Windows Analysis Report
MV_TRANS-ASIA_I.xls

Overview

General Information

Sample Name:	MV_TRANS-ASIA_I.xls
Analysis ID:	1274208
MD5:	0c13eceb36bdde5263a3e2ecc3339407
SHA1:	19d9f3512d1d0e0ec66fe8fec4efd149f4287e1f
SHA256:	fffb8dde88ae23cc6c9b00e3692bfe33242ebfde732dc0b0f4a445b729985fc5
Tags:	xls
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Antivirus detection for dropped file

Excel sheet contains many unusual embedded objects

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample execution stops while process was sleeping (likely an evasion)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MV_TRANS-ASIA_I.xls

Avira: detected

Multi AV Scanner detection for submitted file

Source: MV_TRANS-ASIA_I.xls	Virustotal: Detection: 42%			Perma Link
Source: MV_TRANS-ASIA_I.xls	ReversingLabs: Detection: 26%

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\~DF91913997E8231534.TMP

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 1MB later: 80MB

Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.aadrm.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.office.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.scheduler.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.entity.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cr.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://d.docs.live.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://directory.services.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.windows.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://invites.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.local
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://management.azure.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://management.azure.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://tasks.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.yammer.com

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 16

Screenshot OCR: document is protected (')T_2 (') (') X a kheet2 J Sheet3 I IE] I m I i '00% O Type her

Excel sheet contains many unusual embedded objects

Source: MV_TRANS-ASIA_I.xls	OLE: Microsoft Word 2007+
Source: ~DF91913997E8231534.TMP.0.dr	OLE: Microsoft Word 2007+

Document contains embedded VBA macros

Source: MV_TRANS-ASIA_I.xls	OLE indicator, VBA macros: true
Source: ~DF91913997E8231534.TMP.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~WRF{C5C377A4-DBAB-4E46-BF0B-39EC296CAA1F}.tmp.1.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: MV_TRANS-ASIA_I.xls	Virustotal: Detection: 42%
Source: MV_TRANS-ASIA_I.xls	ReversingLabs: Detection: 26%

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: MV_TRANS-ASIA_I.xls	OLE indicator, Workbook stream: true
Source: ~DF91913997E8231534.TMP.0.dr	OLE indicator, Workbook stream: true

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{1935121C-0117-4180-8A62-DDC0FB773FCC} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal76.winXLS@22/81@0/1

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: MV_TRANS-ASIA_I.xls

Static file information: File size 1436672 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: ~WRF{C5C377A4-DBAB-4E46-BF0B-39EC296CAA1F}.tmp.1.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392B/CONTENTS' entropy: 7.98177286202 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392C/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392D/CONTENTS' entropy: 7.90090466154 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392F/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3930/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3931/CONTENTS' entropy: 7.94924924846 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3933/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3934/Package' entropy: 7.98610659657 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'Workbook' entropy: 7.90099886459 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392B/CONTENTS' entropy: 7.98177286202 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392C/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392D/CONTENTS' entropy: 7.90090466154 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392F/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3930/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3931/CONTENTS' entropy: 7.94924924846 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3933/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3934/Package' entropy: 7.98610659657 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'Workbook' entropy: 7.90099886459 (max. 8.0)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 410

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

Screenshots

Behavior

Click here to start
Slideshow Behavior Animation

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	C871053BF2AC0B98BC89253E672BF376	CCBC5B2142B2863FDCFACEA270C2401726C10A32	2C767E8B72495786362FE1A7CAEFC788646A05D2AC0C66D13EDC5055496A13E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	8F1944E2F1324D7E22D9796C459B6496	73903F86A9109D31A6B9512EDD63F35413510178	67B8180CF7D6FE1CDB22615D55A959D9633AB32895CCAAC3EE569D47A9CD7F79
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	91C69F5E63FF0B0F2C5758C1378F2F9A	9C82A9D22B83E5043A301FCFCC62288C478514DA	59F331BEEAEDFD53DE4B1D1077DE5CB550159E8D288184DD91C2D738681F3458
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	CCF2B87A14EBBEE6C8F8CE51E4ED9D41	6D02BB66DDC645E8E0ACC524E500CA41F4838B16	96850A33C1599C42FF4C89BDB77EF44E792008F12EB743587D86736571868B97
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	DA1F6A367B150F236EFA17FFE47F124F	5925F64767F6CF07D44BC965A41D9D648CEE75F5	D93F2C9B951CEA7C4E228876DC38EDC4A6962AE3767EBF4FCF9E6805645FCA9F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	6ED08598A6F76F46FC28C46D781F474E	28F4981C716DA1086E4D13A66793A2849ADE9C29	3457860971B87FDD8A79AB3214159DBC7F806C01730C7D80FDFDC4D808EC6761
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	37DCE6A501921682AEFBFE877FA10E1B	3160403CDC41C8E104181011F0B4BDB892ED5A39	123E3CECD049C060705583572118BE26C4297948FF9CABC29A9914CBF8617DD2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	5412B176A37357F111F0AA175F8BB2EF	F5807E2E0D3E9D97D316E43863C4F34394F1F91F	3B5F52D3EFDF4B3AAB2413144377256A9CBF63159662B86049F640EE29684B77
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	2E4BBA1013971089FFDED1A40B7563E4	31814365231DC102FBF6BB73423DCA16B5F2F698	C658F57EDDE953DE46E3B5E920376C5D33666232C59C3B3795FEF5F281997816
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	B2F3F8612B84CB3CD1F28CE9D4DA0DD3	384D7457E7585E19DC6B39163F66ED4F7B136230	12FF8A02C800B9B2A0B88A3072F521C44E186B7528C72B9C2D2D7E026B74467D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	A879848609F1099D1309297AD51595C6	7BC8D045859DE60698A0F4614AEA59096B199B0E	8EDE23779D93C1A33D3F7660B4DDF3C527F22CC29D56F9A987A02990F45D0B6C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	515776C56999EFEA34F652FE86530864	A9ABC844CA9C2FF02E750BFC1792BCB1E3C0E9B7	71E090610F36219FE0894B246AC88BF821CA68C072AED89DA6762B202A098376
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	39816C41D385BF0716307FDCE2241D8E	6F90190E096CF377142587DF3D4A28E4C559796C	91447CD470AFEA613B2027F8100E42C8EE81557AE684E9869609FF2C179F62EA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	250B1BAE344CFB109250F9908861AEF8	B391A0F20C24483BABE64421D9FB9C85F85A873C	34907413BFA978FADC74432CDCF31706C9C734D7B46BFE7CEEFC1A0FDDA4F033
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	E280C58A7CA3BFA0630FE68BA42ECFEA	E1C78EBDC2784E3A0B7337D82E5E12DFCE73880B	97ECA4707E4EF6F3C24DDC9324D66B29CAB854BFDD64EA719C3DB96D826CB6EE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	7654A9790356D9B93271C6E90B54A225	47C184234887C7D61F522A22373FC00F4F06ED7D	02AF6CCC02163F84D6B1E33AD39A5474D0C55E783296F65A1A56D4383FE36396
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	AB88BA320A998AFC717B2DE2490AC7F9	DD5FBD6F499812A7A21260182C3B50D5562CBA0F	4AB1B8E911FE8AFE2AFDA0B83D620121CDE1A8E00FCE1EDD112B2C08A068CC5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	B78E7AAE756C4DC24521317DAD0C4859	3FEDB7F8EB5613799356ACD4ED77FCB34C679CF2	2EE888BAD682A6B262B8AA77978A567AA4DED6FF0068C1046F3735D2A4277163
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	6474913FB488D2BD37477A269631A5D3	6225A41FC0983BCA1A66258028FC0F7FD3B1D7AF	8C7260677BF30713DED205BCF180B419BA18C18260D78D555AA6B4017A6F7C74
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	A649C83AB20040A2D03E7E0EEE4283F7	F8102ECFEB3A058AFF4AA2DAA3C1AEFF0A8BEA9D	474743EEE136D1C5D07F99D60ECCCDC832382195558424928EC4A45A93264311
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	DEF6387A0F907D18B5BFEBD6D468D193	F70022CBD4B97ACD830BDCB5B1B209BE8477577E	E1452A393B01DB999FE59C0B9127B6CDF935FC42C2363415FE1AD815DA7D5D29
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	0E855DD48677834E2A49D1E6D2463BC6	27D3D6D8DD32354D1AB810D2DF0F60B396ED24D2	2EDBC922371BF3FF21A00DE6E0F6080D9F03E01998B7CE55754B980C400FA8B4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	2A440B631436A61BBB294B4E0633E1A1	BCB32B49052B8A0D8233EE9BA5F627EF414315EA	E3134367A5A0F730EAB44DB0AEDD35B107F9B0214EB51287322C6A7F4D4F5412
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	08170EB2CA2B31E06D2C33D55FC28F19	AFEC5404BEC52E33161F084C6DA7DCEEE83B6E2D	3B3B97A65C58E5F016A673C68216C66D97BF7EA29C2E75ABA5DE5DF582A10F16
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	5F172C8DD74FCBC2D035C99FAAE25B56	A8D2382D98FAD661049DBC11AF2815D38690B6C6	890477B637E175111902B6F167A64E987D9FAA259E619AAD977B2BB14A6C4E4B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	6FCA2269A987D0B7B0CE14A60C25D940	19394BA726993C2D90BD4D5B37A69FA495B88846	3D0DB86A1A07B153B4A0D68D7154C45719F9015969E3CA8EA4A0253698C721BF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	B01BCE57B6D6A59332809F475A51F7DF	54B53ECE8A6482109B2C5526B4DEC4979E32D699	85DC3494C8209F260E17B67FB93C5D8D1C729174D7FD75280C2A6DC295BBDA69
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	425C8360C0B4F42225D881898BDE8618	208FBF744D1DEFC6E7A5D4191A9ED6B2121AC2F8	A8828F20982185964FA1113039710FDA39FFBD1F40BD28F98B579D6880BB8313
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	3862E106B096B935B868DF37FE81C4F6	7F7BB74B0886930574073300201229B9EAA4CB2D	F50A27EF56FBDA3B380659CF8F92391C485E61C71CB0A43F602288176404ADAA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	259AB2CE32FEA5EE82988CFE9F1543BD	76A7FD2C2F6C6E323B1D51E0C81465BB0873DECB	E860E331B010B224EAC7C2B0DC65CB9099B5D9219C9225A939E8839C3A86557C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	0B9B83AB42D8ABD27458E235ADDFDFAE	A8F2ACE0492802C37B55843B8DF2AD3A27F1D642	2A4B6B72C7058D6BE8F358A4A91DA0966D1697B667E4BB92A335254653E8EB72
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	2158B57C75CAAF89F36F71AD0ED6D2A7	2D977C6391F50593724FC14DB757582AD08F6D4A	225BCBA6268EE6970290203D24BC717DB932B331A8093964F666F33688C347C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	F2E9E588441DE9E4854E3FE2D235952A	AD1E7E9296AE27789FC9B3940675F15EA7528965	37B8CF910D9EF839EE672E2144580AA0DB8CCB33EA9A5F77C4318219698C3F0C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	C3A7782AA11794810C8A8CAC53D25271	4301A78D6F82445D88F3097549ACE123CB62F415	CBFE2E6BC09750EAA3234B940A035B32FAC77461AE2BB9FC2747E18F1073A397
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	BEFE1B9793D4F60F15C00CB43D0C75D2	3B23B653C5F3521FA0C8E2CC4526CCA149A140E6	F167067D7192854F54C9638B692DB45042D8340AC82ECD0036E20422A658A1C7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	4EDEE7ADE1D31967944B1E5A7125E232	EE134DD29121E58419443F4014F1DCDC7199619F	CF539C0AB365AFCE8DA72358EB03095C1BBEC58D24483D5E3701226E5EB114E8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	3B930E2E525CE053D6B36431FFC84FF6	8C9FE70468306FD294E9AEFA98D736382938E8BC	12AC713AEC177276A63919A131DEF06C85F7A586A2F467FDB0AD06B65CEAC061
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	1408FA5CB916829135B1FD1A65B4E9C7	90DA54F7CE20BFF187D7BF887FD0978013853EDD	E489FEEB8028A3F02434CCC2A703DDACE3D8A612D67F0B62A8CEC95009FF868A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	B9959BF04C262EAC43B85EF0C73BAA85	30C18D01976DA949ADCB72CCE5F671F9B0C28E89	1CA8DE24BF2A6E0ACBA765ACF08EF2137B8740E45DF8E47F6DB5DC5CFE04DF5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	data	A431D80A00A83CA06547CFFA8BD91B2E	51583DC3594374B607018D4D46D7416CB3D779F5	217F035E62AAFAD7AD8EEA4DF08A475E39E2AEF9D9186B653EF9754FC6FEEFE2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)	data	A431D80A00A83CA06547CFFA8BD91B2E	51583DC3594374B607018D4D46D7416CB3D779F5	217F035E62AAFAD7AD8EEA4DF08A475E39E2AEF9D9186B653EF9754FC6FEEFE2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF5b1969.TMP (copy)	data	A431D80A00A83CA06547CFFA8BD91B2E	51583DC3594374B607018D4D46D7416CB3D779F5	217F035E62AAFAD7AD8EEA4DF08A475E39E2AEF9D9186B653EF9754FC6FEEFE2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_86b8040b7132b608_0_1 (copy)	data	7654A9790356D9B93271C6E90B54A225	47C184234887C7D61F522A22373FC00F4F06ED7D	02AF6CCC02163F84D6B1E33AD39A5474D0C55E783296F65A1A56D4383FE36396
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_8c84d92a9dbce3e0_0_1 (copy)	data	B78E7AAE756C4DC24521317DAD0C4859	3FEDB7F8EB5613799356ACD4ED77FCB34C679CF2	2EE888BAD682A6B262B8AA77978A567AA4DED6FF0068C1046F3735D2A4277163
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_aba6710fde0876af_0_1 (copy)	data	5F172C8DD74FCBC2D035C99FAAE25B56	A8D2382D98FAD661049DBC11AF2815D38690B6C6	890477B637E175111902B6F167A64E987D9FAA259E619AAD977B2BB14A6C4E4B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_febb41df4ea2b63a_0_1 (copy)	data	B9959BF04C262EAC43B85EF0C73BAA85	30C18D01976DA949ADCB72CCE5F671F9B0C28E89	1CA8DE24BF2A6E0ACBA765ACF08EF2137B8740E45DF8E47F6DB5DC5CFE04DF5C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	694ACD9820150A6D78ED376BC1CB3481	4B15D61B52A82F14F53E6EBDE8C02F7A9134F74C	F3E91ED81CBE42D135366DAE0A12D36F8D946932EF1BB0C94381E957C9BE448A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	694ACD9820150A6D78ED376BC1CB3481	4B15D61B52A82F14F53E6EBDE8C02F7A9134F74C	F3E91ED81CBE42D135366DAE0A12D36F8D946932EF1BB0C94381E957C9BE448A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5a583c.TMP (copy)	ASCII text	694ACD9820150A6D78ED376BC1CB3481	4B15D61B52A82F14F53E6EBDE8C02F7A9134F74C	F3E91ED81CBE42D135366DAE0A12D36F8D946932EF1BB0C94381E957C9BE448A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	3A0F8193E47E6B7D6CDCB8E7BD757B05	9E18F31DB641D6F5155D8377719B8DE4E3964ED5	B83B37B96CD2F9878A0F745C46B75D6E003A982A94DE44737A12D412F7E96F8B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000, file counter 16, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 16	73AB0C61197DD8A6D422E9B50B8A80EE	A7FBC9289ABF2C21F0CE818B7A53A806ADBFFEC6	DC6B7A61118A6AD1D30FF287F24C179164A501841BE633A67DA40FFD2AD5AF59
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	622E1430ECC62A18A35535D2F02586D0	9533B6E26C55A6EC3366DA09B6FF4AF11DB6E758	E35623DC16EF69917C4948D9AFA386253F477DFB64047DDEE338FA20EAC57A85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst (copy)	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.4608	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)	PostScript document text	4D5E3CD969F14362210F0473720C5528	AFD90E9888759B809F78E87D5550B601A288A0A3	79D95D01FDE7FC7C890CD62734A7F203B12A5D44A56D6009D0E43E40D99682AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst (copy)	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.4608	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat	data	3A1007D6764F9F112D164E57A09A24E8	DAB006AD11CD0EE8DB9715FFE780A2B8487844FE	825F4CECD0764872C98774ACF9BD291E9FFBC53BBB343B062AD621ADD6C75791
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin	data	C4AC96052C37B1A6F6ACAAA2E2C5E3ED	9716DF1A7F75C74BEE25AD5789A2D6FF1CA0AE44	90A1C57F22E293C1CDA151369ABDABA6769AA79931DE447FD7057085C9527E49
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\EC4C8406-9600-479F-B523-6A0DBCE8283F	XML 1.0 document, ASCII text, with CRLF line terminators	E4FEB58E41C974A18DD206DE41065D49	18528DAA290D92C66B1B12DFD703BCDE7FEA7843	0FAB80758DD2FEE9E82699A201B2BBE138F323DEE0EC6D47BDCAE83B122D281B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\12A6B5D8.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	9ABE7EB352E0DB96B52C99AC2FDEA85F	8DC45D02308275BA32B7FFB320A3042256D40C8B	EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\16EBD673.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	0FFCA2E0D06FD9393E46F20F4AE6B53E	FEAD188430DF862BA1F39A92480BD8089E533AD6	FA91A49FBA91AF8F9F6487B69D5D3265DFAAA123563A0558B79C0F72792C41C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\297FEF5D.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	4D59A7E93170340B5EC4009F7FA3AD31	E07421156DD87789F93F10904118343CA452BBB5	83473215E5C2160333AA92EA7F9B1276D8ED7DD66AFC472DC92C88055D189D7D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\41B92C74.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	649BC957D73117EC8A34E263992E1206	50636F1BB74D7C9F8504112788353CD957354931	248213732341A5A1530BA451107F43C4C7AA0F5EAA77B8DCCE389635BEE4A688
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\74F335BA.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	D69C22A341E111FEEA69DF6D8C655D60	AC862337F2EFA43627508927F5052CE694012206	05B2053BF1D070D6034B45CD79B54D80DA3C6D88D016671A345E75048B1A68DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\86DB968E.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	1E4BA5BE743CD211DB2785335298C75D	6169D84FC99CFF765CEDB41DBB2B7183BAC6AFAB	13355342932542883BC3466357C60CB8497E87B614A9286226DD96D4826780DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A23AD1CC.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	A01B9617553432807B9B58025B338D97	439BDCC450408B9735B2428C2D53D2E6977FA58C	7A0426ED2E2349916969FF7087C0F76089FB8CE7F4627F3D11CCBC1AAEFCEDCE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B013937.emf	Windows Enhanced Metafile (EMF) image data version 0x10000	AB3C71DADD57C96DE74236A677761633	B1831C9C1D2276395D10AAA35D0A837A1E51C31C	BE0B0602293E0078A54D37F29B03C21091D4450EDCF827A577D376E670A2C445
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~$RO0000.doc	data	22EDA48C698D77F5EDD76C113A8C17FA	F37CD83E8629BABF7D1C1543035AE7DCC3195336	FB2722F575EE5DB8EA1ECEC0AEF9CB2A44BBECAEA355EAEA197D716553AC276A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{C5C377A4-DBAB-4E46-BF0B-39EC296CAA1F}.tmp	Composite Document File V2 Document, Cannot read section info	B9CF147A11C5472B3DDABCECB4FEA645	813458C582D9C0B50BB925D59FD222D64ED9CC55	459CA22BF4ED75729711B21332424458E70C9E3ACE7E0C5315E65A3244C764DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRO0000.doc	Microsoft Word 2007+	A2411BDA9FD65DCA69FE3827C53400CE	FC4B6B079272FFC749E762F4C0E728B243D9DF44	1B2AE580BE8EB987CD2676D60FE9524BBA9BAA1C7C7444C5CAF7F485DF85DCE9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{73518E95-782A-45BE-9C96-7CF15AFBE3D3}.tmp	data	A011B8D7E882E35715E853C4A8453C23	442DBC16B47AA37F2D28ADE2B41A1C56A53E4A68	55544BA145BA271F5DF122D0E03670AA85FC5E03AA1B2FFB0F80F8233165383A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C568A0DB-DBE4-44C5-85CE-BCEC9ECCA540}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Temp\~DF1F963D1F478F8E7D.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Local\Temp\~DF91913997E8231534.TMP	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sun Jul 16 18:43:24 2023, Security: 0	B4115B969BFB265BE73E717391CB3E1F	F44BD7D04C27ED8796C76CF8FFE72B356318AC80	07B01D42247B67313D436A455F86A91C4205CFEDA02AE04218FBB0D0CBF8A16C
C:\Users\user\AppData\Local\Temp\~DFF5BAAE5120DD87CE.TMP	data	062170D41AFAB5BC613F0C6F009FC51D	0C7EF25F5BB567E4714172829E0598FD90C2E6AB	EC10A6A383686B5B3ACA96509633961719EC862C20827871A234AA9ADB63863F
C:\Users\user\AppData\Local\Temp\~DFFAD80AEB439BFBA7.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	data	29DB0E735966B4175186D8B1E31433F2	5315462C8A8CE1E704E6AA78DAC8FE04C99119E4	4CD385E3B8F22E156832D84DD6AB1A5AB5B55968774B70DC46DCD12F33586C0F
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	data	7CE04D02A980B310BEFD5CA048E563DD	388CDE051FE089C475024409211827B24105D63A	43934CF20C8A3223DF6EE4F440B484C4F29970192310F3DE1891969AE8453A43
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	22EDA48C698D77F5EDD76C113A8C17FA	F37CD83E8629BABF7D1C1543035AE7DCC3195336	FB2722F575EE5DB8EA1ECEC0AEF9CB2A44BBECAEA355EAEA197D716553AC276A
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C4F79900719F08A6F11287E3C7991493	754325A769BE6ECCC664002CD8F6BDB0D0B8CA4D	625CA96CCA65A363CC76429804FF47520B103D2044BA559B11EB02AB7B4D79A8

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MV_TRANS-ASIA_I.xls

Avira: detected

Multi AV Scanner detection for submitted file

Source: MV_TRANS-ASIA_I.xls	Virustotal: Detection: 42%			Perma Link
Source: MV_TRANS-ASIA_I.xls	ReversingLabs: Detection: 26%

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\~DF91913997E8231534.TMP

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 1MB later: 80MB

Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.aadrm.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.office.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://api.scheduler.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.entity.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://cr.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://d.docs.live.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://directory.services.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.windows.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://invites.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.local
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://management.azure.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://management.azure.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://tasks.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: EC4C8406-9600-479F-B523-6A0DBCE8283F.0.dr	String found in binary or memory: https://www.yammer.com

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 16

Screenshot OCR: document is protected (')T_2 (') (') X a kheet2 J Sheet3 I IE] I m I i '00% O Type her

Excel sheet contains many unusual embedded objects

Source: MV_TRANS-ASIA_I.xls	OLE: Microsoft Word 2007+
Source: ~DF91913997E8231534.TMP.0.dr	OLE: Microsoft Word 2007+

Document contains embedded VBA macros

Source: MV_TRANS-ASIA_I.xls	OLE indicator, VBA macros: true
Source: ~DF91913997E8231534.TMP.0.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~WRF{C5C377A4-DBAB-4E46-BF0B-39EC296CAA1F}.tmp.1.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: MV_TRANS-ASIA_I.xls	Virustotal: Detection: 42%
Source: MV_TRANS-ASIA_I.xls	ReversingLabs: Detection: 26%

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: MV_TRANS-ASIA_I.xls	OLE indicator, Workbook stream: true
Source: ~DF91913997E8231534.TMP.0.dr	OLE indicator, Workbook stream: true

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{1935121C-0117-4180-8A62-DDC0FB773FCC} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal76.winXLS@22/81@0/1

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: MV_TRANS-ASIA_I.xls

Static file information: File size 1436672 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: ~WRF{C5C377A4-DBAB-4E46-BF0B-39EC296CAA1F}.tmp.1.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392B/CONTENTS' entropy: 7.98177286202 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392C/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392D/CONTENTS' entropy: 7.90090466154 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D392F/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3930/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3931/CONTENTS' entropy: 7.94924924846 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3933/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'MBD001D3934/Package' entropy: 7.98610659657 (max. 8.0)
Source: MV_TRANS-ASIA_I.xls	Stream path 'Workbook' entropy: 7.90099886459 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392B/CONTENTS' entropy: 7.98177286202 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392C/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392D/CONTENTS' entropy: 7.90090466154 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D392F/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3930/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3931/CONTENTS' entropy: 7.94924924846 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3933/CONTENTS' entropy: 7.94631733096 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'MBD001D3934/Package' entropy: 7.98610659657 (max. 8.0)
Source: ~DF91913997E8231534.TMP.0.dr	Stream path 'Workbook' entropy: 7.90099886459 (max. 8.0)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 410

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000			Jump to behavior

ID:	1274208
Product:	CloudBasic
Start time:	07:54:11
Start date:	17.07.2023
Sample:	MV_TRANS-ASIA_I.xls
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0c13eceb36bdde5263a3e2ecc3339407
SHA1:	19d9f3512d1d0e0ec66fe8fec4efd149f4287e1f
SHA256:	fffb8dde88ae23cc6c9b00e3692bfe33242ebfde732dc0b0f4a445b729985fc5
Filetype:	Microsoft Excel sheet (30009/1) 47.99%

Windows Analysis Report
MV_TRANS-ASIA_I.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Windows Analysis Report MV_TRANS-ASIA_I.xls

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Windows Analysis Report
MV_TRANS-ASIA_I.xls