Edit tour

Windows Analysis Report
RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg

Overview

General Information

Sample name:	RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg renamed because original name is a hash value
Original sample name:	RE New Order PO-EST-57601450_36KV XLPE Materials-300mm.eml.msg
Analysis ID:	1436916
MD5:	08b202cf0ee64aad0d5088cc5ea558b8
SHA1:	8adeab72d5a1b6f8d8662f8b9031aa345fab25b4
SHA256:	1f9d35a383258ae9eae909c373e191f1ac621c7a7cd7154f169f8c171deccdc5
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6156 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 3552 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "90DF6AE3-D7D7-42EF-B1BC-F3109C112C66" "172A97E9-E7B8-4157-A6F4-F4E71DE45BFC" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

notepad.exe (PID: 3312 cmdline: C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt MD5: E92D3A824A0578A50D2DD81B5060145F)

notepad.exe (PID: 6840 cmdline: C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt MD5: E92D3A824A0578A50D2DD81B5060145F)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: classification engine

Classification label: clean1.winMSG@7/14@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240506T1841560478-6156.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "90DF6AE3-D7D7-42EF-B1BC-F3109C112C66" "172A97E9-E7B8-4157-A6F4-F4E71DE45BFC" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "90DF6AE3-D7D7-42EF-B1BC-F3109C112C66" "172A97E9-E7B8-4157-A6F4-F4E71DE45BFC" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436916
Start date and time:	2024-05-06 18:41:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg renamed because original name is a hash value
Original Sample Name:	RE New Order PO-EST-57601450_36KV XLPE Materials-300mm.eml.msg
Detection:	CLEAN
Classification:	clean1.winMSG@7/14@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, prevhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 40.79.197.34, 52.109.16.52
Excluded domains from analysis (whitelisted): ecs.office.com, fs.microsoft.com, us1.odcsm1.live.com.akadns.net, odc.officeapps.live.com, slscr.update.microsoft.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, ncus-000.odc.officeapps.live.com, onedscolprdjpe01.japaneast.cloudapp.azure.com, ecs.office.trafficmanager.net, osiprod-ncus-bronze-public-000.northcentralus.cloudapp.azure.com, mobile.events.data.trafficmanager.net, prod.odcsm1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.393919311843336
Encrypted:	false
SSDEEP:	1536:r1YLqrgs/K3vX3gpUgs6HNcAz79ysQqt2hMxYqoQQ7rcm0Fv2WCyophja+Ux2LU0:Gmg1HVgTmiGu2fqoQsrt0FvJQ5HCM76M
MD5:	C6B22243E0CCDDBEEF0F96F156CB1CC9
SHA1:	2544CD30DCD0007F761D9401484FBCF1FDCB7299
SHA-256:	B966E1B1DA7339927CAEB17F81DE6F5DF52D62F1F2840CF598FCFCE07799E762
SHA-512:	41D86338115CE125970C6852088A08FB4DBA238BC8A891D84648FD6EEF1E2A9F59224BC5AF74CA34B0A8D29CC74BCBC2E9BF20D872ECD5ACA3330551979FFFDD
Malicious:	false
Reputation:	low
Preview:	TH02...... .@}.E.......SM01X...,...pL.E...........IPM.Activity...........h...............h............H..ht........g.d...h........8...H..h\cal ...pDat...h....0.........h.c~............h........_`.j...h.b~.@...I.lw...h....H...8..j...0....T...............d.........2h...............k..D...........!h.............. h...........#h....8.........$h8.......8....."h..............'h..............1h.c~.<.........0h....4....j../h....h......jH..hx...p...t.....-h .............+hv`~.....h................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04571325397760245
Encrypted:	false
SSDEEP:	3:Gtlxtjl93Dwk4lxtjl93Dw8tljR9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GttD4tbtlt9X01PH4l942wU
MD5:	D18E5980B1A8B7D633314E42A3A56053
SHA1:	F3AC9779B0DD9AD8EFD6629B137D19462F259345
SHA-256:	6D1893D964DA164B99B6A030411A5A0A197EF02B23BF2E3AB6A71DBD72BB2979
SHA-512:	DE9A318A99DA4FDBC0C65968ABB9E5B9868434395E120B8EE3A32ED222C7DA1004B1C9FAFB2EDB3220B692CA3D501CB82767C67FFD1434E628ADCEFDFA1921F2
Malicious:	false
Reputation:	low
Preview:	..-.......................F....O..h.'\|....I.?[...-.......................F....O..h.'\|....I.?[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.48400956103284876
Encrypted:	false
SSDEEP:	48:13GQ17qUll7DYMcyezO8VFDYMTkBO8VFDYML:/Pll4HjVGJjVGC
MD5:	31FBBA52716A26163F19DE4EBCD7E586
SHA1:	DA68B16521C6E9B4EF4A3215F09A61444CB4C503
SHA-256:	C493E14021E5EB64D27C613E59B47A1CBA86B0450ECD512191976AD26D6170B1
SHA-512:	33E9C50E8D18167DE4D012D2A1F44FFA7DEDDB72D505E29745E73D4D3D8B9E44FCC8714C618BD31A4B8FE77CD6AF57AFA50634EAE3E4D853B69F0324D7163157
Malicious:	false
Reputation:	low
Preview:	7....-..........O..h.'\|.=..b............O..h.'\|.B..P.]..SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13 (002).txt

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.9137995646056796
Encrypted:	false
SSDEEP:	3:hEHLUAI99:h8UAI3
MD5:	D233DEDE5959E470826330C0127326B8
SHA1:	1B76BB8AAEBEFE2A3E767959513B69AA1D75A5C3
SHA-256:	C3FE1DE74E35F391EC259D3EE28392322C640B7F0F5606290F3D129C429C32DA
SHA-512:	4389C11FAC6A138D1A4B67C1650D66F2AEA86E31849AADED8561C1AD9172C686A1C96F39B3A045D1B9BB368600D4A12B4B0C129DD41381B16F8933C0B500D446
Malicious:	false
Reputation:	low
Preview:	This attachment was removed.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13 (002).txt:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.9137995646056796
Encrypted:	false
SSDEEP:	3:hEHLUAI99:h8UAI3
MD5:	D233DEDE5959E470826330C0127326B8
SHA1:	1B76BB8AAEBEFE2A3E767959513B69AA1D75A5C3
SHA-256:	C3FE1DE74E35F391EC259D3EE28392322C640B7F0F5606290F3D129C429C32DA
SHA-512:	4389C11FAC6A138D1A4B67C1650D66F2AEA86E31849AADED8561C1AD9172C686A1C96F39B3A045D1B9BB368600D4A12B4B0C129DD41381B16F8933C0B500D446
Malicious:	false
Reputation:	low
Preview:	This attachment was removed.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715013716720441200_A4D856D4-3E08-4876-9448-FBDAED848B11.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28774), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.15933043845675432
Encrypted:	false
SSDEEP:	1536:7COEt3olT4oUn7kayfgzxijVGWVFLljpvQ8OXDBE8:A3MBUngbZJr
MD5:	21F0783B3CA4708CE033E855191E6866
SHA1:	CB5AAD3604A26BF96E9632888531BD16E853CE4A
SHA-256:	62B82BAEF3A13663EC5213254324A9732576A2D33FD376727EACAB42C220EE7C
SHA-512:	0AF3DA11B05FE712B494CE6E97D19FA595CECF2FF2B7F06098FC613D88E765BEED0A27F5EFE78C0D264426C99A9B8C9A74DB141E537CA5A3DB235139E053B6F0
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..05/06/2024 16:41:56.750.OUTLOOK (0x180C).0x1804.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-05-06T16:41:56.750Z","Contract":"Office.System.Activity","Activity.CV":"1FbYpAg+dkiUSPva7YSLEQ.4.11","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...05/06/2024 16:41:56.766.OUTLOOK (0x180C).0x1804.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-05-06T16:41:56.766Z","Contract":"Office.System.Activity","Activity.CV":"1FbYpAg+dkiUSPva7YSLEQ.4.12","Activity.Duration":11509,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715013716721291600_A4D856D4-3E08-4876-9448-FBDAED848B11.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240506T1841560478-6156.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.435009133186718
Encrypted:	false
SSDEEP:	1536:waW4tI9auoajDBDcpz2roEWN1B3E1LvFwvnIjlOptkMVcSREWniXOg93Nuz69qEr:DW4tIUuVDBDcpz2roEWN1B3E1LvFwvnA
MD5:	58DC968D07E9E4ACB2C78BF0C5B03246
SHA1:	EA8825A2F0C376D3A3095A91D30E638943D742F1
SHA-256:	77F8C2F5BD38500B50B5078873E7EEF91EC4B8AC038524571F66A0843F802162
SHA-512:	81F901A685DD92543381DA5302F73D824A1301C9CE06CE393B4EB34451777B0F65F4B27A117A938EA9CF76BE8B456968B9027D154299222B550B383767BA30BF
Malicious:	false
Preview:	............................................................................`..............N...................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................P...Y.............N...........v.2._.O.U.T.L.O.O.K.:.1.8.0.c.:.f.3.b.d.6.3.4.e.a.2.1.7.4.2.8.e.b.2.9.f.b.f.4.3.0.9.f.3.d.b.9.f...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.5.0.6.T.1.8.4.1.5.6.0.4.7.8.-.6.1.5.6...e.t.l.......P.P..........Y.N...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF31FC3359C7A396E0.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.3303802128403168
Encrypted:	false
SSDEEP:	192:SZNay/a7Jxt4oINEFhFmOCjtGNgz0XHWQOAIAbAFAqwNh/:SZYMmLINcVStJz0XHOAIMu
MD5:	5F28AB9FC84184891647CE0261E878C0
SHA1:	DE2214F9669A451FCF0324372E06BAE04CD107C9
SHA-256:	FADB6B779EA2259B0B220B2A52EBF4B4332822F2D5107BA71F9CE168FE3C11A1
SHA-512:	6BEC0567C309404E4F30DF220538A56711B2991A45DFC67C8AF72C66E426A180E67D4B384F81C33EDE975FF6A5DA2BBB2C3ED0BCC4F27F41CA74C2188EE4E5E8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:Cu:C
MD5:	714CA7BF2A81317480C629342025C511
SHA1:	C6C9D508B53788C4828819CF5BB6DA19C90BFDE6
SHA-256:	6721B764A93B8A33CF78CCDF73EC38B7DC463C6923EBCDC0561173679BC867A7
SHA-512:	825C47C4BA4FDE096466DFF005115D62B15545F88BBAEC29BB993523C847985BE85A19BF3A266F4FCB2B8901BF0E65B7004F359E0B28046DE0886C2FF79FF399
Malicious:	false
Preview:	..............................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.3613983954565287
Encrypted:	false
SSDEEP:	768:3ZQcPKIejCT76iSeIVvJsL7x8xdMWuGM9aiABfk8BUTIZ:VcOgB+88V16fkeNZ
MD5:	1557CD9015A1853B5C282CE78DC6FD4F
SHA1:	4AC0F32532115463706B4AF1D7D13CC64EB7A0B4
SHA-256:	F80B13A2EC08C06FB184538DAF514524951143E7EEBF9792FC4565D1D7A9B028
SHA-512:	FC27EE4F70ECE36DAB39E6DD30E0AE96A5A7834F117B803745D3648753B14BE1DFA946B3AEF21724448A3163B680EE3402765DF9225B5F0DC05C850D89A3946D
Malicious:	false
Preview:	!BDN.R.:SM......\...P...........2.......U................@...........@...@...................................@...........................................................................$.......D.......L..............................1....................................................................................................................................................................................................................................................................................................s...2*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.128290406146246
Encrypted:	false
SSDEEP:	384:UjTIXJ+De+jqHasdVwQrjWKzg47G1R1xr:wTIZ+biasDJ/s9
MD5:	C3A3A29D0AFF8926A1C3822255263FA9
SHA1:	535006949DDC5AAF1973DE97ADBA78718A9FD3B6
SHA-256:	A56126921283552AB258920CB92F73B9B756446320D416BF86443919C7F254A8
SHA-512:	CAC57487C949C0493C8AC8E28DDF9DFFCE22AEEECE26A95132C778F2ACBCEF9D7D2B33363B24E850EC20A6E0F53DA6F68AD12323468D0DA4B495786012C4802B
Malicious:	false
Preview:	.8..C...T..............N.....................#.!BDN.R.:SM......\...P...........2.......U................@...........@...@...................................@...........................................................................$.......D.......L..............................1....................................................................................................................................................................................................................................................................................................s...2*....N........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.1930184407392215
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg
File size:	45'056 bytes
MD5:	08b202cf0ee64aad0d5088cc5ea558b8
SHA1:	8adeab72d5a1b6f8d8662f8b9031aa345fab25b4
SHA256:	1f9d35a383258ae9eae909c373e191f1ac621c7a7cd7154f169f8c171deccdc5
SHA512:	a17b5c19562c7146e80cc0efaea9b6d339715384074d4b745d9eabdf57e55a3370e77d5bf8a302dac29e9d526a35b1fbc76079d9b23f741baf9432387d4d4c57
SSDEEP:	768:7dHDdHhpZDS3qCQsKWsKZs769cu47mIA7KZgCRkeKpBciqty:71Xn+KuBsO9A7ZA7KZXRk+Hy
TLSH:	8313D13569E90226F277EA3589F3A0D39D227D41BD11C64E61E1370F48F2F81ADA172B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Static Mail

General

Subject:	RE: New Order PO-EST-57601450_36KV XLPE Materials-300mm
From:	Thomas <thomas.volkerts@connectchemicals.com>
To:	undisclosed-recipients:;
Cc:
BCC:
Date:	Mon, 06 May 2024 17:17:46 +0200
Communications:	Good Day, I hope this message finds you well. We are interested in placing an order for the products listed below from your company website Could you please provide us with your best prices in USD? All the necessary details and requirements have been included in the attachment Please do not hesitate to reach out if you have any questions or require further clarification Thank you for your attention to this matter. WELL CARE TRADING & CONTRACTING EST. PO Box 4800, Al-Ahasa 31982 Kingdom Of Saudi Arabia Phone : +966 13 531 1942 Fax : +966 13 531 1943 Web : www.connectchemicals.com Email : thomas.volkerts@connectchemicals.com
Attachments:	DFLA_6763700182_782399399393____________________.r13.txt

Headers

Key	Value
X-AuditID	c0a8e7f0-b64687000000f1d2-23-6638f7366792
Received	from webmail.grupointeca.com (localhost.localdomain [IPv6:::1])
Mon, 6 May 2024 09	17:47 -0600 (CST)
Received-SPF	pass (mail.grupointeca.com: connection is authenticated)
MIME-Version	1.0
Date	Mon, 06 May 2024 16:17:46 +0100
From	Thomas <thomas.volkerts@connectchemicals.com>
To	undisclosed-recipients:;
Subject	=?UTF-8?Q?RE=3A_New_Order_PO-EST-57601450=5F36KV_XLPE_Materials-?=
In-Reply-To	<edc58ab24761da1bd50be9c042485974@connectchemicals.com>
References	<4c3cc6fafecb9620a4e8d0391cbda9cf@silmarelectronics.com>
User-Agent	Roundcube Webmail/1.4.15
Message-ID	<bd8e107c91760c8d89413582a840ccae@connectchemicals.com>
X-Sender	thomas.volkerts@connectchemicals.com
Content-Type	multipart/mixed;
X-PPP-Message-ID	<171500866925.13273.15198799932895081202@mail.grupointeca.com>
X-PPP-Vhost	grupointeca.com
Authentication-Results	symauth.service.identifier; dmarc=fail (p=none,
X-Brightmail-Tracker	H4sIAAAAAAAAA51Ua1ATVxTmZpOwhKws4eEx1REy9jFORSDUrMUHDtqh4/humQ6dVtawgUhI
date	Mon, 06 May 2024 17:17:46 +0200

File Icon


Icon Hash:	c4e1928eacb280a2

Target ID:	0
Start time:	18:41:56
Start date:	06/05/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg"
Imagebase:	0x620000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:41:57
Start date:	06/05/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "90DF6AE3-D7D7-42EF-B1BC-F3109C112C66" "172A97E9-E7B8-4157-A6F4-F4E71DE45BFC" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff6ad350000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	18:43:10
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt
Imagebase:	0x6f0000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:43:39
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\notepad.exe C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt
Imagebase:	0x6f0000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13 (002).txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13 (002).txt:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\L735RNI7\DFLA_6763700182_782399399393____________________.r13.txt:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715013716720441200_A4D856D4-3E08-4876-9448-FBDAED848B11.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715013716721291600_A4D856D4-3E08-4876-9448-FBDAED848B11.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240506T1841560478-6156.etl

C:\Users\user\AppData\Local\Temp\~DF31FC3359C7A396E0.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: OUTLOOK.EXEPID: 6156, Parent PID: 4380

General

Chronological Activities

Analysis Process: ai.exePID: 3552, Parent PID: 6156

Windows Analysis Report
RE New Order PO-EST-57601450_36KV XLPE Materials-300mm#U00b2.eml.msg