Edit tour

Windows Analysis Report
Fw Action required Review access by 14 November 2024.msg

Overview

General Information

Sample name:	Fw Action required Review access by 14 November 2024.msg
Analysis ID:	1545411
MD5:	62ddfe63b8e602f3629f328e9b2e4384
SHA1:	af90e7a027d9fb05b1012bce1870e250ba984d8c
SHA256:	2d7f85fdfa959fbc998c036f6657f620f479bfcfe74cd40519fe6af53f78e660
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 3572 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Fw Action required Review access by 14 November 2024.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5820 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADD518D9-7263-4581-8767-23EB781B974A" "69E90EEC-75BF-458D-AD8A-CE450AD4D87C" "3572" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3572, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: classification engine

Classification label: sus21.winMSG@3/18@0/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0929100053-3572.etl

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Fw Action required Review access by 14 November 2024.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADD518D9-7263-4581-8767-23EB781B974A" "69E90EEC-75BF-458D-AD8A-CE450AD4D87C" "3572" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADD518D9-7263-4581-8767-23EB781B974A" "69E90EEC-75BF-458D-AD8A-CE450AD4D87C" "3572" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Persistence and Installation Behavior

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to be from Microsoft Security but uses urgency and pressure tactics with a deadline to review access

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.109.32.97	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545411
Start date and time:	2024-10-30 14:27:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Fw Action required Review access by 14 November 2024.msg
Detection:	SUS
Classification:	sus21.winMSG@3/18@0/4
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97
Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Fw Action required Review access by 14 November 2024.msg

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "explanation": [ "The email claims to be from Microsoft Security but uses urgency and pressure tactics with a deadline to review access", "The links in the email are redirected through Sophos protection, which is unusual for legitimate Microsoft communications", "The email contains inconsistencies in branding, mixing Azure AD and Microsoft Entra ID terminology in a suspicious way" ], "phishing": true, "confidence": 8 }
{ "date": "Wed, 30 Oct 2024 14:16:12 +0100", "subject": "Fw: Action required: Review access by 14 November 2024", "communications": [ "looks phishy\n\n\nAnees Modan\n\n \n\nHead of Core Business Systems\n\n \n\nW: cardfactory.co.uk\n\n \n\n\n\n \n\nThis email is for the intended recipient only and is confidential. If this email has been misdirected, please let the sender know and delete it. Any disclosure, copying, distribution or other use is prohibited. Although we take great care to protect our network from computer viruses, we accept no responsibility for mail-borne viruses and recommend that you scan the email and its attachments. If you do find any virus please let us know so that we may take appropriate action. For the legal protection of our business any email sent or received by us may be monitored or intercepted. Sportswift Limited trading as cardfactory company number 03493972, registered in England and Wales and whose registered office is Century House, Brunel Road, Wakefield 41 Industrial Estate, Wakefield, West Yorkshire, WF2 0XG.\n\n \n\n________________________________\n\n", "From: Microsoft Security <MSSecurity-noreply@microsoft.com>\nSent: Thursday, October 17, 2024 11:29 AM\nTo: Anees Modan <Anees.Modan@cardfactory.co.uk>\nSubject: Action required: Review access by 14 November 2024 \n \nReminder: Confirm your need for access. Azure Active Directory is now Microsoft Entra ID. Learn More. Please review Your Microsoft 365 Guest Account in SAP SE: Please review by 14 November 2024 to con \nCAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security.\t \nsophospsmartbannerend \nReminder: Confirm your need for access. \n <https://aadcdn.msftauthimages.net/c1c6b6c8-6apefqgxjmqyqv1py-27zisoqhbqzg27hafx-dvsstu/logintenantbranding/0/bannerlogo?ts=636701132408700000> \t\t\n <https://images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/images/icons/status-info-gray.png> \tAzure Active Directory is now Microsoft Entra ID. Learn More. <https://eu-west-1.protection.sophos.com?d=aka.ms&u=aHR0cHM6Ly9ha2EubXMvRW50cmFJRA==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=bHBZTzdvSi9kM0NUcEhCYTQ3d0Nwb0daT1hjRTUrSksva2dtbTBWK2FUUT0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> \t \n\t\n\nPlease review Your Microsoft 365 Guest Account in SAP SE:\n\n\t\nPlease review by 14 November 2024 to confirm your continued need for access.\n\nTo continue having access to your Microsoft 365 Guest Account at SAP SE, please click the Review access button below and follow the steps to confirm your account (MFA required). If you deny or dont respond in time your Guest account will be deactivated.\n\nLearn more about reviewing your access. <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9kb2NzLm1pY3Jvc29mdC5jb20vZW4tZ2IvYXp1cmUvYWN0aXZlLWRpcmVjdG9yeS9hY3RpdmUtZGlyZWN0b3J5LWF6dXJlLWFkLWNvbnRyb2xzLWhvdy10by1yZXZpZXcteW91ci1hY2Nlc3M=&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=a3Z1ZmkrZjRlaUNVWmlkV05iWTh2R1BJQndkMHcwWk1QVXZ2MHpmeFhybz0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> \n\n\t\nReview access > <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9teWFjY2Vzcy5taWNyb3NvZnQuY29tL3NhcC5vbm1pY3Jvc29mdC5jb20jL2FjY2Vzcy1yZXZpZXdzL2EyYTRmYjJjLThjMDgtNGJkMy1iNDdkLWZkMjhmMmFkYTU3OQ==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=dHRBVGRvZ0RoeTYvbE9OWS92YXYxaHBCQ2J1cFNZQUpoUlZrdTJKRWpjUT0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> \t \n\t\nWant to try our new experience (preview)? Click Here\n\n\t\nPrivacy Statement <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8_TGlua0lkPTUyMTgzOQ==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=aFUvcHJmZEw2VU1HQkxvOGZNY1ByWEsxTzNCT0gvcWZjdTJjbFM4NGtyND0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> \n\nMicrosoft Corporation, One Microsoft Way, Redmond, WA 98052\n\nFacilitated by\n\n <https://images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/images/logos/microsoft-logo-2x.png> \t\n" ], "from": "Anees Modan <Anees.Modan@cardfactory.co.uk>", "to": "Security <Security@cardfactory.co.uk>", "attachements": [ "Outlook-sfo2h2la.png" ] }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Action required: Review access by 14 November 2024", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [ "cardfactory", "cardfactory.co.uk" ] }

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	231348
Entropy (8bit):	4.393936112590898
Encrypted:	false
SSDEEP:
MD5:	052B76C3AFEACC5BF2BB343A79B5B902
SHA1:	C55EDD35A8769E245EFACF1379C39B89C20AA6AB
SHA-256:	DAB1CE8AE71AB7D0ECD2F7EF2615FB0FBCADB945B75E343EBA4EC315659B1D6D
SHA-512:	E5F962F81E1D1518DEEA250409B6CEF88F5C0FB88985E4C7B90FC96A356250C0CB19BF1F246F299E914D8768C9E62C42298D248E438A3873E6C289292B224472
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..~.........SM01X...,.................IPM.Activity...........h...............h............H..h........\|?V....h...........H..h\tor ...AppD...h....0..........h.;.............h........_`.k...h0=..@...I.+w...h....H...8..k...0....T...............d.........2h...............k4.0.....;.1...!h.............. h`..[..........#h....8.........$h.......8....."hP.............'h..............1h.;..<.........0h....4.....k../h....h......kH..h....p.........-h .......D.....+ht;.......................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13700485453793962
Encrypted:	false
SSDEEP:
MD5:	5F347590971DFF6D2DDBFAF2E9A05E3D
SHA1:	B699F0465EDC3AB3D0F0A50A5999A011C80BF2C1
SHA-256:	655EEF557A17AC5A38B06823446C653177FB484883BA34D056A4C3176748003E
SHA-512:	023EF65A1E4C2D97632BC8AC3CF3DA90196EC935A85BFDABB3943367BBF494907D6A819BBC5CE1927FFAF6C5CDC52C3C129C405B679E61A964DB174C8EAF661D
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....KZVS....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04449162272699445
Encrypted:	false
SSDEEP:
MD5:	43A7DD1D79D315F469525CE9CC45580B
SHA1:	9AB9B5DE18EC10747CDFF159F19C80FFD1BF6949
SHA-256:	C542FFC7CEE059137CCD758A8B5DA66639F72E9B696571F3BFA4D1B316DB589C
SHA-512:	C3FB831B31C163DB783A950470A5ECA8D182F652730DDD8CE7A21D162E10DA3DEF079EFCFC1D7DC879879C4F880736FE5F6A212C87AED0B537BB78E60E563C6F
Malicious:	false
Reputation:	unknown
Preview:	..-........................8f.......\|.ns.s......-........................8f.......\|.ns.s............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.39469989381931403
Encrypted:	false
SSDEEP:
MD5:	EA29B7722B3DC7750E173719316D0D10
SHA1:	A45561DFF410D640658B451CFE3EE0F42E4E7D6E
SHA-256:	66BF7487D324C05F8C2EDAFF926713E575582C56A8EE962AD7A512D68DB25A90
SHA-512:	832277A30B6A7D8719C825305B51DB2C1C87D88DF372DAB8F47EBFCECA42CE603306A9BB9A8F45A2504BA18AB198B93B29BE2E39FC1FC2268C8D3853BD17C8AB
Malicious:	false
Reputation:	unknown
Preview:	7....-..............\|.n.....KV.............\|.n.....m..SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.82424816474132
Encrypted:	false
SSDEEP:
MD5:	B1ECC5EB003028492950E5D5700855F0
SHA1:	766BB1240867A19A2D6B05F1083B9BD87D19B73E
SHA-256:	DDBC09973D2F4739CE9EBE754849EDC01113F40CFCE0129DA7EFE63FA54A29D6
SHA-512:	B60A2B084C0EBFA31FF735B24CD1776EA0A24369FA19CBDE813CC5774DFF85FD543A2C5E5059CE5A7BA4EA22BF3C6C6EFDDF4EBECB16D4149B173C124D03CDAE
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.O.U.x.K.d.g.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.R.h.a.i.7.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	2684
Entropy (8bit):	3.9090179266946787
Encrypted:	false
SSDEEP:
MD5:	A3BC2A5B3BB69D28752CF3732F7DC41B
SHA1:	79E020110B259F2CCE25AD3823CABCEE9879D6BD
SHA-256:	793FEA2CFCFD7E1147D78AE6F082C315CD933901E2AC766E935D95F1A3539005
SHA-512:	CF24BADB8C75FF71EA82BC9442693E1F528A07079D149E52CC56D1D93419E9A1AFCAA76D2C3CCEAC486A95A11F1329DF6991E5BF5F2C005350A9D3C27438F22B
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.N.h.U.Q.K.F.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.R.h.a.i.7.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.998452408522678
Encrypted:	false
SSDEEP:
MD5:	9CF7106EB579F871BF1E201C8D2DB51C
SHA1:	C71D80DA0E3905B0BC80ECC4563898E5F162444D
SHA-256:	AD6967FFBC55C8E8A1ABCE0E8CA6D838F8FE8DBDA0AFC73DE8E66BD41044413A
SHA-512:	84911420B3489D294B178318A09C03EDA49E928A5AAA2987EC8B81CBCD869AB31A3C76DBD898636D37B3A084C0124FCB200145F035B8161F0160F9F9A68D852E
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.n.L.X.D.t.A.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.R.h.a.i.7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCE190B4.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	PNG image data, 935 x 147, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	54160
Entropy (8bit):	7.975948030471787
Encrypted:	false
SSDEEP:
MD5:	ECE52028ECCB17CF1E8C814B673D0706
SHA1:	F6FDE7FDF7C3CA5D2723B6579CDC3F3789B54EA4
SHA-256:	ABF562D0630C2201B361A7678A746DABF6D354E16E2C8FA13FB78D2E5E62D0E6
SHA-512:	EDAE745A5464084BAAC45A13D89C33F4CAC3616D3117E1610A003CCF139C20E65805F0ED8BDAC17744899A0937A0FCE979AE0EEAFC78BE798A904C36976B3114
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r.oV....sRGB.........pHYs...%...%.IR$.....tEXtSoftware.Microsoft Office..5q....IDATx^........[..Kww#!...v........N..DE..%....Yj....~...Y.{.Ct.w.s.w.g..v./..G.#....x.<.....G.#....x.....E...../......x.<.....G.#....x.<...H.<9...#....x.<.....G.#....x..9.....!....x.<.....G.#....x.<...ON....x.<.....G.#....x.<...}..'..\|.\|.<.....G.#....x.<.....G..S?.<.....G.#....x.<.....G`.#...>......G.#....x.<.....G.#.........G.#....x.<.....G.#.....xr...7.#....x.<.....G.#....x.<9.s.#....x.<.....G.#....x..9.....!....x.<.....G.#....x.<...ON....x.<.....G.#....x.<...}..'..\|.\|.<.....G.#....x.<.....G..S?.<.....G.#....x.<.....G`.#...>......G.#....x.<.....G.#.........G.#....x.<.....G.#.....xr...7.#....x.<.....G.#....x.<9.s.#....x.<.....G.#....x..9.....!....x.<.....G.#....x.<...ON....x.<.....G.#....x.<...}..'..\|.\|.<.....G.#....x.<.....G..S?.<.....G.#....x.<.....G`.#...>......G.#....x.<.....G.#.........G.#....x.<.....G.#.....xr...7.#....x.<.....G.#....x.<9.s.#....x.<.....G.#

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{46079FBC-051C-4FFC-A793-228B017E3151}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	19740
Entropy (8bit):	4.000948256559813
Encrypted:	false
SSDEEP:
MD5:	CC39764C217B1E6C5DB444D9D9A1EA94
SHA1:	C5697790CAB1243952EB423ACCC080668023E578
SHA-256:	025FC703AC5E1A60F39EF5A43315D78B3D46FC7B32855BC6A7398650AF7E41F1
SHA-512:	847273D125956976317EAD6D5659DAD96ED25CF11EAF6AD8CB94AF3D416A3D0C43FA84977B14FF13E2417EFBBB427B5E10CA22791EA92B0EDB0AD9DB37BE2A47
Malicious:	false
Reputation:	unknown
Preview:	....l.o.o.k.s. .p.h.i.s.h.y.......A.n.e.e.s. .M.o.d.a.n.......H.e.a.d. .o.f. .C.o.r.e. .B.u.s.i.n.e.s.s. .S.y.s.t.e.m.s.......W.:. .c.a.r.d.f.a.c.t.o.r.y...c.o...u.k.......I.N.C.L.U.D.E.P.I.C.T.U.R.E. .".c.i.d.:.f.3.3.4.5.b.2.d.-.3.3.4.a.-.4.1.9.d.-.8.7.d.4.-.6.4.7.c.e.f.1.a.1.7.5.b.". .\.. .M.E.R.G.E.F.O.R.M.A.T.I.N.E.T... . ......................................................................................................................................................................................................."...:...>...z...~...................V...Z.......j...n........................................................................................................................................................................................................................................................................................................................................d.........d,......$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.....

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730294950248425200_923433E2-1A96-4CBB-98E8-E3D44AF31730.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.007816251409584547
Encrypted:	false
SSDEEP:
MD5:	825DD5E3BEC3E9A28D8CC984530490AD
SHA1:	22E9E92A0E019CACD017F6576398C68471823666
SHA-256:	E3FEDB5782C78B1599C52ABA9B0847272F8DCF9CB87E551B10E73A47E88E0F11
SHA-512:	FE5BE87EB71DDD7B110F45DE9DD6BE6F55B303C8C59C317A83467637CCB318D9C8C226B3BE111A32C863D69C075017B0D8C4437C5E57836EF6DF23824BCC7848
Malicious:	false
Reputation:	unknown
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/30/2024 13:29:10.277.OUTLOOK (0xDF4).0x918.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-10-30T13:29:10.277Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"8EE30BAD-D758-422F-A6CE-AE0579CBC582","Data.PreviousSessionInitTime":"2024-10-30T13:27:43.365Z","Data.PreviousSessionUninitTime":"2024-10-30T13:27:46.459Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/30/2024 13:29:10.325.OUTLOOK (0xDF4).0xC04.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Ti

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730294950249367300_923433E2-1A96-4CBB-98E8-E3D44AF31730.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0929100053-3572.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	4.895851523455868
Encrypted:	false
SSDEEP:
MD5:	3C9705BC497690501229E03D09868C86
SHA1:	E04B6A3480E06BD08C2E74705812185925AE1FEA
SHA-256:	84AA131DEA0C28D704B1E9CA1EA177C246D567B632360D1832FAB5BAAEE00290
SHA-512:	AFF0FD8A483D421938BF2BC62627B7C53F8FE32A9B389CC8B446177DCA7CB129ED22612204A5EA176923A1B69C10403972C1C832DEE5448539CBD4EDF76F860B
Malicious:	false
Reputation:	unknown
Preview:	............................................................................b............G....................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................(..Y...........G............v.2._.O.U.T.L.O.O.K.:.d.f.4.:.9.c.c.c.c.2.0.9.a.f.4.3.4.0.1.0.a.e.4.0.f.9.2.2.b.e.7.2.e.6.a.6...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.0.T.0.9.2.9.1.0.0.0.5.3.-.3.5.7.2...e.t.l.............P.P.............*..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE97ADC3EFFD4F42C.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.43792674726580205
Encrypted:	false
SSDEEP:
MD5:	89BA0EC4B2297C4A8A1985F487AAD003
SHA1:	984F8E806EDB64E68193CEB1EBE0FBBDAB1F00C5
SHA-256:	0EEC4E9DA1C74048176E96376D65F443D0DF8ED82A5CEDB906B2A17F37A150BB
SHA-512:	0ACDAB3521D73794F552BC9022EC3096E2086E6E9CB796495FC773AC774783618138D48B174D2E6A7E09FD0C1AAD16A19CACF1FCDF8519D8FFF911AF47732605
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.172253928364927
Encrypted:	false
SSDEEP:
MD5:	58E809C159794B07BFD8E37D51426985
SHA1:	47542CABB2F3E5E478B435278FE7D871E8221742
SHA-256:	6B74DBB9CAB0711F074E6887B223837E09DFFC06F2F8E680073E10DE09B6D150
SHA-512:	4683CE7E0E8B49F48B10E508214F71FFA2A68679EFE1EB3038FCDFE66327BB03202712F288213D6ADF1FFF31E16DAC9114A25F0A9DFD7D3630D2C1224E5BDA8B
Malicious:	false
Reputation:	unknown
Preview:	.....*........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6697109878412593
Encrypted:	false
SSDEEP:
MD5:	E015197B91A1BE4785C783468152933A
SHA1:	BD3F3EE201F658319A1E0C1AD22135D8CCB07663
SHA-256:	1C2C97474D4117FD1EEBC440E6830802AE631B9865DF87DF9E9DF5FEC7AC81E6
SHA-512:	886CCA112B7CDCFBE56A2A16211B42BC913E53EA4AB53CA9DACFE985A98C6AC18A775AA92C96A76708433E07C3F44E0260525BEEB4A47D2D225C1557A36FF438
Malicious:	true
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	0.8086823843236353
Encrypted:	false
SSDEEP:
MD5:	6DDF92526CB089F90631EE4D7E62F995
SHA1:	4A63F609F4664A1699D99EEE66F3110A56F51CAA
SHA-256:	DCA746896B3F7742F8F2C77442DB05C00838F7D259EC0CDF94BF8DF6CC4E85B5
SHA-512:	A55EEF124AB1782E5489DE515AF88832E34E8396121CE28B7CB8AA4251304A0F12D039CDCF31F29E8DCA1D8835B0C0D41C340A0DBDB496C3192FCD55A15FF0A4
Malicious:	true
Reputation:	unknown
Preview:	!BDN..M.SM......\...$...........a.......H................@...........@...@...................................@...........................................................................$.......D.......x..............U..............._........n..........................................................................................................................................................................................................................................................................................+..qMQ......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.04689905693146468
Encrypted:	false
SSDEEP:
MD5:	644D95E48A26E93D0D35D8D083D91C3E
SHA1:	734C8C3B2F5DFB43D328D57577C643C45025459D
SHA-256:	EE5C86F3C6D92914B2830F713A0B40C439404E5927B2D608FA653725A7250089
SHA-512:	C9DDF4B2AD998CA1B5CB6CCC021013DC1D648537311D0FD918310A373171D8F06E491405E324EE24D142A94DDA0F5C6D7362A5F5CE18AA6EECD9FF72C2B294AB
Malicious:	true
Reputation:	unknown
Preview:	....0..........................D............#......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................zV..D......w..0..........................B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	6.109118817405549
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	Fw Action required Review access by 14 November 2024.msg
File size:	157'696 bytes
MD5:	62ddfe63b8e602f3629f328e9b2e4384
SHA1:	af90e7a027d9fb05b1012bce1870e250ba984d8c
SHA256:	2d7f85fdfa959fbc998c036f6657f620f479bfcfe74cd40519fe6af53f78e660
SHA512:	86f022fb529c098e6e63dd56f487fc17057ff1bdd79e1bdc1f4304741b0688b80c342600dbc37b88cc60912aa6f0bb833e76b23f301c1f74d192c625844abcf9
SSDEEP:	1536:LVAe8Yo6+9484KW+WiLWUaW+WprUdWKOSvLQjCEGLOHhYWyYAC+6mDeN2i:/mb4GzhUfXLQmEGq65Gm82i
TLSH:	3BF3E7103AFA4119F3769F754BE2909F8827FC92AD29969F2295330E0773950DC61B3B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Static Mail

General

Subject:	Fw: Action required: Review access by 14 November 2024
From:	Anees Modan <Anees.Modan@cardfactory.co.uk>
To:	Security <Security@cardfactory.co.uk>
Cc:
BCC:
Date:	Wed, 30 Oct 2024 14:16:12 +0100
Communications:	looks phishy Anees Modan Head of Core Business Systems W: cardfactory.co.uk This email is for the intended recipient only and is confidential. If this email has been misdirected, please let the sender know and delete it. Any disclosure, copying, distribution or other use is prohibited. Although we take great care to protect our network from computer viruses, we accept no responsibility for mail-borne viruses and recommend that you scan the email and its attachments. If you do find any virus please let us know so that we may take appropriate action. For the legal protection of our business any email sent or received by us may be monitored or intercepted. Sportswift Limited trading as cardfactory company number 03493972, registered in England and Wales and whose registered office is Century House, Brunel Road, Wakefield 41 Industrial Estate, Wakefield, West Yorkshire, WF2 0XG. ________________________________ From: Microsoft Security <MSSecurity-noreply@microsoft.com> Sent: Thursday, October 17, 2024 11:29 AM To: Anees Modan <Anees.Modan@cardfactory.co.uk> Subject: Action required: Review access by 14 November 2024 Reminder: Confirm your need for access. Azure Active Directory is now Microsoft Entra ID. Learn More. Please review Your Microsoft 365 Guest Account in SAP SE: Please review by 14 November 2024 to con CAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security. sophospsmartbannerend Reminder: Confirm your need for access. <https://aadcdn.msftauthimages.net/c1c6b6c8-6apefqgxjmqyqv1py-27zisoqhbqzg27hafx-dvsstu/logintenantbranding/0/bannerlogo?ts=636701132408700000> <https://images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/images/icons/status-info-gray.png> Azure Active Directory is now Microsoft Entra ID. Learn More. <https://eu-west-1.protection.sophos.com?d=aka.ms&u=aHR0cHM6Ly9ha2EubXMvRW50cmFJRA==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=bHBZTzdvSi9kM0NUcEhCYTQ3d0Nwb0daT1hjRTUrSksva2dtbTBWK2FUUT0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> Please review Your Microsoft 365 Guest Account in SAP SE: Please review by 14 November 2024 to confirm your continued need for access. To continue having access to your Microsoft 365 Guest Account at SAP SE, please click the Review access button below and follow the steps to confirm your account (MFA required). If you deny or dont respond in time your Guest account will be deactivated. Learn more about reviewing your access. <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9kb2NzLm1pY3Jvc29mdC5jb20vZW4tZ2IvYXp1cmUvYWN0aXZlLWRpcmVjdG9yeS9hY3RpdmUtZGlyZWN0b3J5LWF6dXJlLWFkLWNvbnRyb2xzLWhvdy10by1yZXZpZXcteW91ci1hY2Nlc3M=&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=a3Z1ZmkrZjRlaUNVWmlkV05iWTh2R1BJQndkMHcwWk1QVXZ2MHpmeFhybz0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> Review access > <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9teWFjY2Vzcy5taWNyb3NvZnQuY29tL3NhcC5vbm1pY3Jvc29mdC5jb20jL2FjY2Vzcy1yZXZpZXdzL2EyYTRmYjJjLThjMDgtNGJkMy1iNDdkLWZkMjhmMmFkYTU3OQ==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=dHRBVGRvZ0RoeTYvbE9OWS92YXYxaHBCQ2J1cFNZQUpoUlZrdTJKRWpjUT0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> Want to try our new experience (preview)? Click Here Privacy Statement <https://eu-west-1.protection.sophos.com?d=microsoft.com&u=aHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8_TGlua0lkPTUyMTgzOQ==&p=m&i=NjVjNTg4NDM3NThkMjYzMWU1N2QyOWJl&t=aFUvcHJmZEw2VU1HQkxvOGZNY1ByWEsxTzNCT0gvcWZjdTJjbFM4NGtyND0=&h=022acead68fc4a3d9ebac3211f0212e0&s=AVNPUEhUT0NFTkNSWVBUSVYgfuMvzoLjIbPfdW7whZuSxp9XaiC50iQQmyKIVGzn-qHent-BP_63qD7_3k6v2xY> Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 Facilitated by <https://images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/images/logos/microsoft-logo-2x.png>
Attachments:	Outlook-sfo2h2la.png

Headers

Key	Value
Received	from AM6PR03MB4472.eurprd03.prod.outlook.com
13	16:12 +0000
Authentication-Results	dkim=none (message not signed)
by GVXPR03MB10684.eurprd03.prod.outlook.com (2603	10a6:150:214::6) with
2024 13	16:13 +0000
([fe80	:d876:7680:b1e0:3883%4]) with mapi id 15.20.8093.014; Wed, 30 Oct 2024
Content-Type	application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding	binary
From	Anees Modan <Anees.Modan@cardfactory.co.uk>
To	Security <Security@cardfactory.co.uk>
Subject	Fw: Action required: Review access by 14 November 2024
Thread-Topic	Action required: Review access by 14 November 2024
Thread-Index	AQHbIH+AW3IGk3JXWE24R79Gmd+NxLKfWrHc
Date	Wed, 30 Oct 2024 13:16:12 +0000
Message-ID	<AM6PR03MB44726AD98A891CC1BF062049B3542@AM6PR03MB4472.eurprd03.prod.outlook.com>
References	<W5QJ4X6ODOU4.AG6WZITR6FCQ3@am4pepf00002b61>
In-Reply-To	<W5QJ4X6ODOU4.AG6WZITR6FCQ3@am4pepf00002b61>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-SCL	-1
X-MS-TNEF-Correlator	<AM6PR03MB44726AD98A891CC1BF062049B3542@AM6PR03MB4472.eurprd03.prod.outlook.com>
msip_labels	MIME-Version: 1.0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Organization-AuthSource	AM6PR03MB4472.eurprd03.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Internal
X-MS-Exchange-Organization-AuthMechanism	04
X-MS-Exchange-Organization-Network-Message-Id	7fdfb8ab-ae50-446b-f257-08dcf8e5070f
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	AM6PR03MB4472:EE_\|GVXPR03MB10684:EE_\|AS8PR03MB7414:EE_
Return-Path	Anees.Modan@cardfactory.co.uk
X-MS-Exchange-Organization-ExpirationStartTime	30 Oct 2024 13:16:13.1969
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Office365-Filtering-Correlation-Id	7fdfb8ab-ae50-446b-f257-08dcf8e5070f
X-Microsoft-Antispam	BCL:0;ARA:13230040\|366016\|69100299015\|8096899003\|41050700001;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:AM6PR03MB4472.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(8096899003)(41050700001);DIR:INT;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	30 Oct 2024 13:16:12.8862
X-MS-Exchange-CrossTenant-FromEntityHeader	Hosted
X-MS-Exchange-CrossTenant-Id	7956b84e-0c99-46b5-81c6-28689cfa7221
X-MS-Exchange-CrossTenant-AuthSource	AM6PR03MB4472.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-Network-Message-Id	7fdfb8ab-ae50-446b-f257-08dcf8e5070f
X-MS-Exchange-CrossTenant-MailboxType	HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName	nLYSl6u2sG2WIbjcQNRdI6B35jUWP3yo+b5LB+GWMsjZMEBFbamrArkHKoXjeTAsl4PeOUqmZvsJklZXH0omVeuZoq94ziYs3pxqiFIjaIo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped	GVXPR03MB10684
X-MS-Exchange-Transport-EndToEndLatency	00:00:02.3540715
X-MS-Exchange-Processed-By-BccFoldering	15.20.8093.027
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?650Uqy/k+C2DOlitu33pfDatQw3IC8faTQdTDEden+7n4zofJncAbU1gQcua?=
date	Wed, 30 Oct 2024 14:16:12 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fw Action required Review access by 14 November 2024.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCE190B4.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{46079FBC-051C-4FFC-A793-228B017E3151}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730294950248425200_923433E2-1A96-4CBB-98E8-E3D44AF31730.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730294950249367300_923433E2-1A96-4CBB-98E8-E3D44AF31730.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0929100053-3572.etl

C:\Users\user\AppData\Local\Temp\~DFE97ADC3EFFD4F42C.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Windows Analysis Report
Fw Action required Review access by 14 November 2024.msg