaNl%2Bw%3D&reserved=0	Get hash	malicious	Browse

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.6647027446212626
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuVl/wU1yRktU+fXiTFJrqzOJkvP5m1:men9YOFLvEWdM9QbUHtU+vi7Z+P41
MD5:	5E3F1659AD32F825B7169074D36805C6
SHA1:	68CA292A9FEFE1BD20AAA3B424E36EA6967480FB
SHA-256:	B86ED7A239CB90633CD7A2752EFED6C3D4A2805B6C481619A00472170FF5D98C
SHA-512:	9B87D2E4747C561DE0D3EF16AF4A6FD5D244D0AD2137E83A1E8EC7AE9254549F50E04462F74300BE01A5563F96CEAE3312DA1CAA456A3AB14A4A336D6BC22229
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .....L/....."#.D.1K.3..A.A..Eo......6+..............d.{v.^.G...d.W.:...P..k%..A..Eo..................

Process:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149710
Entropy (8bit):	5.359443413029752
Encrypted:	false
SSDEEP:	1536:OL+C7/gUMB5BQguw/BQ9DQe+zQVk4F77nXmvid3XRcE6Lcz6S:L5Q9DQe+zCXzJ
MD5:	2FF3800710237D561C21F2C86D80B638
SHA1:	6D03D862AFFF5F0FEB57E4F809DACFCE937D64B7
SHA-256:	81111B58AC8DCD1F550289B3D1AB3145873EF0F56FBFA172A6F1EE9770EF97B7
SHA-512:	9E9BA918B9644185A986C88AE21FE9715BF351590EB7CB0F07052E7B038A11D87053BA9880492266F396ED53B6AB370AFF6B3747289DF084F2B55B5E5FB852FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2022-11-22T04:33:06">.. Build: 16.0.15913.30526-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.5 (zip deflate encoded)
Category:	dropped
Size (bytes):	13967
Entropy (8bit):	7.940864427331845
Encrypted:	false
SSDEEP:	192:9iS46xa/RA0Hq0CDqXM7/12hFsfA3JuxQVCDcTK8OUh8YIXRaoSd9R5r2XscTD7Z:9Xxa/W0HvXe/gLsfuJinWz8YEWMXs4x
MD5:	D7D523998E107028A5E915802C5AC259
SHA1:	A7F8D262D76E7A720B1A4B766CC6CE8F0CBB0A64
SHA-256:	42A4F8D26C6F44B94D0C0D5BA30ABE6119A8C16CBA8089376FD8ADD6EE722287
SHA-512:	19C83178F57AEA5B9E9D0F50FAF4179C9DBF0E007CD2FC6C5C7F1317067794315E96774A17FB98C1195DCCB5EB1279A5669D79E5A33F21C8A879AF2C9E4D6F63
Malicious:	false
Preview:	%PDF-1.5.%......4001 0 obj.<</Linearized 1/L 1746526/O 4003/E 173896/N 96/T 1745458/H [ 470 758]>>.endobj. ..4008 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<056C7E0C08E5F2DBF3639B584976DA2E><1C0F47C28661F84782AB05D5B5F07DBC>]/Index[4001 15]/Info 4000 0 R/Length 55/Prev 1745459/Root 4002 0 R/Size 4016/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`..$....Q .l."...&. ......o.d100b%..2...`..p....endstream.endobj.startxref..0..%%EOF.. ..4015 0 obj.<</C 992/Filter/FlateDecode/I 1015/Length 661/O 976/S 922>>stream..h..S.K.Q....72...Aw.Y..-.....`..`'.U.....r...Tt7.E}0...LA...V..Wp.e+zHj7....._.E...b.Cw..............".e...L.......J..+=... ...?T.....]..+...*...C...?...+;.m.'}HOJE..Y.[...{..\|...\........Gza.sKG.....3.wL.....m....F.C.L.VJ..e..'.@.........S.z..5k#...."....l.sh:<.....E....S.W..-T;~............U.yCRl..B6;.Q,E.\|,.nN..?:.y.6;...s8..I..X<}..k.s...V. .:...U.W[Pq..hg(...#... .$..RQX..!..:......_6.Myy..L...w&..%...xr.....s...x

File type:	Microsoft Word 2007+
Entropy (8bit):	7.762432869499085
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	Client Query.docx
File size:	37398
MD5:	24f52154d5888129af9de7636294c421
SHA1:	0a33d2b45723fafe57bc673c0637c563cb851918
SHA256:	772018897f11e02786891d354839b2574fffc98bfa69afccd295b2620536c80f
SHA512:	89e2c0196035848f159d804b8fb14a70187c88db633bd7cc509aacd27757cb88c8f530605a296ebf2569d75fc546f42c09561875d1fdaa4138ed27005c34ea6d
SSDEEP:	768:VBlpGTEPc85SvY4CTxllNh27Reb9qv6bf4X3P50wOVTgrexDsFonL2+Uy:dpGTETSCTBjo2q6DAG7grSwFoLr
TLSH:	66F2E1A6C141781AEF01A17DC40E11E532098C55E2B9B9EA7D49F3D91AD08B363DC2DE
File Content Preview:	PK..........!.A.......^.......[Content_Types].xml ...(.........................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2022 05:33:48.191394091 CET	56924	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:33:48.193614006 CET	60625	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:33:48.195554972 CET	49302	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:33:48.218617916 CET	53	56924	8.8.8.8	192.168.2.3
Nov 22, 2022 05:33:48.220927000 CET	53	60625	8.8.8.8	192.168.2.3
Nov 22, 2022 05:33:48.366307974 CET	53	49302	8.8.8.8	192.168.2.3
Nov 22, 2022 05:33:48.404571056 CET	53975	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:33:48.444392920 CET	53	53975	8.8.8.8	192.168.2.3
Nov 22, 2022 05:33:50.485090017 CET	57134	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:33:50.502322912 CET	53	57134	8.8.8.8	192.168.2.3
Nov 22, 2022 05:35:48.373759985 CET	65196	53	192.168.2.3	8.8.8.8
Nov 22, 2022 05:35:48.400952101 CET	53	65196	8.8.8.8	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2022-11-22 04:33:48 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
2022-11-22 04:33:48 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-11-22 04:33:49 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 22 Nov 2022 04:33:48 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-N06IpOjoj9rSTfqmhEANcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-22 04:33:49 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-11-22 04:33:49 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-11-22 04:33:48 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-11-22 04:33:49 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-fL1Flon3bZf0IBitcpazrg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 22 Nov 2022 04:33:48 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5803 X-Daystart: 74028 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-11-22 04:33:49 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 30 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 37 34 30 32 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5803" elapsed_seconds="74028"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-11-22 04:33:49 UTC	2	IN	Data Raw: 6d 78 76 59 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 Data Ascii: mxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" si
2022-11-22 04:33:49 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-11-22 04:33:49 UTC	4	OUT	GET /?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0 HTTP/1.1 Host: nam04.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-11-22 04:33:50 UTC	5	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://www.homeaffairs.gov.au/criminal-justice/files/modern-slavery-reporting-entities.pdf Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: DM6NAM04WS036 X-ServerVersion: 15.20.5834.008 X-ServerLat: 965 X-SafeLinks-Tracking-Id: 826b0eb6-89cb-4667-d308-08dacc42c069 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Date: Tue, 22 Nov 2022 04:33:49 GMT Connection: close Content-Length: 208
2022-11-22 04:33:50 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 6d 65 61 66 66 61 69 72 73 2e 67 6f 76 2e 61 75 2f 63 72 69 6d 69 6e 61 6c 2d 6a 75 73 74 69 63 65 2f 66 69 6c 65 73 2f 6d 6f 64 65 72 6e 2d 73 6c 61 76 65 72 79 2d 72 65 70 6f 72 74 69 6e 67 2d 65 6e 74 69 74 69 65 73 2e 70 64 66 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.homeaffairs.gov.au/criminal-justice/files/modern-slavery-reporting-entities.pdf">here</a>.</h2></body></html>

Target ID:	0
Start time:	05:33:04
Start date:	22/11/2022
Path:	C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xa60000
File size:	1937688 bytes
MD5 hash:	0B9AB9B9C4DE429473D6450D4297A123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Client Query.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Windows Analysis Report
Client Query.docx

Target ID:	10
Start time:	05:33:37
Start date:	22/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	11
Start time:	05:33:38
Start date:	22/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,11372630972955660951,662453779972926978,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	12
Start time:	05:33:40
Start date:	22/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.homeaffairs.gov.au%2Fcriminal-justice%2Ffiles%2Fmodern-slavery-reporting-entities.pdf&data=05%7C01%7Crevathy.kumar%40inmobi.com%7Cd60b95bbd397482a082608dabe4e2946%7C89359cf49e60409980c4775a0cfe27a7%7C0%7C0%7C638031540157593767%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Y%2BFt7EyZOufQunHcYbjJuLH74tU1HgaJFGJRvpo4%2Ff4%3D&reserved=0
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	13
Start time:	05:33:59
Start date:	22/11/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Downloads\modern-slavery-reporting-entities.pdf
Imagebase:	0x10000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	14
Start time:	05:34:11
Start date:	22/11/2022
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x1f0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre