Edit tour

Windows Analysis Report
AWB-M09CT560.docx.doc

Overview

General Information

Sample name:	AWB-M09CT560.docx.doc
Analysis ID:	1545123
MD5:	f7c1cf4cd91138f1c612b34717f6a3d4
SHA1:	fb22da61844c7ee52b306675a5315db6d9f76f37
SHA256:	9c7fcd1b7917d8a13309d4cc1bd0eee6959fb8ed06ed358326a6f828697e4fd6
Tags:	docdocxuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Contains an external reference to another file

Office viewer loads remote template

Sigma detected: Suspicious Microsoft Office Child Process

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3240 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

verclsid.exe (PID: 3804 cmdline: "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5 MD5: 3796AE13F680D9239210513EDA590E86)

EXCEL.EXE (PID: 3828 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EXCEL.EXE (PID: 3884 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, CommandLine: "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, CommandLine|base64offset|contains: , Image: C:\Windows\System32\verclsid.exe, NewProcessName: C:\Windows\System32\verclsid.exe, OriginalFileName: C:\Windows\System32\verclsid.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ParentProcessId: 3240, ParentProcessName: WINWORD.EXE, ProcessCommandLine: "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, ProcessId: 3804, ProcessName: verclsid.exe

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 3240, Protocol: tcp, SourceIp: 104.21.74.191, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3240, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3240, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: acesso.run

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for submitted file

Source: AWB-M09CT560.docx.doc

ReversingLabs: Detection: 33%

Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49161 version: TLS 1.2

Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run

Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.74.191:443

Source: Joe Sandbox View	IP Address: 172.67.162.95 172.67.162.95
Source: Joe Sandbox View	IP Address: 104.21.74.191 104.21.74.191

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A26CAB80-A8B4-4BB0-A913-49E7089833DE}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: acesso.run

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:22:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GO%2B9885lC2Z27uSni9jmOIhI4dLL90bZmjHdVFwUnxlJsp3YNPJd6LAePxU4Vs7cgOhuldCVPKC8Ip%2FUvTuxySxs0CcINLdZz5RwQlnJ0%2FQmsdtBSa7hN7176CDJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da94f1a78f48784-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1456&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=728&delivery_rate=2244961&cwnd=247&unsent_bytes=0&cid=69765e49a4479b12&ts=295&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:22:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Security-Policy: default-src 'none'cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=euVxp%2Fxp9DKS%2B8DctqGQqyEAazHv8JgqNP3gtVsucfo%2BYjfcr2HFcOYj7GUT%2FayEgg6bXjsGUbKewhzqtyXb7FRnfdeWFdZkvDqEINeBLGBnJgYVPvta%2F9ORqcUm"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da94f3bcd8ba927-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=771&delivery_rate=2513888&cwnd=168&unsent_bytes=0&cid=a60882f580010c63&ts=242&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:22:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Security-Policy: default-src 'none'cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OmkIr4mijRseEgH%2BJMyCBiBE%2F1hWzsNkar8tmhq3ZgoEHxpj%2Bb2Ah83ByUJxaET2Rui8M9W4qTaAB8GmUB83Y6lsXpIGeknD%2BT92kRRZcxh0sfoiyOMoaIhRVhMy"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da94f414cd3477a-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=771&delivery_rate=1676896&cwnd=226&unsent_bytes=0&cid=26c2750aa581e334&ts=289&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:22:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vsximHz4s55g7UN0XfXfoqZJ4gtNioUcsiJkL7f924jHe3ukAjIHhElQHXgYtuETZ%2FdRIuRHRZZblsu1NwMv%2BWdG%2BI2xu6suSU1q5VNE20JfmA1TpSbE0yZqTekQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da94f4e7c51315a-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=926&delivery_rate=2118507&cwnd=242&unsent_bytes=0&cid=e425e604b01cd1f0&ts=253&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49161 version: TLS 1.2

Source: ~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal76.evad.winDOC@5/16@7/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$B-M09CT560.docx.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR78A8.tmp

Jump to behavior

Source: AWB-M09CT560.docx.doc

OLE indicator, Word Document stream: true

Source: 4.466364_2401 PACKING LIST.xlsx.0.dr

OLE indicator, Workbook stream: true

Source: AWB-M09CT560.docx.doc	OLE document summary: title field not present or empty
Source: ~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: AWB-M09CT560.docx.doc

ReversingLabs: Detection: 33%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\verclsid.exe "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\verclsid.exe "C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5	Jump to behavior

Source: C:\Windows\System32\verclsid.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\verclsid.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\verclsid.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\verclsid.exe	Section loaded: rpcrtremote.dll	Jump to behavior

Source: AWB-M09CT560.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\AWB-M09CT560.docx.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AWB-M09CT560.docx.doc	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/media/image2.png
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/media/image1.png
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: AWB-M09CT560.docx.doc

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: \Device\RdpDr\;:1\acesso.run@SSL\DavWWWRoot

Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://acesso.run/bkeoxh?&ashram=various&tiger=merciful&creative=threatening&campanile

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\verclsid.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\verclsid.exe TID: 3824	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\verclsid.exe TID: 3824	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\verclsid.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	14 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWB-M09CT560.docx.doc	33%	ReversingLabs	Win32.Trojan.Generic
AWB-M09CT560.docx.doc	6%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
acesso.run	7%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
acesso.run	104.21.74.191	true	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://acesso.run/404	true		unknown
https://acesso.run/bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.162.95	unknown	United States		13335	CLOUDFLARENETUS	false
104.21.74.191	acesso.run	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545123
Start date and time:	2024-10-30 07:21:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AWB-M09CT560.docx.doc
Detection:	MAL
Classification:	mal76.evad.winDOC@5/16@7/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:22:37	API Interceptor	9x Sleep call for process: verclsid.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.162.95	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse
	0001.xls	Get hash	malicious	Remcos	Browse
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Order-1351125X.docx.doc	Get hash	malicious	FormBook	Browse
	2MbHBiqXH2.rtf	Get hash	malicious	RedLine	Browse
	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	Get hash	malicious	RedLine	Browse
	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse
	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse
	PROFORMAXINVOICE.docx.doc	Get hash	malicious	Lokibot	Browse
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
acesso.run	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	172.67.162.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Purchase Order PO61000016222.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	0JLWNg4Sz1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	XhYAqi0wi5.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
CLOUDFLARENETUS	Purchase Order PO61000016222.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	0JLWNg4Sz1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	XhYAqi0wi5.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	0001.xls	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	1.rtf	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	ingswhic.doc	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	swithnew.doc	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95 104.21.74.191
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95 104.21.74.191
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.162.95 104.21.74.191
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95 104.21.74.191
	odthings.doc	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	na.doc	Get hash	malicious	MassLogger RAT	Browse	172.67.162.95 104.21.74.191
7dcce5b76c8b17472d024758970a406b	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	104.21.74.191
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	104.21.74.191
	Transferencia.doc	Get hash	malicious	Quasar	Browse	104.21.74.191
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	SecuriteInfo.com.Exploit.CVE-2017-0199.05.Gen.16537.13180.xlsx	Get hash	malicious	HTMLPhisher	Browse	104.21.74.191

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025657033294029664
Encrypted:	false
SSDEEP:	6:I3DPcwth9RvxggLRDuhq0uXlY0TRXv//4tfnRujlw//+GtluJ/eRuj:I3DP/b/uhqD+OvYg3J/
MD5:	0A2CB5B8572A589C20EC0D52A7819C98
SHA1:	CC03367634018B72CA54574476350BA022116A35
SHA-256:	778CEA53EF910CE622E037B80157F1D32F0462EC53EF17C722CE4C5B868EAC67
SHA-512:	6A092DAC456DF0B399E96A377F538EF3C0457A8F9E8B85850363ED15860087BD96CF8D12B7E84F08B6B4A3CAB4241BA055B0E2ABD221A1A2C893FB4DD394AD2B
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z..r}...B...?5...S,...X.F...Fa.q...............................-.).E...(............t/..FZK..4].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1FC6CE80.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7428
Entropy (8bit):	5.614949866122965
Encrypted:	false
SSDEEP:	96:yJBOblJaXn/08zDefAm/luoOHo6MiDbDda91RjTBbPxmPAWmOHGXED:yGTNAK4oOIGbK1RvVwPAWmOHGXw
MD5:	A0981767D618160D66397C829AF1CEFB
SHA1:	CB76812F91F24C49385A2E99E6BBC657FCB0E18F
SHA-256:	48F87B835ADFA658EADF4C6D9321B08308B0B9F8292E7013CD0751A8F52E1EAB
SHA-512:	B41798F1F835DFA57C701ABDF94EDD140F92C93D66374264E7E4D420D4E2A1A2FCB719C78EE19E5476B3F3B20E37A2350A64DDAE0AF1C6866EE8A9E4937FAEDB
Malicious:	false
Reputation:	low
Preview:	....l...............<................... EMF................................8...X....................?..................................C...R...p...................................S.e.g.o.e. .U.I...................................................p.6.).X.....S.d.....................O..O....s....\.....O.......O.\|.O.7..s......O..].u?..s.......s..p...vw.Mq...b.....8.O...sw..q.$.......d.........O.*X.s.....X.s.?q..Mq...n...b.-...d.O.6=rw................<..u.[.v....X..Z......p........................vdv......%...................................r.......x...........'...x.......(...(..................?...........?................l...4...........(...(...(...(...(..... .........................................................................................................................................................................................................................................HD?^KHCcNJFfOJFiQMHlSPJoUPLrWRMvYSPx[UR{]XQ~^XS._ZT.a[U.c\U.e^V.e^X.g`Y.hbY.jaZ.jb\.ld].ld].nd^.nf^.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5BF1D71A.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 42 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	822
Entropy (8bit):	7.616419704330421
Encrypted:	false
SSDEEP:	12:6v/7LWb/EYintm3eiVOOrbyUv5uNEXoNGJ/qiIXrqOoNUHGcvlf3vKyo1AIJc8Ni:eeinouisOPAYGK/qhLoNUHL9f3iZPpNi
MD5:	35C4E9D7C83D8F4A6792B18A15937836
SHA1:	FD15558DDC4DB88D3BB5491F2064B3C2AFBC85DF
SHA-256:	A8C99F80AB0A94ED469AE026947C14FF6C41F7EB816933EB7A54FCB937FB82B6
SHA-512:	1906EFA3A254C7E955D786C15C4E1A870B5BD9BFC815704E7BE507FEF383E5F602783C55EC33D0CB38710FC44728E97F36FE25E67B6C4934C221DB525B25D67C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR......3.............sRGB.........gAMA......a.....pHYs..........o.d....IDAThC.=.)Q....i...B.P.D..mU+..P..Y.Q..Pjh..H.$.."..n..H.t..w......\o._r....d..{g.1..........E..p...h4.....>..L&..V..........m_,..///x.^..jEG]FWQ.L$..B.....v..g.YM..B..\|>.G.QM....J..g?.t...I.n....5........O....K..wE.u{Z........2.N..b.....Zt..A2...`@[...n...P.....,..0..P$._#e..W&..S%..~zz..8..-......1v..`...c...T...'e...m.....$..v...-.l6).D"......i?....f.....L&.....e.`.N.S.....2y...!.....%..l(..,.r.L..`..C.a.>??S&..<.D...).,.K.....Z......)..K.f.Q&..j..%.t:..(.....LX...c......-..x(..>...[..r.M...^.G..E...JQ%.Q..V.....4..L.c.J...J%...Q...C6..J... .............mj....d.d.5.....g.."({zb5./.....V?J..a.4J..TQd4..>...tQ.\.8.ZRZq3Q.;.N.bo.+.b.G[\|m..f.X,....V.x<~.k.....E.....I..........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8864853.png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 55 x 39, 8-bit colormap, interlaced
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.14782184831536
Encrypted:	false
SSDEEP:	24:ct4piFqtc+YQKOQw45DymHbFUN9F2zFg91p:Poqtc+fJX+Xarrp
MD5:	49A2F544E34D8473E29F8C4D9CB10D78
SHA1:	8B30666DE8F119B1C2E800C2B2437C09C4F6CEC9
SHA-256:	52417106494ECBBDD3A3D56DE565996562A1C0B0C29C4F43ED99E5FCB4805E07
SHA-512:	091D234ED76AFDEFC4AB3D1687FEE14DDFCFE0149F01106716ED383EB6FC8913803B26A32C69E15ECC85F6781DF09BD1C712193D8A234042E844730C56864128
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...7...'........y....sRGB.........gAMA......a.....PLTE..............===SSS........."""...---......uuu....................'''.........\|\|\|~~~..............$$$...555..........YYY......@@@.........ddd...___.....................,,,......DDD.....000.............u...}}}......???......&&&.........UUU......HHH.........jjj777.........qqq...III......yyy......XXX..........;;;...444.....[[[.........sssppp...BBB...+++...>>>!!!mmm...AAA...###zzz%%%...TTT...xxx......JJJ....bbb...FFFNNN {{{.........VVV.................tRNS..........................................................................................................................................................^p.....pHYs..........+......IDAT8O.M.. .....+...*.`.b..{.H\.s..._H..b..\|....>...x...o.<.D-..d..&+..'L....2..g<0...1.s.E_..c)..EY..4d..DCJP/....d&.......p4........Y..$.>^..\.Y8.:.wjg.+.~.j.".v....!<.......j...+.i.R.7....Fi.yRA.2+.tK....F3..f4..m...L..z>.X.....,..hv..y..j.G.....s..`..e..<....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.285025063890845
Encrypted:	false
SSDEEP:	768:pYX89n64o5bzkv8iCjOm3uv90YVXHwtYX89n64o5bzkv8iCjOm3uv90YVXHw:SyviF3WTNHTyviF3WTNH
MD5:	94712EE400983E4B54CDE652C41F5787
SHA1:	B17B4122432ACFBC53BDB178487723AF6E132E01
SHA-256:	7983893431831CABC50AED2355D8D794E202C1F6FCCB5A4D97EF017DA7F818A0
SHA-512:	613884E4427CEB3EB421D15B4A55A1423B6C434B9B7C1973E991CBC7E5BBFCFFD7F9D4A0ABD8E0525B33AB4C3AD058FFDB7903D11147B3743BAD3530EC6C2993
Malicious:	false
Reputation:	low
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................9....................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8.......:...;.......=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7B3BFE15-CA86-4957-A0E6-3A277A67AA66}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.5528375746276538
Encrypted:	false
SSDEEP:	3:Gg7NNKElClDK/lNlYdltn/lvllLl/2qlrzNBqkzNB/EPXwPxZlhWu/+6n:3pUElClDK/e3Xt7j/mXwPxZSu26
MD5:	1CDE6EB529DAF198F0A2C88465709CA0
SHA1:	B3375E057829A7A8B7D0929160F59EE2414DA928
SHA-256:	6F07DF007C3ABC15BFD89BD942FDC1A75F4C9E523C4D20C5B6441156B85B11AA
SHA-512:	052A97933AD5F2A60D511836DE796E0987F4C0DF38588B0C8B6B5B9CD3D2D53BF374349AC43EF70041D728C54647B56A3329EDD0EFCF166AF5A9D06AFEE3B564
Malicious:	false
Reputation:	low
Preview:	....E.M.B.E.D. .P.a.c.k.a.g.e..... . ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A26CAB80-A8B4-4BB0-A913-49E7089833DE}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4.466364_2401 PACKING LIST.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	26110
Entropy (8bit):	7.621832725963441
Encrypted:	false
SSDEEP:	384:4X89n8bp+o5bjfTlqveNi/36emvOmHGJMHuMw9fvHZSildVX1ZZ2bm:4X89n64o5bzkv8iCjOm3uv90YVXHwm
MD5:	B9EEC5763BD7CF995AE4CB02F24A7E2B
SHA1:	9C450546C6632262C7BABD5BA1990CD0B30E14D6
SHA-256:	FB55559C6DDD496228CCB56832AAC3B21291872CAD1D4B61C5F4FC4F8F0D1BAA
SHA-512:	D3D1874B7C0984952FE7381E00FA97FDE86CB2476AEBF73FE8347B2DA274160B76BBE98AAF866CBEA5FB4ACB23E9FA04423AA1E7E1DD02EDDED92A4F7D058395
Malicious:	false
Preview:	PK..........!...............[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..#.....q..j...# ..`.mb.-....6.B.4..K..wfv...l.......q^.E.^.c}.......7....X.....d...W{lDG...D.A....<..C...kjeTz.Z.......x.Q....-....n...J......L.....Z......!....j0A...]cL..v..:&.....1.r+g...N.g.y}{E....\.Psei.;.....!.....?`...'..A..\:....-.E..d_3..u.......FYn.G...+..:...d......."...m/.C.J`...=.....:LR.Y.\?....h.W+.o:..#........BD.......\=....,l.a.O.a.p<.c..k.l.%._.......PK..........!..U0#....L...

C:\Users\user\AppData\Local\Temp\4.466364_2401 PACKING LIST.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\{DDCF9BC7-CD01-42DF-8C28-24E11853346A}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025657033294029664
Encrypted:	false
SSDEEP:	6:I3DPcwth9RvxggLRDuhq0uXlY0TRXv//4tfnRujlw//+GtluJ/eRuj:I3DP/b/uhqD+OvYg3J/
MD5:	0A2CB5B8572A589C20EC0D52A7819C98
SHA1:	CC03367634018B72CA54574476350BA022116A35
SHA-256:	778CEA53EF910CE622E037B80157F1D32F0462EC53EF17C722CE4C5B868EAC67
SHA-512:	6A092DAC456DF0B399E96A377F538EF3C0457A8F9E8B85850363ED15860087BD96CF8D12B7E84F08B6B4A3CAB4241BA055B0E2ABD221A1A2C893FB4DD394AD2B
Malicious:	false
Preview:	......M.eFy...z..r}...B...?5...S,...X.F...Fa.q...............................-.).E...(............t/..FZK..4].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{F53D3696-CAC8-4040-B1A1-DD4531201B31}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025606259505332966
Encrypted:	false
SSDEEP:	6:I3DPcf1DdVvxggLRZk5oKtRXv//4tfnRujlw//+GtluJ/eRuj:I3DPSz65oSvYg3J/
MD5:	0B34337A338EC4F17A17F0300B00A7EF
SHA1:	77CE7156DC01A286BB8F58749EDD4505CABFEBC0
SHA-256:	B287B1B41E7E4588D696CB799E119724CAB1F12C12BD4443BB42307F31614420
SHA-512:	953573EA153D8E2B48926C898FABA5E234E6CDA10F4C14697D8775A63D6A1ADE117B180C39D19A48078137940CFA97C5A308860469E83269ADB8E4693EF73029
Malicious:	false
Preview:	......M.eFy...z..#...A.{..!.Z.S,...X.F...Fa.q.............................U..@..B.c..j...........c.....dE.z.t........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~$4.466364_2401 PACKING LIST.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\AWB-M09CT560.docx.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Wed Oct 30 05:22:00 2024, length=35788, window=hide
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.512935111370214
Encrypted:	false
SSDEEP:	24:8pidk/XTECKbknq7JWreguuu7JeDv3q557u:8V/XTERbT7JoDQ7JV59u
MD5:	CAD394878DD30B0F537458FD0816EBE1
SHA1:	7D655F1C2652D3486AC9324562309393DB8B18C8
SHA-256:	7714246FEF9A61C3057E450AE4AB7ED29043A897E504D8F5BAF167C45104EFB0
SHA-512:	3F1597B50B035C474679A9CB7077834ACC608A5AD9BE2452C16BD81CD29127413144A99D6FB200C8AF63B1E2EA674875AE18EE9E702E562C2ABD77BD3E4CA6ED
Malicious:	false
Preview:	L..................F.... ....e..r....e..r...LPX................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....^Y.2..user.8......QK.X^Y.2...&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....t.2....^Y.2 .AWB-M0~1.DOC..X.......WD..WD.*.........................A.W.B.-.M.0.9.C.T.5.6.0...d.o.c.x...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\921702\Users.user\Desktop\AWB-M09CT560.docx.doc.,.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A.W.B.-.M.0.9.C.T.5.6.0...d.o.c.x...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......921702..........D_....3N...W...9..W

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.701217804390187
Encrypted:	false
SSDEEP:	3:M17IoVhIZFSm4jnIoVhIZFSv:MyoUF5oUFc
MD5:	C7EC9AF61B0AF2C0A739931ECA1185C9
SHA1:	C9FD413C3228836C50BC6A0298F015BF900EBC68
SHA-256:	736206AB70C0A9ABF1ED323229F603B0AC06FF75B82F56C1D5EB01C84FDF9E68
SHA-512:	F10728E02EFF356C94313B5C810A40CCBC5DEA0392F9CBA9A6609FC874CAE334176006784909C95890CDD99C5E8698736BD323123846B0CEF8C893A196C26B61
Malicious:	false
Preview:	[doc]..AWB-M09CT560.docx.LNK=0..[folders]..AWB-M09CT560.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\~$B-M09CT560.docx.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.973254144292467
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	AWB-M09CT560.docx.doc
File size:	35'788 bytes
MD5:	f7c1cf4cd91138f1c612b34717f6a3d4
SHA1:	fb22da61844c7ee52b306675a5315db6d9f76f37
SHA256:	9c7fcd1b7917d8a13309d4cc1bd0eee6959fb8ed06ed358326a6f828697e4fd6
SHA512:	a39d518f1d985113d89ffa6a433aff2a7eb1b83c9d7d0bf2c5e86fdd13313f4277018cd16726e3b7d04344895699ce130727aa95066d12e7c49ac4478a736791
SSDEEP:	768:vWCQYFaatj9gLjkB85vsgRxyZIwL4q+txAwuiiqbXyPI:dQtAj9gcB8SgD/wLotGrPI
TLSH:	FFF2E0B1FB4E593BF56AC17165003D54C329B001C90D9753BAF09CCCAC7FA9A0949F42
File Content Preview:	PK..........]Y.4..m...........[Content_Types].xmlUT.....!g..!g..!g.T.n.0..W.?D....CUU..]......{.n..6..wL(.* m.K...[f<q...[..........p+....m....,Df.S.@I...pp}.......&.d....4..h.... R[.Y.W?....6.z...RnM....4....5...=..s....d.M]..sNI.".ta....... ,.k..V..z.

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "AWB-M09CT560.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	2
Total Edit Time:	1
Create Time:	2024-10-29T11:50:00Z
Last Saved Time:	2024-10-29T11:51:00Z
Number of Pages:	1
Number of Words:	3
Number of Characters:	18
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 26683

General
Stream Path:	\x1Ole10Native
CLSID:
File Type:	data
Stream Size:	26683
Entropy:	7.593676128863785
Base64 Encoded:	True
Data ASCII:	7 h . . . . 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . C : \\ U s e r s \\ 9 1 9 7 4 \\ O n e D r i v e \\ D e s k t o p \\ W o r d F i l e \\ N E W F I L E S \\ 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . . . . . C . . . C : \\ U s e r s \\ 9 1 9 7 4 \\ A p p D a t a \\ L o c a l \\ T e m p \\ 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . e . . P K . . . . . . . . . . ! . . . . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . .
Data Raw:	37 68 00 00 02 00 34 2e 34 36 36 33 36 34 5f 32 34 30 31 20 20 50 41 43 4b 49 4e 47 20 4c 49 53 54 2e 78 6c 73 78 00 43 3a 5c 55 73 65 72 73 5c 39 31 39 37 34 5c 4f 6e 65 44 72 69 76 65 5c 44 65 73 6b 74 6f 70 5c 57 6f 72 64 46 69 6c 65 5c 4e 45 57 46 49 4c 45 53 5c 34 2e 34 36 36 33 36 34 5f 32 34 30 31 20 20 50 41 43 4b 49 4e 47 20 4c 49 53 54 2e 78 6c 73 78 00 00 00 03 00 43 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 0d 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:22:03.496176958 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:03.496294975 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:03.496505976 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:03.501538992 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:03.501576900 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.123613119 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.123692989 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.130059004 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.130068064 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.130408049 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.130479097 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.210692883 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.251360893 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502291918 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502367020 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.502386093 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502439022 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.502470016 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502513885 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.502521038 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502568960 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.502605915 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.502664089 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.508402109 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:04.508423090 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:04.871129990 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:04.871156931 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:04.871247053 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:04.871707916 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:04.871717930 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.488312006 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.488408089 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.491873026 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.491887093 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.492176056 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.496949911 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.539336920 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.749231100 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.749377012 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.749435902 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.750006914 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.750027895 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.750044107 CET	49162	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.750051022 CET	443	49162	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.751744032 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.751837969 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:05.751912117 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.752149105 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:05.752182961 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.375358105 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.392482996 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.392508030 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.410548925 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.410562038 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.659725904 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.659872055 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.659955025 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.660140038 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.660140038 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.660140038 CET	49163	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:06.660188913 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.660213947 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:06.660232067 CET	443	49163	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:10.044578075 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.044610977 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.044678926 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.045335054 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.045347929 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.654107094 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.654251099 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.659452915 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.659476995 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.659727097 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.678832054 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.723326921 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.915926933 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.916003942 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:10.916060925 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.939610004 CET	49164	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:10.939634085 CET	443	49164	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:11.108227968 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.108270884 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.108349085 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.108572960 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.108588934 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.728209019 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.728291988 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.734261990 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.734277010 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.734553099 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.735702991 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.779365063 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.965557098 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.965656996 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.965985060 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.969662905 CET	49165	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.969703913 CET	443	49165	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.991005898 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.991111994 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:11.991189957 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.991369009 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:11.991399050 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.613192081 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.613764048 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:12.613833904 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.614682913 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:12.614700079 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.895833015 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.895946026 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:12.896065950 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:12.896260977 CET	49166	443	192.168.2.22	172.67.162.95
Oct 30, 2024 07:22:12.896323919 CET	443	49166	172.67.162.95	192.168.2.22
Oct 30, 2024 07:22:13.129901886 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.129944086 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:13.130027056 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.130362988 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.130377054 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:13.750876904 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:13.750960112 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.797941923 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.797957897 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:13.858407974 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:13.858427048 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.110277891 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.110351086 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.110361099 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.110409975 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.110481977 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.110498905 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.115343094 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.115427017 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.115525007 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.115901947 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.115942001 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.724143028 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.724298000 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.726394892 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.726421118 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.728286982 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.728302956 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972060919 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972148895 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972274065 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972301006 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972323895 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972357988 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972390890 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972390890 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972418070 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972429991 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972485065 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972496033 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972515106 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.972552061 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.972575903 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.973069906 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.973107100 CET	443	49168	104.21.74.191	192.168.2.22
Oct 30, 2024 07:22:14.973133087 CET	49168	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:22:14.973172903 CET	49168	443	192.168.2.22	104.21.74.191

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:22:03.482023001 CET	54562	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:03.493310928 CET	53	54562	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:04.845164061 CET	52917	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:04.856899977 CET	53	52917	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:04.858767986 CET	62751	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:04.870754957 CET	53	62751	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:10.019201040 CET	57893	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:10.027112007 CET	53	57893	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:10.028466940 CET	54821	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:10.044200897 CET	53	54821	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:11.085709095 CET	54719	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:11.095338106 CET	53	54719	8.8.8.8	192.168.2.22
Oct 30, 2024 07:22:11.096894979 CET	49881	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:22:11.107939005 CET	53	49881	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 07:22:03.482023001 CET	192.168.2.22	8.8.8.8	0xf52	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.845164061 CET	192.168.2.22	8.8.8.8	0x8127	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.858767986 CET	192.168.2.22	8.8.8.8	0xc0a7	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.019201040 CET	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.028466940 CET	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.085709095 CET	192.168.2.22	8.8.8.8	0xb6ec	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.096894979 CET	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 07:22:03.493310928 CET	8.8.8.8	192.168.2.22	0xf52	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:03.493310928 CET	8.8.8.8	192.168.2.22	0xf52	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.856899977 CET	8.8.8.8	192.168.2.22	0x8127	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.856899977 CET	8.8.8.8	192.168.2.22	0x8127	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.870754957 CET	8.8.8.8	192.168.2.22	0xc0a7	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:04.870754957 CET	8.8.8.8	192.168.2.22	0xc0a7	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.027112007 CET	8.8.8.8	192.168.2.22	0x1100	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.027112007 CET	8.8.8.8	192.168.2.22	0x1100	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.044200897 CET	8.8.8.8	192.168.2.22	0x2664	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:10.044200897 CET	8.8.8.8	192.168.2.22	0x2664	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.095338106 CET	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.095338106 CET	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.107939005 CET	8.8.8.8	192.168.2.22	0xd97e	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:22:11.107939005 CET	8.8.8.8	192.168.2.22	0xd97e	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

acesso.run

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	104.21.74.191	443	3240	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:04 UTC	132	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: acesso.run Content-Length: 0 Connection: Keep-Alive
2024-10-30 06:22:04 UTC	987	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:22:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GZ9cMSjpF8R%2FmUNk8zgIi47qmfR%2BwGMpgz7lRK3fsHgNjZVcg%2FbWgtkaGm6tksLJAE816AnY8IDIURWzRGkOgCjD2dk%2B47Zy3zu2VqZ1iyFADzh8Vxtz3hpPywi1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f0cb9ace7cf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=746&delivery_rate=1771253&cwnd=251&unsent_bytes=0&cid=9c8a19ad80743433&ts=403&x=0"
2024-10-30 06:22:04 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-10-30 06:22:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	172.67.162.95	443	3240	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:05 UTC	179	OUT	HEAD /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: acesso.run
2024-10-30 06:22:05 UTC	1008	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 30 Oct 2024 06:22:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AkrvpPSL2GznP6SYzf35y0u9UfbmtS3vjnv1p7lmy7cBA2dUhHAKYLlQUea%2B680DFdR6gC%2Fr5olfXt6SjevoW5s6QxVHonVN0G73reRYTWoQgLxpowDx%2F0KYx6%2BF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f14cd234690-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1049&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=793&delivery_rate=2726930&cwnd=239&unsent_bytes=0&cid=7789dfa0fbaa5a82&ts=275&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49163	172.67.162.95	443	3240	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:06 UTC	114	OUT	HEAD /404 HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: acesso.run
2024-10-30 06:22:06 UTC	993	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:22:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GO%2B9885lC2Z27uSni9jmOIhI4dLL90bZmjHdVFwUnxlJsp3YNPJd6LAePxU4Vs7cgOhuldCVPKC8Ip%2FUvTuxySxs0CcINLdZz5RwQlnJ0%2FQmsdtBSa7hN7176CDJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f1a78f48784-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1456&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=728&delivery_rate=2244961&cwnd=247&unsent_bytes=0&cid=69765e49a4479b12&ts=295&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49164	104.21.74.191	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:10 UTC	127	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: acesso.run
2024-10-30 06:22:10 UTC	979	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:22:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQuvjxmW11qeI3wYRkaXe4u8Tea5KVbA7hovWAH7zkJgfqcu2VCzB1Yf3Iyn7zEuVNxHxL7hleKP6lIar3pX7m5i132dq5IB0aNuRTWn0XSn0ba5wo1Q8Yv5a0Go"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f352f39e813-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2227&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=741&delivery_rate=1289403&cwnd=251&unsent_bytes=0&cid=2809139388c44a16&ts=267&x=0"
2024-10-30 06:22:10 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-10-30 06:22:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49165	172.67.162.95	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:11 UTC	157	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 61 63 65 73 73 6f 2e 72 75 6e 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: acesso.run
2024-10-30 06:22:11 UTC	1024	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:22:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=euVxp%2Fxp9DKS%2B8DctqGQqyEAazHv8JgqNP3gtVsucfo%2BYjfcr2HFcOYj7GUT%2FayEgg6bXjsGUbKewhzqtyXb7FRnfdeWFdZkvDqEINeBLGBnJgYVPvta%2F9ORqcUm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f3bcd8ba927-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=771&delivery_rate=2513888&cwnd=168&unsent_bytes=0&cid=a60882f580010c63&ts=242&x=0"
2024-10-30 06:22:11 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>
2024-10-30 06:22:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.22	49166	172.67.162.95	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:12 UTC	157	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 61 63 65 73 73 6f 2e 72 75 6e 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: acesso.run
2024-10-30 06:22:12 UTC	1022	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:22:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OmkIr4mijRseEgH%2BJMyCBiBE%2F1hWzsNkar8tmhq3ZgoEHxpj%2Bb2Ah83ByUJxaET2Rui8M9W4qTaAB8GmUB83Y6lsXpIGeknD%2BT92kRRZcxh0sfoiyOMoaIhRVhMy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f414cd3477a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=771&delivery_rate=1676896&cwnd=226&unsent_bytes=0&cid=26c2750aa581e334&ts=289&x=0"
2024-10-30 06:22:12 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>
2024-10-30 06:22:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	104.21.74.191	443	3240	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:13 UTC	409	OUT	GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2024-10-30 06:22:14 UTC	998	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 30 Oct 2024 06:22:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kEdsnlF5Ke9WpbSpjefp9%2FqfehxBxQ0xWYex5zFGT%2FMW83BwpxhnyMdqmFCuoie4WMlkpcw1GRvy%2BSzk1sqUXexRfml%2FxU7NvvKubahDt5cK%2BdpIrWIyY2v4oBRa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f490ea6e530-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1116&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=991&delivery_rate=2544815&cwnd=235&unsent_bytes=0&cid=c32871b6f150c28c&ts=365&x=0"
2024-10-30 06:22:14 UTC	38	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 34 30 34 Data Ascii: Moved Permanently. Redirecting to /404

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	104.21.74.191	443	3240	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:22:14 UTC	344	OUT	GET /404 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2024-10-30 06:22:14 UTC	1009	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:22:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vsximHz4s55g7UN0XfXfoqZJ4gtNioUcsiJkL7f924jHe3ukAjIHhElQHXgYtuETZ%2FdRIuRHRZZblsu1NwMv%2BWdG%2BI2xu6suSU1q5VNE20JfmA1TpSbE0yZqTekQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da94f4e7c51315a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1385&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=926&delivery_rate=2118507&cwnd=242&unsent_bytes=0&cid=e425e604b01cd1f0&ts=253&x=0"
2024-10-30 06:22:14 UTC	360	IN	Data Raw: 31 32 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 75 6e 64 65 66 69 6e 65 64 20 69 73 20 61 20 66 72 65 65 20 61 6e 64 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 55 52 4c 20 73 68 6f 72 74 65 6e 65 72 20 77 69 74 68 20 63 75 73 74 6f 6d 20 64 6f 6d 61 Data Ascii: 1225<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/><meta name="description" content="undefined is a free and open source URL shortener with custom doma
2024-10-30 06:22:14 UTC	1369	IN	Data Raw: 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 36 78 31 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 39 36 78 31 39 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 39 36 Data Ascii: /><link rel="icon" sizes="196x196" href="/images/favicon-196x196.png"/><link rel="icon" sizes="32x32" href="/images/favicon-32x32.png"/><link rel="icon" sizes="16x16" href="/images/favicon-16x16.png"/><link rel="apple-touch-icon" href="/images/favicon-196
2024-10-30 06:22:14 UTC	1369	IN	Data Raw: 22 6e 65 78 74 2d 68 65 61 64 2d 63 6f 75 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 33 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 70 61 67 65 73 2f 5f 61 70 70 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 72 75 6e 74 69 6d 65 2f 77 65 62 70 61 63 6b 2d 31 63 35 31 39 39 66 66 36 36 35 35 30 64 32 36 65 34 39 39 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f Data Ascii: "next-head-count" content="3"/><link rel="preload" href="/_next/static/um22g2LP8Ko0jk1vHrPCc/pages/_app.js" as="script"/><link rel="preload" href="/_next/static/runtime/webpack-1c5199ff66550d26e499.js" as="script"/><link rel="preload" href="/_next/static/
2024-10-30 06:22:14 UTC	1369	IN	Data Raw: 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 39 70 78 3b 68 65 69 67 68 74 3a 34 39 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 22 3e 3c 68 32 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 22 3e 54 68 69 73 20 70 61 67 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 21 2d 2d 20 2d 2d 3e 2e 3c 2f 68 32 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 69 64 3d 22 5f 5f 4e 45 58 54 5f 44 41 54 41 5f 5f 22 20 74 79 70 65 3d 22 61 70 70 6c Data Ascii: ext-align:left;line-height:49px;height:49px;vertical-align:middle"><h2 style="font-size:14px;font-weight:normal;line-height:inherit;margin:0;padding:0">This page could not be found... -->.</h2></div></div></div></div><script id="__NEXT_DATA__" type="appl
2024-10-30 06:22:14 UTC	186	IN	Data Raw: 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 62 75 69 6c 64 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 73 73 67 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_buildManifest.js" async=""></script><script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_ssgManifest.js" async=""></script></body></html>
2024-10-30 06:22:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:22:00
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f230000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:22:37
Start date:	30/10/2024
Path:	C:\Windows\System32\verclsid.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\verclsid.exe" /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Imagebase:	0xff700000
File size:	11'776 bytes
MD5 hash:	3796AE13F680D9239210513EDA590E86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:22:37
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
Imagebase:	0x13f9a0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:22:38
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding
Imagebase:	0x13f9a0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AWB-M09CT560.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1FC6CE80.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5BF1D71A.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8864853.png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{7FD5699E-2534-46B6-8F2E-C2FEB11F873A}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7B3BFE15-CA86-4957-A0E6-3A277A67AA66}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A26CAB80-A8B4-4BB0-A913-49E7089833DE}.tmp

C:\Users\user\AppData\Local\Temp\4.466364_2401 PACKING LIST.xlsx

C:\Users\user\AppData\Local\Temp\4.466364_2401 PACKING LIST.xlsx:Zone.Identifier

C:\Users\user\AppData\Local\Temp\{DDCF9BC7-CD01-42DF-8C28-24E11853346A}

C:\Users\user\AppData\Local\Temp\{F53D3696-CAC8-4040-B1A1-DD4531201B31}

C:\Users\user\AppData\Local\Temp\~$4.466364_2401 PACKING LIST.xlsx

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\AWB-M09CT560.docx.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\Desktop\~$B-M09CT560.docx.doc

Static File Info

General

File Icon

Static OLE Info

General

OLE File "AWB-M09CT560.docx.doc"

Indicators

Summary

Document Summary

Windows Analysis Report
AWB-M09CT560.docx.doc