Edit tour

Windows Analysis Report
WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg

Overview

General Information

Sample name:	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg renamed because original name is a hash value
Original sample name:	WG Pishing Versuch Compltez avec Docusign BCO-AXPO-003.pdf.msg
Analysis ID:	1544687
MD5:	015890c951e8174de40354ce9b7ffc3d
SHA1:	99e53de72827428879d5c6ee184419c2ff1c90dd
SHA256:	882b697291f6ee1d99168168b443f45266dea705be589d828cc2661518bd97e6
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 8076 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8DA48A2-09A7-4EDD-8538-B96EB5A23A97" "09C0D152-9C8A-4A3B-85A5-9615CE186DE2" "7728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7728, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.office.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://api.scheduler.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://augloop.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.entity.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://community.docusign.com/signing-7
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cortana.ai
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://cr.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://directory.services.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ecs.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://graph.windows.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://invites.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.windows.local
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://management.azure.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://management.azure.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://mss.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://na3.docusign.net/Signing/EmailStart.aspx?a=0782aff9-d6d8-4dac-885c-1586d7531928&etti=24&acct
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi137krau46W6bx3Irgdc6K8cc3-8kqqdMzFb
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://substrate.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/fr/articles/How-do-I-manage-my-email-notifications
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/fr/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=fr&
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://tasks.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	String found in binary or memory: https://www.docusign.fr/fonctionnalites-et-benefices/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNot
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	String found in binary or memory: https://www.yammer.com

Source: classification engine

Classification label: sus21.winMSG@3/14@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T1127070470-7728.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8DA48A2-09A7-4EDD-8538-B96EB5A23A97" "09C0D152-9C8A-4A3B-85A5-9615CE186DE2" "7728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8DA48A2-09A7-4EDD-8538-B96EB5A23A97" "09C0D152-9C8A-4A3B-85A5-9615CE186DE2" "7728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to be from DocuSign but uses a suspicious URL structure and an unusually long security code

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi137krau46W6bx3Irgdc6K8cc3-8kqqdMzFb	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	false		unknown
https://api.addins.omex.office.net/appinfo/query	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://powerlift.acompli.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://cortana.ai	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://notification.m365.svc.cloud.microsoft/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://cloudfiles.onenote.com/upload.aspx	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://na3.docusign.net/Signing/EmailStart.aspx?a=0782aff9-d6d8-4dac-885c-1586d7531928&etti=24&acct	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	true		unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://cr.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://store.office.cn/addinstemplate	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://globaldisco.crm.dynamics.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://notification.m365.svc.cloud.microsoft/PushNotifications.Register	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://d.docs.live.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://mss.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://management.azure.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://support.docusign.com/	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg, ~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp.0.dr	false		unknown
https://insertmedia.bing.office.net/odc/insertmedia	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown
https://api.office.net	4FCC870A-081B-46AA-8879-6AE46E196D38.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544687
Start date and time:	2024-10-29 16:26:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg renamed because original name is a hash value
Original Sample Name:	WG Pishing Versuch Compltez avec Docusign BCO-AXPO-003.pdf.msg
Detection:	SUS
Classification:	sus21.winMSG@3/14@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.111.236.34, 52.111.236.32, 52.111.236.33, 52.111.236.35, 13.89.179.13
Excluded domains from analysis (whitelisted): ecs.office.com, slscr.update.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, onedscolprdcus21.centralus.cloudapp.azure.com, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.394595457433472
Encrypted:	false
SSDEEP:	1536:H7YLvGgsEKo0YI3spgs5pNcAz79ysQqt2pJIyqoQhWrcm0Fv6x2y55SvAvGfPUnK:Mugkzyg8miGu2BqoQ0rt0FvOCSmIyU0
MD5:	97916DDA2767675909E97471BEAAFFEB
SHA1:	97738293DD2E43167A329330C205D904119255A5
SHA-256:	56B1268CE5C042F52B5220311449EA7556065705F4B02FD859EC19D172BA3744
SHA-512:	592D4F7C349F0B9AACCF7A62AC3E4CEB20E1DF78BEF5C84D6E411A9BC47C94CCD13AC745D34E2C5750A448E5FB19AC2DEDFED6703DC4AD1A5D54EE23A61DD2A3
Malicious:	false
Reputation:	low
Preview:	TH02...... ..eO........SM01X...,....~C............IPM.Activity...........h...............h............H..h........4......h............H..h\jon ...ppDa...hP...0...`......h.\n...........h........_`.j...h..\n@...I..v...h....H...8..j...0....T...............d.........2h...............k..............!h.............. hx.......x.....#h....8.........$h........8....."hX.......x.....'h..............1h.\n<.........0h....4.....j../h....h......jH..h0...p.........-h .............+h\.\n................ ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.091286183070608
Encrypted:	false
SSDEEP:	48:cG3JFnzyr3InzysWkSyrpednzyrXHnzyMySyKUdSyqIASy1dyDhdyBkJdyVYdyO:hF27I2sVbded2rH2MybKUdbqIAb1EDhl
MD5:	03DEF52CCAC66FA147CAFF32DA00AE0D
SHA1:	FC11EB8E81D377A1E2200CF3937B9036B9A793D8
SHA-256:	7101FCC172A310CA0680D1AA38D03BA8B75F9D40FA504C5611479A0FDE99B40C
SHA-512:	CD960D9C872BDF748B8FB47A47830CBCB3F02DB4D1E3535B7FC7A2F45EE7321064B1853FF5E1D6BEA9C1A7A200059FEDB2AF7A2FDADC12C7C772B60051338D16
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos Display_45876482</Id><LAT>2023-10-04T10:58:38Z</LAT><key>29442803203.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-04T10:58:38Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-04T10:58:38Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-04T10:58:38Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-04T10:58:38Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-04T10:58:38Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4FCC870A-081B-46AA-8879-6AE46E196D38

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180288
Entropy (8bit):	5.291000787223155
Encrypted:	false
SSDEEP:	1536:9i2XfRAqFbH41gLEwLe7HW8QM/o/NMOcAZl1p5ihs7EXXOEADpOoagYdGVF8S7CC:7Pe7HW8QM/o/aXbbkx
MD5:	0757DB8BDA381AFEC065AF66C1636617
SHA1:	CAA684CD31FB145C78740E4C9407E5F0835A559E
SHA-256:	AE09C9284B07D7652A3BF5620FBACF1F54E3F7BE23E843D357B6C0008435EBA9
SHA-512:	A79B87D27E52E8C7C7BF26BDAC8792F7D92079A9049D548F4CE3D85C9E662E0B243E7032C790DFA8FCD2A84FB430632E518E17F374C1F684DF9803DB2C30356F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-29T15:27:10">.. Build: 16.0.18222.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04579732647217531
Encrypted:	false
SSDEEP:	3:Gtlxtjl0WwWlYlxtjl0WwW//ljR9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GtNlYN//lt9X01PH4l942wU
MD5:	242D643DA9F55D421582EE560D172115
SHA1:	1DE3EAB772EF347CE4A9B5903D26F10BAFF9D87D
SHA-256:	F57A65CBEE5A676ED60E0EA2BC94A3CF79E2BA2A1B0909DBB5B002960D6C47B4
SHA-512:	453AB2918D3ED9597D7145442935D7BC8EC425A2CBA63CA52D1011C9786898CA365EEC618236B263468ACC2E24B57F614ED642CCE296C877ECA377685522E750
Malicious:	false
Reputation:	low
Preview:	..-......................hW....Q.J.....{'..T?5...-......................hW....Q.J.....{'..T?5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.48469575269631526
Encrypted:	false
SSDEEP:	48:9dOQ1Y3yUll7DYME4lzO8VFDYMVyBO8VFDYML:9fu3tll4GjVGwYjVGC
MD5:	31F43A9103830714BD8C5B27F4AE81F8
SHA1:	12F8DF4E3F131ED627A9CB9755C00793F469BE64
SHA-256:	58DA301D149E4B2D61E4D001BEE72BB6424B47D82EE416D6064B5F5291BC5473
SHA-512:	7674092E421E50876E1C6EBDB60F1A6169A214F4EC2197C844E3D65C20A0471888A4637FB32374C63B7BEC839CA7782F7B4B673C6F07B482BBDD7C0337B3802C
Malicious:	false
Reputation:	low
Preview:	7....-...........J......M...D).........J......=....SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\28D0CA.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	823
Entropy (8bit):	6.383036735600367
Encrypted:	false
SSDEEP:	24:49YMWWSo0XxDuLHeOWXG4OZ7DAJuLHenX3u3:49YMbuERAc
MD5:	2C1B060229A914F2A90A8C7E3BE6EB40
SHA1:	03D8FB85556EDF397D8AFCAFC0B13F11ECBDE50C
SHA-256:	CB0628092DDEA96BB040221B5C793DBBB792A67D0621BDFBA170C07374D85801
SHA-512:	B69BB43B94BE309FBE7266F0DA6EF49667F171DA1EAE9019CACC717AC132BA673B45C895A6ECAA08880A8B1474A884B0225F688EF8EC6A56C9104EF89C12CD06
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 512.000000
Category:	dropped
Size (bytes):	16452
Entropy (8bit):	3.5450561490096377
Encrypted:	false
SSDEEP:	192:n4++gcWMnxpBhZF06qr0WJt0n/qi6T45CRVcDb+y0Vi3fnPoJwauP2jy8UR1nS2f:4++gI46NIzu+Vp8RUIeMAMnOm
MD5:	E8D945746E8D82B3202882CD5B8EE8DC
SHA1:	9A2FE6BBA0551A47FD035F36823C4C60283F007C
SHA-256:	2AC1EE6D2EDAB81B4C6AD2C83A3F086A9128D1B2AEBC3F39F6AB5FBA2D1ABB87
SHA-512:	395363EFA54248148BE9A08139994912C551C9BEA237CB3CE0BAA8622530477B2A23DF4E820018B8DC824D9DA79C4829135A1B572F605D46B31575431CAE7BEC
Malicious:	false
Reputation:	low
Preview:	....K.e.i.n. .p.h.i.s.h.i.n.g. .m.a.i.l.....V.o.n.:. .T.h.o.m.a.s. .D.r.e.i.e.r. .<.t.h.o.m.a.s...d.r.e.i.e.r.@.a.x.p.o.-.s.y.s.t.e.m.s...c.o.m.>. ...G.e.s.e.n.d.e.t.:. .D.i.e.n.s.t.a.g.,. .2.9... .O.k.t.o.b.e.r. .2.0.2.4. .1.4.:.4.0...A.n.:. .N.O.C. ./. .S.O.C. .<.n.o.c.@.a.x.p.o.-.s.y.s.t.e.m.s...c.o.m.>...B.e.t.r.e.f.f.:. ........................................................................................................................................................................................................,...~...........D...h...v...x...F...H...J............................................................................................................................................................................................................................................................................................................................................................................$.a$....$..$.If........!v..h.#v....:V.......t.....6......5.......4

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730215627840599100_E10997D4-DD35-46CF-97C2-4A91A0910C6A.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28771), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.1780361903737985
Encrypted:	false
SSDEEP:	1536:icAZpv2mTLBSEfBO+QsQHnAo/1U8e8k2GZXdx2tj6ZUIJgC2aLBXgtyiffG:svVJSEU+SHHGahfG
MD5:	4CB2F5DB11AA7C7B4418A1739A106FB6
SHA1:	0C575CEF4742D80F820CD8DDF24A26CE2B660713
SHA-256:	D56226E9AADA985F43D7FC521B141250DA7AA19F138FA3CD5485480395884E8E
SHA-512:	58499D023A66983632443E0CB9DF4CDFC68F98F408E850712492EEF092FB0A6FBC6E1E36434FAED93B20805609ADDF673C810644F8AE22197707F25C1393A7EB
Malicious:	false
Reputation:	low
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/29/2024 15:27:07.907.OUTLOOK (0x1E30).0x1E34.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-10-29T15:27:07.907Z","Contract":"Office.System.Activity","Activity.CV":"1JcJ4TXdz0aXwkqRoJEMag.4.9","Activity.Duration":25,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/29/2024 15:27:07.923.OUTLOOK (0x1E30).0x1E34.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-29T15:27:07.923Z","Contract":"Office.System.Activity","Activity.CV":"1JcJ4TXdz0aXwkqRoJEMag.4.10","Activity.Duration":13144,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730215627841922000_E10997D4-DD35-46CF-97C2-4A91A0910C6A.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T1127070470-7728.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	4.451902018150745
Encrypted:	false
SSDEEP:	1536:wOs76+g0TPPjaHkG5hczAeGHwkQZNh3Iz4NXqWtAkFvqqV9bCZeZcNYhshEidiwn:U44Yd5JXjIgx
MD5:	C637DD4F3C2F750F4C81812531CF0BBC
SHA1:	D16B179D6B0EA73C66814DEE22414D9D83844790
SHA-256:	EC6F6CC83C0BF9F1C59153B2E1DC77C7F606629E73EDA53C8E4385DBC44C5367
SHA-512:	D6963D7E7E1E162B2A921FD24FD89C720DE4460338829D3AAA3D7F9B17CDA799757C53034E404BFD74573A6C778CCF521E86AC7F9D3A314674EE56E2622D3E1B
Malicious:	false
Preview:	............................................................................b...4...0..........................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................d............................v.2._.O.U.T.L.O.O.K.:.1.e.3.0.:.e.5.e.f.6.2.d.1.2.3.7.d.4.f.8.b.a.f.e.7.b.3.a.3.a.3.5.b.c.3.5.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.9.T.1.1.2.7.0.7.0.4.7.0.-.7.7.2.8...e.t.l.............P.P.4...0...B....*..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF17FB7B235DBEB063.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.36988758695597684
Encrypted:	false
SSDEEP:	192:8Vi9SPNrU5goyFYkn8tdYnUSU+tEXKohNgiXHWQOuqAbAW+NhU:qOSrzqYbtE6JiXHOuqM
MD5:	36BDB4419B411342800E0F26EF589486
SHA1:	2CBC3FD2C37700BD4CEF8C12B0EDAB0BA5C0BF73
SHA-256:	1F08EC929F92DB33F371FF60485B96043A24C9438F4E1F01F738204E3ABAAC70
SHA-512:	752B0D5E472AD976B86BDDACAA4CC74B340E8A85A40C9BDB6CBD92410C63B3FF78BE8E2CC3433BC244160E707C73C3CAC5E5784C1EA65C87C29359A1D3BC2D37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:Ayl7/lt:Ac7/
MD5:	E3E08FA39122D2E4404A2BF3ADFC271B
SHA1:	D4E0FB8116C468E11677452D18D32F043008D724
SHA-256:	A874F2FEA6C741CFFACD68011FE21C32EDCE1CAA87D9AE17419DF5509F9350C6
SHA-512:	3EE6C50BAEF2D37DAFB516F47202A4AAA47E35B9A4860254855A3B244EB8FD7B31BFDC24E24168B750C7494D5738A9A3EE2E84E33380B8585AADBD6582B72E51
Malicious:	false
Preview:	..............................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.280861495294828
Encrypted:	false
SSDEEP:	768:RvKQc5W5qqgf8YCtNVTIGl7LeD/TZtG0s5k7p:QSqHUtgGQDN0y
MD5:	662377300593CC858F680BCED9A5AF73
SHA1:	870CA4F6083C0C0F70363E8F701E8E271DE7B5E5
SHA-256:	12E4487591251E638B199D2304C21538191A8307BC61A5C5CDF66295E13111A5
SHA-512:	F6F5F8E976FBB664EC8E467E7CA13A0AFB0FDA83B1FD30555B0ACA3FCECE36EF25ADFB4E3918D160047C7FB35E164765249DACFBA62FAA93C1A25678A850D185
Malicious:	true
Preview:	!BDNl.h.SM......\...7...........:.......U................@...........@...@...................................@...........................................................................$.......D.......U..............6...............9...........................................................................................................................................................................................................................................................................................x........&:.#8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.1305976050085083
Encrypted:	false
SSDEEP:	384:jvjTIgo+YtQ47d5Tvi2UBQJyHWO+9OQArsr9PkZgaU:jbTIIylmm8pUMZD
MD5:	2037CDADF67FC69B0BEDD92CB8762C74
SHA1:	88E84831E708A379A619B424AE25C82B8294CB4C
SHA-256:	CDFE5ADB5761C943C767918C475964BD3A28CB84AC3B1FF80DB4EAEC8B48C6B0
SHA-512:	D93F8A9983808EC2E35B23B89C91C98DF8CAECEF374FF4A19489A1477D6DAE61A07DEC485D0DA41ADC61147A96C0ADFEB933C679049A1C3819D8DE3F3A8A5386
Malicious:	true
Preview:	.ow0...[.......0....]..........B............#...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................:G....:........D.[C...\.......0....].......................#.!BDNl.h.SM......\...7...........:.......U................@...........@...@...................................@...........................................................................$.......D.......U..............6...............9...............................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.137874503074506
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg
File size:	102'912 bytes
MD5:	015890c951e8174de40354ce9b7ffc3d
SHA1:	99e53de72827428879d5c6ee184419c2ff1c90dd
SHA256:	882b697291f6ee1d99168168b443f45266dea705be589d828cc2661518bd97e6
SHA512:	174b6799c090f0f51a846970f698764bd2cf5a73869582d008e5dddb84838dd784a72c8b55f944d6a9424c09bf60aa6781f2901ee8f20687dea7b1319e5d645c
SSDEEP:	1536:Vg/B8OLLLFx5JMXWoWYTWNWWGM951WsWFzDa1:u/uOLLLFxlIXa1
TLSH:	36A3132435E94E35F2769F3289F780979526FD929D218B4F3195334E0A72940A8E3F3E
File Content Preview:	........................>...................................#...................v..............................................................................................................................................................................

Static Mail

General

Subject:	WG: Pishing Versuch???: Compltez avec Docusign : BCO-AXPO-003.pdf
From:	NOC / SOC <noc@axpo-systems.com>
To:	=?utf-8?B?UmVuw6kgRmFkcm55?= <rene.fadrny@axpo-systems.com>
Cc:
BCC:
Date:	Tue, 29 Oct 2024 16:11:17 +0100
Communications:	Kein phishing mail Von: Thomas Dreier <thomas.dreier@axpo-systems.com> Gesendet: Dienstag, 29. Oktober 2024 14:40 An: NOC / SOC <noc@axpo-systems.com> Betreff: Pishing Versuch???: Compltez avec Docusign : BCO-AXPO-003.pdf Hallo zusammen, Ist dieses E-Mail vertrauenswrdig oder handelt es sich um einen Pishing Versuch? Herzliche Grsse, Thomas Von: DocuSign NA3 System <dse_NA3@docusign.net <mailto:dse_NA3@docusign.net> > Gesendet: Dienstag, 29. Oktober 2024 10:12 An: Thomas Dreier <thomas.dreier@axpo-systems.com <mailto:thomas.dreier@axpo-systems.com> > Betreff: Compltez avec Docusign : BCO-AXPO-003.pdf InterCloud Order vous a envoy un document examiner et signer. EXAMINER LE DOCUMENT <https://na3.docusign.net/Signing/EmailStart.aspx?a=0782aff9-d6d8-4dac-885c-1586d7531928&etti=24&acct=41a629a2-9673-4bb0-9a1d-74ba1758b1de&er=6ecab204-b258-4076-9d79-4382672d38d5> InterCloud Order order@intercloud.com <mailto:order@intercloud.com> Thomas Dreier, Compltez avec Docusign : BCO-AXPO-003.pdf Merci, InterCloud Order Technologie Ne partagez pas cet email Cet email contient un lien scuris vers Docusign. Ne partagez pas cet email, le lien quil contient ni le code daccs avec dautres personnes. Autre moyen de signer Consultez le site Docusign.fr, cliquez sur Accs aux documents et saisissez le code de scurit : 0782AFF9D6D84DAC885C1586D75319283 En savoir plus sur Docusign Signez des documents lectroniquement en quelques minutes. Cest sr, scuris et juridiquement contraignant. Que vous soyez au bureau, chez vous, en dplacement, ou mme de lautre ct de la plante, Docusign vous offre une solution fiable pour la gestion de transactions numriques (Digital Transaction Management). Des questions sur le document ? Si vous devez modifier le document ou si vous avez des questions sur son contenu, veuillez contacter directement lexpditeur par email. Ne plus recevoir cet email Signaler cet email <https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi137krau46W6bx3Irgdc6K8cc3-8kqqdMzFblC35G0KyT9QmT0pXwaIg0zedr4BRuQZs8sxqwoBO-XFeh5pHuMm2lKFyP11iWaMI0i42cVOJckasMADCAIcTbnJSFQfPRe3lnc8YWcJIowCdsH5Zz6x_zwTC7eifyO6vCTsoXUySzLWvHknYIgX2cV7vucSjtOsS9ITNqCXV2EUw5sDqSkAemTBD-D1aIU5T8dB_jBS9KfYv7yaT4Fl30XV9J2R7b7Kuv36u53B8L6_8wxaXowh2ilObKVTnhrD-2hzhf4bD3YZMBz6C6ezBJruntpyERdoX1lfD8zbCzPMM7_c4IuythnRIfk2VXTd5Dbc1SPqu3v4tKdDNoKp21unBILZByMZiL9YY32yqQ6Kqk_eAfW3p35wy3Wry8ZCYbjLrWo_t_DemxyDgLaJ80SWpfch8OIQ&lang=fr> ou en savoir plus sur Refuser de signer <https://support.docusign.com/fr/guides/Declining-to-sign-DocuSign-Signer-Guide> et Grer vos notifications <https://support.docusign.com/fr/articles/How-do-I-manage-my-email-notifications> . Si vous rencontrez des difficults pour signer, consultez Comment signer un document <https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=fr&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> sur notre Centre dassistance Docusign <https://support.docusign.com/> , ou parcourez notre Communaut Docusign <https://community.docusign.com/signing-7> pour plus dinformations. Tlcharger lapplication Docusign <https://www.docusign.fr/fonctionnalites-et-benefices/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> Ce message vous a t envoy par InterCloud Order, qui utilise le service de signature lectronique Docusign. Si vous ne souhaitez plus recevoir demails de cet expditeur, contactezle pour le lui signaler.
Attachments:	~WRD0000.jpg

Headers

Key	Value
Received	from GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM
15	11:17 +0000
Authentication-Results	dkim=none (message not signed)
GVAP278MB0104.CHEP278.PROD.OUTLOOK.COM (2603	10a6:710:22::10) with Microsoft
15.20.8093.32; Tue, 29 Oct 2024 15	11:18 +0000
([fe80	:4e43:b87c:b7ef:2050%5]) with mapi id 15.20.8114.015; Tue, 29 Oct 2024
Content-Type	application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding	binary
From	NOC / SOC <noc@axpo-systems.com>
To	=?utf-8?B?UmVuw6kgRmFkcm55?= <rene.fadrny@axpo-systems.com>
Subject	=?utf-8?B?V0c6IFBpc2hpbmcgVmVyc3VjaD8/PzogQ29tcGzDqXRleiBhdmVjIERvY3Vz?=
=?utf-8?Q?ign_	_BCO-AXPO-003.pdf?=
Thread-Topic	=?utf-8?B?UGlzaGluZyBWZXJzdWNoPz8/OiBDb21wbMOpdGV6IGF2ZWMgRG9jdXNpZ24g?=
=?utf-8?Q?	_BCO-AXPO-003.pdf?=
Thread-Index	AQHbKeKlU/54HXjWKUSkvWHBG/OI2LKdvFLAgAAZK7A=
Date	Tue, 29 Oct 2024 15:11:17 +0000
Message-ID	<GVAP278MB0503396D6C33F9EC96074D708A4B2@GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM>
References	<9766015192ee4e0785b1c18b942fdeca@docusign.net>
In-Reply-To	<GVAP278MB000574D2D32B07780FB08C74C74B2@GVAP278MB0005.CHEP278.PROD.OUTLOOK.COM>
Accept-Language	de-DE, en-US
Content-Language	de-DE
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-SCL	1
X-MS-TNEF-Correlator	<GVAP278MB0503396D6C33F9EC96074D708A4B2@GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM>
MIME-Version	1.0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-AuthSource	GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-Network-Message-Id	c3d19091-6309-48d7-5c44-08dcf82bf056
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	GVAP278MB0503:EE_\|GVAP278MB0104:EE_\|GV0P278MB0768:EE_
Return-Path	noc@axpo-systems.com
X-MS-Exchange-Organization-ExpirationStartTime	29 Oct 2024 15:11:18.2624
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Office365-Filtering-Correlation-Id	c3d19091-6309-48d7-5c44-08dcf82bf056
X-Microsoft-Antispam	BCL:0;ARA:13230040\|366016\|8096899003\|41050700001;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:fr;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(8096899003)(41050700001);DIR:INT;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	29 Oct 2024 15:11:17.9024
X-MS-Exchange-CrossTenant-FromEntityHeader	Hosted
X-MS-Exchange-CrossTenant-Id	60d56295-773f-4d6d-bad7-84d99a24857a
X-MS-Exchange-CrossTenant-AuthSource	GVAP278MB0503.CHEP278.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-Network-Message-Id	c3d19091-6309-48d7-5c44-08dcf82bf056
X-MS-Exchange-CrossTenant-MailboxType	HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName	5rGKUP/IS/uNDbP+Bts2TiSV/3njgoDADHMoXJjNbLYyJjFX0f22/CmYpm2ksOlaDiXBdp29SPd2kPV9LVkHCA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped	GVAP278MB0104
X-MS-Exchange-Transport-EndToEndLatency	00:00:02.8175516
X-MS-Exchange-Processed-By-BccFoldering	15.20.8093.027
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	7TSKSqbSnDxFVIpGzIQWlKQcsMUWEwDkzLKgPpYdheUx7ZJei5X2gApunkFLCchE9tvrOcTxptvjRC+wvaxlHDnKXy5XkmC80i6Od61DWXZOAFEnXQ98ZEn/PdUqBhomaPXvmIQ4h+ezutGLmCs1eCmT+YcDlP8rSbHUgBfXkJbcS/8XJ6k2+PZHATiRY2weaniClyaGs0B/cguoMJK6eNsBrRrJ0GR5aBvHD7KA2I7aLHMuxfrsJLSV3o9E5D2MYIbpr/M1lnwApbbrniGONn2znvtqaJmi7I8958F7a0nLzXStPtuMMbDqw6yKmLAGUGIz0tZTzcx2ofegnrsRrfDn1hhniZXC8/4uOpOijo3ulTE2MoXV4C5i81BFFZ5dujDkorEttmi8NHdPjAfskUc1J3glp1bepxT0rl53541TYq0ZG0CJsExvqRk8OajosEcYzYGcapjNWEgkIr0ln7WH1US7+LFImiJQ8hmWxtlGVtR+Cp/PJ9qie9Txs1er97JX84vMa6pghHNyQsfWbNWTEI7WwGKz2i7LieltGI34a8K9v+OsbUd9oMWKFYB70EAP4rh/xe0yZ/n92H1wYhomUeljhtnFWHwy55ytaVOlWeIB5fPz3kb3HrkxHZunnuyJaxI7SFK4qbSUCK2qWO0LLMTxiM5zjLapCVLw1pIzaZYqh7L1v/z1QzQObfPQvS/kg9PfHKUxzauvVPjHX/pd8Zuy8WrtRD5+HsiWFea91B835vY/91DhqcIlOc1KnAuc6oCgUoz8meKrCCtf+x1e350oBssyKWqUiGBIThfrM2ARATufavAO0jVrCgonmWqpuzCMQpbsL42OGdqoLQ==
date	Tue, 29 Oct 2024 16:11:17 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Target ID:	0
Start time:	11:27:03
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg"
Imagebase:	0x8a0000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:27:10
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8DA48A2-09A7-4EDD-8538-B96EB5A23A97" "09C0D152-9C8A-4A3B-85A5-9615CE186DE2" "7728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff7f2fb0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4FCC870A-081B-46AA-8879-6AE46E196D38

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\28D0CA.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A8B68441-CAFE-4122-B30C-A1BA2DCC021D}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730215627840599100_E10997D4-DD35-46CF-97C2-4A91A0910C6A.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730215627841922000_E10997D4-DD35-46CF-97C2-4A91A0910C6A.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T1127070470-7728.etl

C:\Users\user\AppData\Local\Temp\~DF17FB7B235DBEB063.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
WG Pishing Versuch Compl#U00e9tez avec Docusign BCO-AXPO-003.pdf.msg