Edit tour

Windows Analysis Report
REF# 5495941179-documentation 2032Pfile.msg

Overview

General Information

Sample name:	REF# 5495941179-documentation 2032Pfile.msg
Analysis ID:	1440808
MD5:	4e9888c649e09f39dd78208e21bfbb2c
SHA1:	b5cb1ef6ae372c4e2c098f1a5155fe82cbc41ef7
SHA256:	14a2da9d0ffc6e9876ac1a8a8c024666f5cf95cd01e737550e65de423db4411b
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Connects to many different domains

Detected TCP or UDP traffic on non-standard ports

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid T&C link found

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6920 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\REF# 5495941179-documentation 2032Pfile.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7088 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3DDEB4B0-4EDE-42C6-83AE-D9297E3EF3FB" "22732E32-FB36-4811-8AE5-44A29D56056C" "6920" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 2980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTIiLCJsb2NhbGUiOiJlbl9VUyJ9.RRegusJvx9KcvAy6KDBkxhhmfXclEC5f_BCga2pYEi5aijQ2vmoGHWIqbNtTmbemN3fG_w3EWZ911a0E3pWWdg MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5864 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
5.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009

LLM: Score: 8 brands: Microsoft SharePoint Reasons: The URL 'https://empirical.buzz/n/?...' does not match the legitimate domain for Microsoft SharePoint, which is typically hosted on 'sharepoint.com'. The domain 'empirical.buzz' is suspicious and not associated with Microsoft. The page mimics the SharePoint login interface, which is a common tactic in phishing to deceive users into entering their credentials. The presence of a login form where users are asked to enter email credentials specifically for a document they supposedly received is a typical phishing technique. The lack of a captcha and the generic design of the page also contribute to its suspicious nature. DOM: 5.6.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 5.6.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Base64 decoded: https://cdn.socket.io/4.6.0/socket.io.min.js

HTTP Parser: Title: Authenticating ... does not match URL

Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: Invalid link: Terms of use
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: Invalid link: Privacy & cookies
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: Invalid link: Terms of use
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: Invalid link: Privacy & cookies

HTTP Parser: <input type="password" .../> found

Source: https://acrobat.adobe.com/dcpreviewdropin/3.0.2_2.759.0/printHelper.html	HTTP Parser: No favicon
Source: https://documentcloud.adobe.com/proxy/pdfverbs-web/3.17.1_4.855.0/shared-storage.html	HTTP Parser: No favicon
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No favicon
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No favicon

Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No <meta name="author".. found
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No <meta name="author".. found

Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No <meta name="copyright".. found
Source: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 20.190.151.70:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.70:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.214.98:443 -> 192.168.2.17:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.214.98:443 -> 192.168.2.17:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:50125 version: TLS 1.2

Source: unknown

Network traffic detected: DNS query count 33

Source: global traffic	TCP traffic: 192.168.2.17:50070 -> 18.212.47.155:3478
Source: global traffic	UDP traffic: 192.168.2.17:51689 -> 74.125.250.129:19302

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	DNS traffic detected: DNS query: adobe.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: static.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: prod.adobeccstatic.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: l.betrad.com
Source: global traffic	DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: dc-api-v2.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: dc-api.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: api.echosign.com
Source: global traffic	DNS traffic detected: DNS query: cdn-sharing.adobecc.com
Source: global traffic	DNS traffic detected: DNS query: files-download2.acrocomcontent.com
Source: global traffic	DNS traffic detected: DNS query: c.evidon.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _19292._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _39691._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _49100._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: packets.sbs
Source: global traffic	DNS traffic detected: DNS query: empirical.buzz
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: ih1.redbubble.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: stun.fpapi.io
Source: global traffic	DNS traffic detected: DNS query: stun.l.google.com
Source: global traffic	DNS traffic detected: DNS query: use1-turn.fpjs.io
Source: global traffic	DNS traffic detected: DNS query: use1.fptls.com
Source: global traffic	DNS traffic detected: DNS query: fiveradio-newbam.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.190.151.70:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.70:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.214.98:443 -> 192.168.2.17:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.214.98:443 -> 192.168.2.17:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:50125 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.winMSG@23/282@86/428

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240513T2119010808-6920.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\REF# 5495941179-documentation 2032Pfile.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3DDEB4B0-4EDE-42C6-83AE-D9297E3EF3FB" "22732E32-FB36-4811-8AE5-44A29D56056C" "6920" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTIiLCJsb2NhbGUiOiJlbl9VUyJ9.RRegusJvx9KcvAy6KDBkxhhmfXclEC5f_BCga2pYEi5aijQ2vmoGHWIqbNtTmbemN3fG_w3EWZ911a0E3pWWdg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3DDEB4B0-4EDE-42C6-83AE-D9297E3EF3FB" "22732E32-FB36-4811-8AE5-44A29D56056C" "6920" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTIiLCJsb2NhbGUiOiJlbl9VUyJ9.RRegusJvx9KcvAy6KDBkxhhmfXclEC5f_BCga2pYEi5aijQ2vmoGHWIqbNtTmbemN3fG_w3EWZ911a0E3pWWdg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5864 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5864 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 --field-trial-handle=2084,i,3741596586503036819,5928658588397613732,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: Chrome Cache Entry: 532

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	13 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
about:blank	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	18.164.174.11	true	false	high
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	44.209.29.87	true	false	high
use1-turn.fpjs.io	34.231.53.248	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
widget.uservoice.com	104.17.28.92	true	false	high
empirical.buzz	172.67.156.154	true	true	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
api.echosign.com	52.71.63.232	true	false	high
detect.adobedccdn.com	127.0.0.1	true	false	unknown
cs837.wac.edgecastcdn.net	192.229.173.207	true	false	high
packets.sbs	172.67.142.142	true	false	unknown
fiveradio-newbam.com	104.21.84.200	true	false	unknown
cdn-sharing.adobecc.map.fastly.net	151.101.1.138	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
adobetarget.data.adobedc.net	63.140.37.126	true	false	unknown
cs203.wac.edgecastcdn.net	72.21.91.237	true	false	high
d2vgu95hoyrpkh.cloudfront.net	13.226.210.57	true	false	high
part-0041.t-0009.t-msedge.net	13.107.213.69	true	false	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.36.51	true	false	unknown
use1.fptls.com	75.2.10.96	true	false	unknown
www.google.com	142.250.101.99	true	false	high
by2.uservoice.com	104.17.27.92	true	false	high
prod.adobeccstatic.com	18.154.132.11	true	false	unknown
stun.l.google.com	74.125.250.129	true	false	high
c.evidon.com	unknown	unknown	false	high
ims-na1.adobelogin.com	unknown	unknown	false	high
dc-api-v2.adobecontent.io	unknown	unknown	false	unknown
cdn.socket.io	unknown	unknown	false	high
adobe.tt.omtrdc.net	unknown	unknown	false	unknown
www.w3schools.com	unknown	unknown	false	high
cdn-sharing.adobecc.com	unknown	unknown	false	unknown
static.adobelogin.com	unknown	unknown	false	high
_49100._https.detect.adobedccdn.com	unknown	unknown	false	unknown
use.typekit.net	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
ih1.redbubble.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
_39691._https.detect.adobedccdn.com	unknown	unknown	false	unknown
l.betrad.com	unknown	unknown	false	high
p.typekit.net	unknown	unknown	false	high
_19292._https.detect.adobedccdn.com	unknown	unknown	false	unknown
stun.fpapi.io	unknown	unknown	false	unknown
dc-api.adobecontent.io	unknown	unknown	false	unknown
files-download2.acrocomcontent.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
about:blank	false	Avira URL Cloud: safe	low
https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.138	cdn-sharing.adobecc.map.fastly.net	United States	54113	FASTLYUS	false
184.30.148.74	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
173.223.234.37	unknown	United States	21342	AKAMAI-ASN2EU	false
52.38.150.28	unknown	United States	16509	AMAZON-02US	false
172.67.142.142	packets.sbs	United States	13335	CLOUDFLARENETUS	false
54.168.215.59	unknown	United States	16509	AMAZON-02US	false
142.251.2.84	unknown	United States	15169	GOOGLEUS	false
172.64.155.61	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.196.150	unknown	United States	13335	CLOUDFLARENETUS	false
72.21.91.237	cs203.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
13.226.210.57	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
52.109.20.39	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
99.83.173.21	unknown	United States	16509	AMAZON-02US	false
44.198.86.118	unknown	United States	14618	AMAZON-AESUS	false
52.192.157.45	unknown	United States	16509	AMAZON-02US	false
173.223.234.197	unknown	United States	21342	AKAMAI-ASN2EU	false
18.154.132.11	prod.adobeccstatic.com	United States	16509	AMAZON-02US	false
173.223.234.28	unknown	United States	21342	AKAMAI-ASN2EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
75.2.10.96	use1.fptls.com	United States	16509	AMAZON-02US	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
18.238.109.100	unknown	United States	16509	AMAZON-02US	false
3.223.251.211	unknown	United States	14618	AMAZON-AESUS	false
18.238.109.42	unknown	United States	16509	AMAZON-02US	false
184.28.81.181	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.66.0.163	unknown	United States	13335	CLOUDFLARENETUS	false
44.196.228.180	unknown	United States	14618	AMAZON-AESUS	false
52.5.13.197	unknown	United States	14618	AMAZON-AESUS	false
52.71.63.232	api.echosign.com	United States	14618	AMAZON-AESUS	false
142.250.141.95	unknown	United States	15169	GOOGLEUS	false
74.125.137.94	unknown	United States	15169	GOOGLEUS	false
3.233.142.19	unknown	United States	14618	AMAZON-AESUS	false
52.70.118.77	unknown	United States	14618	AMAZON-AESUS	false
74.125.137.95	unknown	United States	15169	GOOGLEUS	false
13.107.246.69	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.235.168.50	unknown	United States	14618	AMAZON-AESUS	false
184.28.81.167	unknown	United States	16625	AKAMAI-ASUS	false
173.223.234.53	unknown	United States	21342	AKAMAI-ASN2EU	false
104.18.32.195	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.213.69	part-0041.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.28.92	widget.uservoice.com	United States	13335	CLOUDFLARENETUS	false
63.140.37.126	adobetarget.data.adobedc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
142.251.2.138	unknown	United States	15169	GOOGLEUS	false
54.144.73.197	unknown	United States	14618	AMAZON-AESUS	false
104.18.32.77	unknown	United States	13335	CLOUDFLARENETUS	false
192.229.173.207	cs837.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
142.251.2.139	unknown	United States	15169	GOOGLEUS	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
18.164.174.11	dd20fzx9mj46f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
23.61.213.57	unknown	United States	16625	AKAMAI-ASUS	false
74.125.250.129	stun.l.google.com	United States	15169	GOOGLEUS	false
104.208.16.95	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.30.148.83	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
184.30.148.84	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
18.212.47.155	unknown	United States	14618	AMAZON-AESUS	false
23.61.212.184	unknown	United States	16625	AKAMAI-ASUS	false
184.28.81.157	unknown	United States	16625	AKAMAI-ASUS	false
13.33.21.72	unknown	United States	16509	AMAZON-02US	false
142.251.2.94	unknown	United States	15169	GOOGLEUS	false
104.17.27.92	by2.uservoice.com	United States	13335	CLOUDFLARENETUS	false
142.250.101.99	www.google.com	United States	15169	GOOGLEUS	false
172.67.156.154	empirical.buzz	United States	13335	CLOUDFLARENETUS	true
63.140.36.51	adobe.com.ssl.d1.sc.omtrdc.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.21.84.200	fiveradio-newbam.com	United States	13335	CLOUDFLARENETUS	false
142.250.101.94	unknown	United States	15169	GOOGLEUS	false
173.223.234.209	unknown	United States	21342	AKAMAI-ASN2EU	false
13.33.21.101	unknown	United States	16509	AMAZON-02US	false
75.101.142.57	unknown	United States	14618	AMAZON-AESUS	false
35.76.214.141	unknown	United States	16509	AMAZON-02US	false

Private

IP
127.0.0.1
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1440808
Start date and time:	2024-05-13 21:18:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	REF# 5495941179-documentation 2032Pfile.msg
Detection:	MAL
Classification:	mal60.phis.winMSG@23/282@86/428
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.20.39, 184.28.81.181, 184.28.81.154, 199.232.214.172
Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, ctldl.windowsupdate.com.delivery.microsoft.com, us2.roaming1.live.com.akadns.net, ctldl.windowsupdate.com, scus-azsc-000.roaming.officeapps.live.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, s-0005.s-msedge.net, ecs.office.trafficmanager.net, osiprod-scus-buff-azsc-000.southcentralus.cloudapp.azure.com, omex.cdn.office.net.akamaized.net, wu-b-net.trafficmanager.net, a1864.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: REF# 5495941179-documentation 2032Pfile.msg

LLM Input / Output

Input

Output

URL: https://empirical.buzz/n/?cmFuZDE9Wmt4MldGUldUR3RGU1ZVM1NuaEdlVWR5TTJNPSZzdj1vMzY1XzVfc3AmcmFuZDI9UlZkQmJrdE1SVzExZUhOTlZtZExNbE5aWW5FPSZ1aWQ9VVNFUjA2MDUyMDI0VU5JUVVFMTAxODA1MDY1MjIwMjQyMDI0MDUwNjE4MTA1MiZyYW5kMz1kVVZGZFVSUU0wZHJOeko2T0dNeGRsUk1VR009

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4561211698933296
Encrypted:	false
SSDEEP:
MD5:	C60D295296CACCAAFD37A9AC361B7173
SHA1:	2E08B7CB24034E0E313B10A1B53934D952CC0DB1
SHA-256:	F532CF8A555A72620B12F289653F6A039FD80D59E6D008E9E0410A251493C08D
SHA-512:	9A64C9A2BF7DAA26E8541413CEE18AFBCB3D9DF73BAF5ABA5D245B8FEBC2B2B5E6B2EA7381AB186C56619BE98EBE8B2678298AC762AFA34129D71D522511C3AC
Malicious:	false
Reputation:	unknown
Preview:	p...... ........YC.kj...(...............................................B:.VZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 13 18:19:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987178535012279
Encrypted:	false
SSDEEP:
MD5:	17F4882D9B7DA68E02D21BB6E88A6796
SHA1:	BFDEB3881F1A81910DCFAF26836F597EE13C37BB
SHA-256:	62FE939BAB95E64A4B98A34EEB5E5F43F686367298C945C9F370B64C4DB416F8
SHA-512:	295EC55B5D8F989572167C7E605D822134B56FB0E3949EE1252FDE277F052919A8D5DFCB53CB242945A78057253C20B993FE2CFE79B6FC6249CB8652FFEA4B94
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......$qj.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xf.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Xf.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Xf............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Xh............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.875334973222991
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	REF# 5495941179-documentation 2032Pfile.msg
File size:	76'288 bytes
MD5:	4e9888c649e09f39dd78208e21bfbb2c
SHA1:	b5cb1ef6ae372c4e2c098f1a5155fe82cbc41ef7
SHA256:	14a2da9d0ffc6e9876ac1a8a8c024666f5cf95cd01e737550e65de423db4411b
SHA512:	4c41158b366ccb1f9815848468cab0f3cde12361ebc5d74cb04b66876653ed3a0cdd55eb93fc95563e6ca53960dfb1186bf68e60de2383ea2433bbf038caf6d3
SSDEEP:	768:8L4eMYiJ44ZRbL2SV6aeqIPYuc+u5XVd7k0+L+0kBMOZoexr1iwMDqkaiQuWsKtG:8fi5VQxP4TqXDqktWlWeP4MBLAs3s
TLSH:	F77362203AFA5209F2BB9F3649F194D7993A7D92BD10994F2151334E0572A80EDA1F3F
File Content Preview:	........................>......................................................................................................................................................................................................................................

Subject:	REF# 5495941179-documentation 2032Pfile
From:	Marie Marx <mmarx@gboe.org>
To:	Marie Marx <mmarx@gboe.org>
Cc:
BCC:
Date:	Fri, 10 May 2024 21:19:48 +0200
Communications:	<https://landing.adobe.com/dam/global/images/acrobat-pro-dc.mnemonic.480x468.png> <https://s7d9.scene7.com/is/image/AdobeDemandCreative/?fmt=png-alpha&size=400,60&wid=400&textAttr=144,strong&resolution=200&textPs=%7B%5C*%5Ciscolortbl%3B74777A%3B%5Cfonttbl%7B%5Cf0%20Adobe%20Clean%20ExtraBold%3B%7D%7D%5Cf0%5Cfs40%5Csl-400%5Cvertalc%5Ckerningoptical%5Ccf1Adobe%20Acrobat> <mailto:shirley@DRML-law.com> mmarx@gboe.org has shared REF# 5495941179-documentation 2032Pfile <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTEiLCJsb2NhbGUiOiJlbl9VUyJ9.FXWYg0Y1PY0ILctprXfcgHwW5qsKxU8vIG85sXqNxq_h9i6kGhynUAjH-j53lisya83nOzoz_LIA5dyIq_f6uw> Open <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2lkL3VybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTIiLCJsb2NhbGUiOiJlbl9VUyJ9.RRegusJvx9KcvAy6KDBkxhhmfXclEC5f_BCga2pYEi5aijQ2vmoGHWIqbNtTmbemN3fG_w3EWZ911a0E3pWWdg> Your public profile <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vYWNjb3VudF9wcm9maWxlIiwibGFiZWwiOiIxMyIsImxvY2FsZSI6ImVuX1VTIn0.mCYT4Tl5bdSM2m5P1XaqRONvfv-pGworAvB6psEElFnmpCo8irnlltz_MqSaD8Txphgniv4kh7X3RYdBMPPKhg> is visible to others who can access this document. You can leave the document at any time by selecting Remove me from the incontext menu. SENT BY mmarx@gboe.org SHARED ON May 10, 2024 2:14:44 PM UTC <https://landing.adobe.com/dam/global/images/adobe-logo.classic.160x222.png> Manage Account <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vYWNjb3VudCIsImxhYmVsIjoiMTQiLCJsb2NhbGUiOiJlbl9VUyJ9.h9JU5RdtFHwvUaNLVQsCFx0NfteLzNOfpi2Ul-Oa6r0A91FCkRuJ1P6-o5d6vJzWVAx0VM1fv4ToxTAzoknEAQ> Customer Support <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vc3VwcG9ydCIsImxhYmVsIjoiMTUiLCJsb2NhbGUiOiJlbl9VUyJ9.jhEqApt-HYgf9ee1b6mwvjffAhmu9rCfcQU60sbHgNWmUc6eApwNgi4MFQtXgYzEVqQwBWS22aoRUVyxrX89-Q> Forums <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vZm9ydW1zIiwibGFiZWwiOiIxNiIsImxvY2FsZSI6ImVuX1VTIn0.7zoLiSqNSQgn2rPs2ba8rtwhEUHY6I1K-GDduYPSV2zgGbnbNePDbcEOB9AOqmnGTXA9zLNaN2MFTVM3Kgk82g> Terms of Use <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vdGVybXMiLCJsYWJlbCI6IjE3IiwibG9jYWxlIjoiZW5fVVMifQ.OuomSl74u5nokEDrkD2SBQ8PeIL_OSuQjT3oLseU6GdPqAfvnRtFgsoLLdfa1IcyA3S-OOvz2_2YaLqwHQmYrw> Report Abuse <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL2Fjcm9iYXQuYWRvYmUuY29tL2xpbmsvcmVwb3J0YWJ1c2UvdHJhY2s_dXJpPXVybjphYWlkOnNjOlZBNkMyOmYyOTA2Y2QzLTk5ZjQtNGU3MC04MzE1LTkyNjQzYzE0NDEwNCIsImxhYmVsIjoiMTgiLCJsb2NhbGUiOiJlbl9VUyJ9.kw5l67MwoItoZXHj-JhYhWLDz_BWET7BVNsPJg-HZ4XJiGWKzo24iIr9Ohn7t0HGLB7cYmmGMkSo-EA-MtGEcA> Adobe, the Adobe logo, Creative Cloud, the Creative Cloud logo, and Document Cloud are either registered trademarks or trademarks of Adobe in the United States and/or other countries. This is not a comprehensive list of Adobe trademarks. For a full list, refer to the Adobe Trademark Guidelines <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vdHJhZGVtYXJrcyIsImxhYmVsIjoiMTkiLCJsb2NhbGUiOiJlbl9VUyJ9.CWx9s9Q2Qavw4qpFU8SfM9sngD1VbZnFoEdbsHpdaNDuWFSgpL6U7p7uP5qTGYu-1bRfmLs-7UF4Mp9PsgxdCA> . All other trademarks are the property of their respective owners. Registered Office: Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Park, Dublin 24, Ireland. Registered number: 344992 Stop notifications for reviews <https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxpbmsiOiJodHRwczovL3d3dy5hZG9iZS5jb20vZ28vY29tbXMiLCJsYWJlbCI6IjIwIiwibG9jYWxlIjoiZW5fVVMifQ.qMQSt0cG3vpbhJtZbL4hjwEPyMA5SDNMv43ZNbAA34Eyy7sbfT1ZvOLQ0KHBS3RG8roH4CHPs4S5cORqdgK7rg> . <https://postoffice.adobe.com/po-server/link/open?source=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImNyYWlnY3VsbHVtNTI3QGdtYWlsLmNvbSIsInJlcXVlc3RJZCI6IjBjZGM2NWIxLWViNzYtNDNkZS00ZjAyLWUzMTYwZjU3MTk5YyIsImxvY2FsZSI6ImVuX1VTIn0.SDeCc72tt9EevsdLvooTFPvyu3ICf6Y0_F7PcxEtZDiEwa6YLaot3FKE46nChVCDl3Bu-a6ztcneVwAYbyAx6Q>
Attachments:

Key	Value
Received	from BY1PR18MB5839.namprd18.prod.outlook.com
BY1PR18MB5839.namprd18.prod.outlook.com with HTTPS; Fri, 10 May 2024 19	19:51
by DM4PR18MB4223.namprd18.prod.outlook.com (2603	10b6:5:392::5) with
2024 19	19:48 +0000
([fe80	:a4e0:2470:a19c:157%6]) with mapi id 15.20.7544.048; Fri, 10 May 2024
19	19:48 +0000
From	Marie Marx <mmarx@gboe.org>
To	Marie Marx <mmarx@gboe.org>
Subject	REF# 5495941179-documentation 2032Pfile
Thread-Topic	REF# 5495941179-documentation 2032Pfile
Thread-Index	AQHaow8IUaOpM6wj+0i8MhxDSJ99sw==
Date	Fri, 10 May 2024 19:19:48 +0000
Message-ID	<BY1PR18MB5839DDDB7F5FAD78C6C0EFEACAE72@BY1PR18MB5839.namprd18.prod.outlook.com>
References	<0101018f63edde27-26b4fb6a-bbfa-483a-bc56-a31fb36c617e-000000@us-west-2.amazonses.com>
In-Reply-To	<0101018f63edde27-26b4fb6a-bbfa-483a-bc56-a31fb36c617e-000000@us-west-2.amazonses.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-AuthSource	BY1PR18MB5839.namprd18.prod.outlook.com
X-MS-Has-Attach	X-MS-Exchange-Organization-Network-Message-Id:
X-MS-Exchange-Organization-SCL	1
X-MS-TNEF-Correlator	msip_labels:
authentication-results	dkim=none (message not signed)
x-forefront-antispam-report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY1PR18MB5839.namprd18.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(366007)(41050700001);DIR:INT;
x-ms-office365-filtering-correlation-id	d3cb0612-f090-4265-3f24-08dc712628e3
x-microsoft-antispam	BCL:0;ARA:13230031\|366007\|41050700001;
x-ms-publictraffictype	Email
x-ms-traffictypediagnostic	BY1PR18MB5839:EE_\|DM4PR18MB4223:EE_\|BY1PR18MB5839:EE_
x-ms-exchange-crosstenant-network-message-id	d3cb0612-f090-4265-3f24-08dc712628e3
x-ms-exchange-crosstenant-originalarrivaltime	10 May 2024 19:19:48.8049 (UTC)
x-ms-exchange-crosstenant-fromentityheader	Hosted
x-ms-exchange-crosstenant-id	b80e5fc2-680e-4818-a40f-7a60cc2263db
x-ms-exchange-crosstenant-mailboxtype	HOSTED
x-ms-exchange-crosstenant-userprincipalname	lBe9jD90WUQGLuSZS6SEDRVmS5RxbbtlN/jxeHbDdjTaoNmX1s4DoMvrIDvTkeZJ
x-ms-exchange-transport-crosstenantheadersstamped	DM4PR18MB4223
x-ms-exchange-transport-endtoendlatency	00:00:02.6372128
x-ms-exchange-crosstenant-authsource	BY1PR18MB5839.namprd18.prod.outlook.com
x-ms-exchange-crosstenant-authas	Internal
X-Microsoft-Antispam-Mailbox-Delivery	ucf:1;jmr:0;auth:0;dest:C;OFR:CustomRules;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	BetO65jPu2ZcXdb3wYB3b+lyvByVf2CwfEz7RfJsERnj306KEXwVvkdD0U1mznHFoG2RCvJhEKXMzcrLeKgStkSoVOtEGCpWRyPub8OBrFH8GPQWmXdPY3L6nOKcaPo+erpVc3jLJ41IZ5Lur4Hke+6GfVQOicPeGng/A/w5zWEjTGoKUK/noqyLAfPTWse158CONfinv68q8pT7oIMVFtKI8QIMbw3VJSFr+Chu582jcngCGiPs8Va9+LFMR8VRGHy6FK7vtnRp3fJcEZE0Aisy6B85v/n4JvisG6CcMnQispr+T1jV5w/iZ3PxniM3r0T5rbwPcVqc04drfd/NldhpYTT10xf62QPivMbuyL1JsKuH9iadz/gHXrQY1Gd8QlhLEK8p2AO031BaxJiswJUCXOKiIvevUIkf2cVovNwVOJWzRxF1t5uiTbUcvuw4bKSIT7+8ox0JY9dwwNf5YVk9BtzQTwRexej51ehskxbcphgIzJRz9NQyX7UWNm33q7yoLPZPqGUgrZHQxk1qsWAFxMoCI7zYRj4zs+0gbcvPGO213BwVK6f3J88X6L5A/29U8b2Nwh3Rq/QhTypwaUn6qXL78yBzOUwuMpKLfU2cRY4Bt1N1+9K/rT42WDJTMlvpDHOkTHWgKa6d08mn4zps9dEV/UeTE+m5VqE7HUiTz4C2jUW6JwmqX1RjDk3N4eI7xdEfFeRmMibju1QzIuB2rDZtQNnGLqQP8xUHMRnBF+seFIl7xR/Aoxu3Z9NZeCbafB9Bym/sZPoyCwjBri1OEhtR3e+A3+TnhSCPBXks2EYCiCYkEnatWGBH4UcGRKm1h+Qa7TEYu5K6kVu31u6RRvHWyTS3Nc3uyG53UPjyq40HB/icvX1JaZoyWp3q
Content-Type	multipart/alternative;
MIME-Version	1.0
date	Fri, 10 May 2024 21:19:48 +0200

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REF# 5495941179-documentation 2032Pfile.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F1939E02-68C9-48DF-B5CF-41CE6106BBCF}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715627942024107000_4CBE35CD-CD38-4D27-8922-25E9346E638F.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1715627942025102100_4CBE35CD-CD38-4D27-8922-25E9346E638F.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240513T2119010808-6920.etl

C:\Users\user\AppData\Local\Temp\~DF82E001EDEFA112D1.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 355

Chrome Cache Entry: 356

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 360

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Windows Analysis Report
REF# 5495941179-documentation 2032Pfile.msg