flash

704.doc

Status: finished
Submission Time: 22.11.2021 13:06:52
Malicious
Exploiter
Evader
Trojan
Emotet

Comments

Tags

Details

  • Analysis ID:
    526268
  • API (Web) ID:
    893788
  • Analysis Started:
    22.11.2021 13:15:10
  • Analysis Finished:
    22.11.2021 13:28:47
  • MD5:
    40f85d07da2533d576b1f2d7c043a2da
  • SHA1:
    60b84d70a6511483c6de131fb62e30a99edff5c4
  • SHA256:
    d05ec2a0134518ec74fcbee94a522c3837d82b7b5d2f162b8466850fc4f1be0d
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
92/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Potential for more IOCs and behavior

malicious
100/100

malicious

IPs

IP Country Detection
60.248.112.145
Taiwan; Republic of China (ROC)
148.72.96.3
United States

Domains

Name IP Detection
primtalent.com
148.72.96.3
huskysb.com
60.248.112.145

URLs

Name Detection
http://ckfoods.net/wp-admin/wPInm2rgMu/
http://ridcyf.com/dm7vg/DGWFrJA0kutWTk/
http://manak.edunetfoundation.org/school-facilitator/qlwM2RAHhDG8N8/
Click to see the 97 hidden entries
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/
http://primtalent.com/wp-admin/9yt1u/
http://adorwelding.zmotpro.com/wp-content/Z8ifMTCM2VBWlfeSZmzv/
https://api.aadrm.com/
https://ofcrecsvcapi-int.azurewebsites.net/
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
https://api.microsoftstream.com/api/
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
https://cr.office.com
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
https://portal.office.com/account/?ref=ClientMeControl
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://graph.ppe.windows.net
https://res.getmicrosoftkey.com/api/redemptionevents
https://powerlift-frontdesk.acompli.net
https://tasks.office.com
https://officeci.azurewebsites.net/api/
https://sr.outlook.office.net/ws/speech/recognize/assistant/work
https://store.office.cn/addinstemplate
http://pesterbdd.com/images/Pester.png
https://api.aadrm.com
http://www.apache.org/licenses/LICENSE-2.0.html
https://go.micro
https://outlook.office.com/autosuggest/api/v1/init?cvid=
https://globaldisco.crm.dynamics.com
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://dev0-api.acompli.net/autodetect
https://www.odwebp.svc.ms
https://api.powerbi.com/v1.0/myorg/groups
https://web.microsoftstream.com/video/
https://api.addins.store.officeppe.com/addinstemplate
https://graph.windows.net
https://dataservice.o365filtering.com/
https://github.com/Pester/Pester
https://officesetup.getmicrosoftkey.com
https://analysis.windows.net/powerbi/api
https://prod-global-autodetect.acompli.net/autodetect
https://outlook.office365.com/autodiscover/autodiscover.json
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
https://ncus.contentsync.
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
http://weather.service.msn.com/data.aspx
https://apis.live.net/v5.0/
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/.Split/p
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
https://management.azure.com
https://outlook.office365.com
http://huskysb.com/cgi-sys/suspendedpage.cgi
https://wus2.contentsync.
https://incidents.diagnostics.office.com
https://clients.config.office.net/user/v1.0/ios
https://insertmedia.bing.office.net/odc/insertmedia
https://o365auditrealtimeingestion.manage.office.com
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/tp
https://outlook.office365.com/api/v1.0/me/Activities
https://api.office.net
https://incidents.diagnosticssdf.office.com
https://asgsmsproxyapi.azurewebsites.net/
https://clients.config.office.net/user/v1.0/android/policies
https://entitlement.diagnostics.office.com
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
https://substrate.office.com/search/api/v2/init
https://outlook.office.com/
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/deXnG/.Split.Split
https://storage.live.com/clientlogs/uploadlocation
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/h
https://outlook.office365.com/
https://webshell.suite.office.com
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
https://substrate.office.com/search/api/v1/SearchHistory
https://api.diagnosticssdf.office.com
https://login.microsoftonline.com/
https://shell.suite.office.com:1443
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
https://autodiscover-s.outlook.com/
https://roaming.edog.
http://server.zmotpro.com/venkat/products/facebook-page/assets/kmIdeXnG/XnG/.Splitplits/
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
https://cdn.entity.
https://api.addins.omex.office.net/appinfo/query
https://clients.config.office.net/user/v1.0/tenantassociationkey
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
https://powerlift.acompli.net
https://rpsticket.partnerservices.getmicrosoftkey.com
https://lookup.onenote.com/lookup/geolocation/v1
https://cortana.ai
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
https://cloudfiles.onenote.com/upload.aspx
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
https://entitlement.diagnosticssdf.office.com
https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
http://huskysb.com4

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\~DF0E259767A8C316A9.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\Desktop\~$704.doc
data
#
C:\Users\user\Documents\20211122\PowerShell_transcript.405464.2vRpjg5W.20211122132242.txt
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
#
Click to see the 15 hidden entries
C:\ProgramData\646848703.dll
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ED19ABEB-CDF2-44DC-A6F4-0F73FB78CE80
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\665C8B7A.png
PNG image data, 1127 x 490, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{AF20B67A-97C1-4448-B2F6-AF3A3498FB76}.tmp
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{35810410-5FD3-47F2-B08A-1DE17B8BA882}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{62016A81-8420-4F16-89A1-1259E0199215}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A2B54B36-922B-4491-AD33-70B4A37C30C5}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1xa3wtq.jvy.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qrskvuat.dwv.psm1
very short file (no magic)
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\704.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:51 2020, mtime=Mon Nov 22 11:22:37 2021, atime=Mon Nov 22 11:22:33 2021, length=136531, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Little-endian UTF-16 Unicode text, with CR line terminators
#