Edit tour

Windows Analysis Report
Tbconsulting Company Guidelines Employee Handbook.docx

Overview

General Information

Sample name:	Tbconsulting Company Guidelines Employee Handbook.docx
Analysis ID:	1576304
MD5:	bc51bca6bdbcb1fd80b041ac0fa20732
SHA1:	924b734434cf013358caf8c3f2cea9b420106182
SHA256:	17baac08210299de158c11f84f587789f3c943c0c1b7675977e85c42e7c7aae8
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Suspicious office document detected (based on various text indicators)

Connects to many different domains

Detected hidden input values containing email addresses (often used in phishing pages)

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 6952 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Tbconsulting Company Guidelines Employee Handbook.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 5740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4076 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Office document

Joe Sandbox AI: Office document contains QR code

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://mstf.mailsupport-netsuites.online
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://mstf.mailsupport-netsuites.online

Suspicious office document detected (based on various text indicators)

Source: Word

OCR Text: DocuSign You have received a secure file to review. SCAN BARCODE TO REVIEW DOCUMENT Agavin agavin@tbconsulting.com This message was sent from DocuSign. All parties have completed Complete with DocuSign: New Company Policy added to Employee Handbook Reigneventsmenphis.pdf You are receiving this email because you subscribed to Microsoft Office 365. Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others.

Source: https://www.justanswer.com/sip/justanswer?r=ppc|ga|27|Tech-Computer-SQR-Search-BMM-Broad|Software-Amazon|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE

HTTP Parser: {"resources":{"hero":{"category":"Experts","tagline":"Get 24/7 help for any issue. Chat with an on-call Expert now.","subhead":["Get your answer in minutes","Personalized help from verified Experts","Get unlimited chats upon joining. Cancel anytime."],"subheadPriceTemplate":"Get unlimited chats upon joining. Cancel anytime.","subheadPriceDefault":"Get unlimited chats upon joining. Cancel anytime.","formattedThirdBullet":"Get unlimited chats upon joining. Cancel anytime.","backgroundImage":"https://ww2-secure.justanswer.com/static/img/sip-prominent-v2/right_rail/Tech.jpg","mediaLogos":[{"name":"icon-cnn"},{"name":"icon-nbc"},{"name":"icon-fox"},{"name":"icon-today"},{"name":"icon-nyt"}],"bullets":[{"text":"Get your answer in minutes","withHtml":false},{"text":"Personalized help from verified Experts","withHtml":false},{"text":"Get unlimited chats upon joining. Cancel anytime.","withHtml":false}],"coBrandedData":{},"cookieBannersProps":{"gdprBannerProps":{"text":"We use cookies to give you the best possible experience on our website. By continuing to use this site you consent to the use of cookies on your device as described in our <a href=\"https://ww2-secure.justanswer.com/en-gb/cookie-notice\" class=\"cookies-privacy-link\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">cookie policy</a> unless you have disabled them."},"ccpaBannerProps":{"text":"By chatting and providing personal info, you understand and agree to our <a href=\"//www.justanswer.com/info/terms-of-service\" class=\"ccpa-terms\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Terms of Service</a> and <a href=\"//www.justanswer.com/info/privacy-security\" class=\"ccpa-policy\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Privacy Policy</a>."},"forceCcpa":false,"shouldShowCcpaBanner":false},"isTcpaBannerEnabled":false},"head":{"marinClientId":"7suskw9xo0","metadata":{"description":"","title":"Ask an Experts Question, Get an Answer ASAP!","canonicalUrl":"https://www.justanswer.com/sip/justanswer","copyright":"2003-2024 JustAnswer LLC","useKeywords":true,"keywords":"","useGooglePlusPublisher":true,"useVerifyV1":false,"useAppleMobileWebCapable":false,"useViewport":false},"headerIcons":{"faviconUrl":"/favicon.ico","touchIconUrl":"/img/ja-boxlogo.png"},"partner":{"baseDomain":"www.justanswer.com"},"labels":{"common":{"copyright":"2003-2024 JustAnswer LLC"}},"jsVariables":{"mainVariable":"JA","variables":{"i":{"analytics":{"tracker":"UA-2229500-1","domain":"justanswer.com","ignoredDomain":"justanswer.com","pagepath":"/fe/layout/desktop/sip.aspx"},"partner":{"ID":1,"Name":"JA Root"},"category":{"id":"53197","name":"Computer","parentName":"","topLevelCategoryName":"Computer","siloVerticalName":"Computer","ppcVerticalName":"Tech","forumSubName":"Computer","hierarchyId":"a8bcbd4209b94fa0918560822259e3bb"},"sipSelectedTabName":"Computer","loadRevizelyInHead":false,"isTargetedMarketing":false,"pt":"100","ptName":"Homepage","baseDomain":"justanswer.com","isDev":false,"i

Source: https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com

HTTP Parser: Base64 decoded: {"uuid":"8e7532e8-2cd2-4fba-8dd0-9938baa6a450","page_time":1734371669,"page_url":"https://mstf.mailsupport-netsuites.online/oVtAwgdE","page_method":"GET","page_request":{},"page_headers":{},"host":"mstf.mailsupport-netsuites.online","ip":"8.46.123.189"}

Source: https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon
Source: https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49807 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	DNS traffic detected: DNS query: mstf.mailsupport-netsuites.online
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: syndicatedsearch.goog
Source: global traffic	DNS traffic detected: DNS query: parking3.parklogic.com
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: click-use1.bodis.com
Source: global traffic	DNS traffic detected: DNS query: www.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: components.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: ww2-secure.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: ww2.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: secure.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: va.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: cat.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: transcend-cdn.com
Source: global traffic	DNS traffic detected: DNS query: sima.justanswer.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: widget.trustpilot.com
Source: global traffic	DNS traffic detected: DNS query: s.adroll.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: cdn.mouseflow.com
Source: global traffic	DNS traffic detected: DNS query: d.impactradius-event.com
Source: global traffic	DNS traffic detected: DNS query: d2hrivdxn8ekm8.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: arttrk.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: 9480947.fls.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: d.adroll.com
Source: global traffic	DNS traffic detected: DNS query: acdn.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ttip-ipv4-prod.telemetry.vaultdcr.com
Source: global traffic	DNS traffic detected: DNS query: ttip-ipv6-prod.telemetry.vaultdcr.com
Source: global traffic	DNS traffic detected: DNS query: tte-prod.telemetry.vaultdcr.com
Source: global traffic	DNS traffic detected: DNS query: x.adroll.com
Source: global traffic	DNS traffic detected: DNS query: adservice.google.com
Source: global traffic	DNS traffic detected: DNS query: segment.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: ml314.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: pixel.tapad.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Tbconsulting Company Guidelines Employee Handbook.docx" /o ""
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4076 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4076 --field-trial-handle=1988,i,14035628684313978814,14330272916034412988,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Tbconsulting Company Guidelines Employee Handbook.docx	Initial sample: OLE zip file path = word/_rels/footnotes.xml.rels
Source: Tbconsulting Company Guidelines Employee Handbook.docx	Initial sample: OLE zip file path = word/comments.xml
Source: Tbconsulting Company Guidelines Employee Handbook.docx	Initial sample: OLE zip file path = docProps/custom.xml

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
dart.l.doubleclick.net	172.217.17.38	true	false	high
user-data-eu.bidswitch.net	35.214.136.108	true	false	high
parking3.parklogic.com	170.187.143.93	true	false	high
adservice.google.com	142.250.181.66	true	false	high
segment.prod.bidr.io	52.31.208.152	true	false	high
platform.twitter.map.fastly.net	151.101.120.157	true	false	high
d1kl3fswx1fgk.cloudfront.net	18.66.161.114	true	false	unknown
stats.g.doubleclick.net	74.125.71.156	true	false	high
scontent.xx.fbcdn.net	157.240.196.15	true	false	high
idsync.rlcdn.com	35.244.154.8	true	false	high
t.co	172.66.0.227	true	false	high
77980.bodis.com	199.59.243.227	true	false	unknown
arttrk.com	18.208.95.164	true	false	unknown
cm.g.doubleclick.net	172.217.19.226	true	false	high
d2hrivdxn8ekm8.cloudfront.net	205.251.222.35	true	false	high
www.google.com	172.217.21.36	true	false	high
d.impactradius-event.com	35.186.249.72	true	false	high
click-use1.bodis.com	199.59.243.205	true	false	high
match.adsrvr.org	15.197.193.217	true	false	high
pixel.tapad.com	34.111.113.62	true	false	high
d1qug1xf2dk5z6.cloudfront.net	18.165.220.61	true	false	high
transcend-cdn.com	104.18.40.238	true	false	high
s.twitter.com	104.244.42.195	true	false	high
sludge-sludge-production-768039409.ap-southeast-1.elb.amazonaws.com	3.1.140.200	true	false	high
syndicatedsearch.goog	216.58.208.238	true	false	high
ad.doubleclick.net	172.217.17.70	true	false	high
adserver-vpc-alb-3-255995556.ap-southeast-1.elb.amazonaws.com	52.74.117.24	true	false	unknown
d2m27mtxipx1og.cloudfront.net	18.66.161.128	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
analytics-alv.google.com	216.239.32.181	true	false	high
googleads.g.doubleclick.net	142.250.181.34	true	false	high
dsum-sec.casalemedia.com	104.18.26.193	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
td.doubleclick.net	172.217.19.162	true	false	high
ml314.com	34.117.77.79	true	false	high
widget.trustpilot.com	18.161.97.94	true	false	high
ib.anycast.adnxs.com	185.89.211.84	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
d2zj3skxk7kh2k.cloudfront.net	18.165.220.41	true	false	unknown
static.ads-twitter.com	unknown	unknown	false	high
d.adroll.com	unknown	unknown	false	high
secure.justanswer.com	unknown	unknown	false	unknown
va.justanswer.com	unknown	unknown	false	unknown
afs.googleusercontent.com	unknown	unknown	false	high
acdn.adnxs.com	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high
ww2.justanswer.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	high
www.justanswer.com	unknown	unknown	false	unknown
ttip-ipv4-prod.telemetry.vaultdcr.com	unknown	unknown	false	high
x.adroll.com	unknown	unknown	false	high
tte-prod.telemetry.vaultdcr.com	unknown	unknown	false	high
ww2-secure.justanswer.com	unknown	unknown	false	unknown
cat.justanswer.com	unknown	unknown	false	unknown
9480947.fls.doubleclick.net	unknown	unknown	false	unknown
x.bidswitch.net	unknown	unknown	false	high
cdn.mouseflow.com	unknown	unknown	false	high
sima.justanswer.com	unknown	unknown	false	unknown
s.adroll.com	unknown	unknown	false	high
ttip-ipv6-prod.telemetry.vaultdcr.com	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
mstf.mailsupport-netsuites.online	unknown	unknown	true	unknown
analytics.google.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
components.justanswer.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://mstf.mailsupport-netsuites.online/?caf=1&bpt=345&query=Contact+Support&afdToken=ChMIzprt_u2sigMVIvO7CB2i4QJuEmoBlLqpj5ASqvXftwqlNK0WjZT-2vZ00jSbxMfBbfDeCaSn5cEU3FDmKGscNErcJUp-1g7d0FEUiUIhfcht7f55gANmkLB2pDGpPskX2fep6CamPOxzYNOYd7FsEXLQezpMjg5DR68hYOWiIAE&pcsa=false&nb=0&nm=38&nx=565&ny=53&is=700x480&clkt=112	false	unknown
https://mstf.mailsupport-netsuites.online/oVtAwgdE#agavin@tbconsulting.com	false	unknown
https://www.justanswer.com/sip/justanswer?r=ppc\|ga\|27\|Tech-Computer-SQR-Search-BMM-Broad\|Software-Amazon\|&JPKW=%2Bhelp%20%2B%26%20%2Bcustomer%20%2Bservice&JPDC=S&JPST=&JPAD=355200043659&JPMT=b&JPNW=s&JPAF=txt&JPRC=1&JPCD=&JPOP=&cmpid=2031261533&agid=71340705109&fiid=&tgtid=kwd-370301366612&ntw=s&dvc=c&gad_source=5&gclid=EAIaIQobChMIiqSKju6sigMVpgcGAB2u5DvREAAYASAAEgJ7_PD_BwE	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.226	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.17.66	unknown	United States	15169	GOOGLEUS	false
104.16.43.9	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.161.128	d2m27mtxipx1og.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
185.89.210.153	unknown	Germany	29990	ASN-APPNEXUS	false
52.31.21.54	unknown	United States	16509	AMAZON-02US	false
63.33.186.64	unknown	United States	16509	AMAZON-02US	false
13.251.177.224	unknown	United States	16509	AMAZON-02US	false
54.90.40.148	unknown	United States	14618	AMAZON-AESUS	false
52.31.208.152	segment.prod.bidr.io	United States	16509	AMAZON-02US	false
2.17.100.200	unknown	European Union	4230	CLAROSABR	false
34.117.77.79	ml314.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.217.17.38	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
18.66.161.114	d1kl3fswx1fgk.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
3.1.140.200	sludge-sludge-production-768039409.ap-southeast-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
162.159.140.229	unknown	United States	13335	CLOUDFLARENETUS	false
18.208.95.164	arttrk.com	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.34	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
199.59.243.227	77980.bodis.com	United States	395082	BODIS-NJUS	false
184.30.24.109	unknown	United States	16625	AKAMAI-ASUS	false
104.18.40.238	transcend-cdn.com	United States	13335	CLOUDFLARENETUS	false
216.58.208.238	syndicatedsearch.goog	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
18.165.220.96	unknown	United States	3	MIT-GATEWAYSUS	false
18.165.220.61	d1qug1xf2dk5z6.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.89.211.84	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
52.109.28.47	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.42	unknown	United States	15169	GOOGLEUS	false
18.66.161.92	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.181.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.17.70	ad.doubleclick.net	United States	15169	GOOGLEUS	false
52.109.76.240	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.161.97.94	widget.trustpilot.com	United States	3	MIT-GATEWAYSUS	false
104.18.26.50	unknown	United States	13335	CLOUDFLARENETUS	false
35.214.136.108	user-data-eu.bidswitch.net	United States	19527	GOOGLE-2US	false
52.74.117.24	adserver-vpc-alb-3-255995556.ap-southeast-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.16.42.9	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
74.125.71.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
52.111.252.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.41	d2zj3skxk7kh2k.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
20.42.65.89	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.147.18	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.120.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.68	unknown	United States	15169	GOOGLEUS	false
172.217.17.40	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.66	adservice.google.com	United States	15169	GOOGLEUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.165.220.122	unknown	United States	3	MIT-GATEWAYSUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
170.187.143.93	parking3.parklogic.com	United States	7018	ATT-INTERNET4US	false
92.122.101.59	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
199.59.243.205	click-use1.bodis.com	United States	395082	BODIS-NJUS	false
104.18.26.193	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
104.244.42.195	s.twitter.com	United States	13414	TWITTERUS	false
34.111.113.62	pixel.tapad.com	United States	15169	GOOGLEUS	false
205.251.222.174	unknown	United States	16509	AMAZON-02US	false
205.251.222.35	d2hrivdxn8ekm8.cloudfront.net	United States	16509	AMAZON-02US	false
18.161.97.38	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.181.104	unknown	United States	15169	GOOGLEUS	false
172.217.19.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
35.186.249.72	d.impactradius-event.com	United States	15169	GOOGLEUS	false
173.194.222.84	unknown	United States	15169	GOOGLEUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
2.19.198.26	unknown	European Union	16625	AKAMAI-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576304
Start date and time:	2024-12-16 18:53:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Tbconsulting Company Guidelines Employee Handbook.docx
Detection:	MAL
Classification:	mal52.phis.winDOCX@29/170@186/390
Cookbook Comments:	Found application associated with file extension: .docx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

File type:	Microsoft Word 2007+
Entropy (8bit):	7.878788688178597
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Tbconsulting Company Guidelines Employee Handbook.docx
File size:	15'305 bytes
MD5:	bc51bca6bdbcb1fd80b041ac0fa20732
SHA1:	924b734434cf013358caf8c3f2cea9b420106182
SHA256:	17baac08210299de158c11f84f587789f3c943c0c1b7675977e85c42e7c7aae8
SHA512:	4e951bc82c18a2140893cf0a2f3f6d3dcd2c29c7e0f5a8e6d74800b391678c4c980a6f20602a06256f04977c716977b48710d46cd80a10995900fb417221b83b
SSDEEP:	384:Y/Swf58NjAZ/vZmyahy3XWwbh45XF9Owy4aef:wz2mx5ahy3xSPBnvf
TLSH:	8062AE15D982C327C95741FDB1041D82D9B2249FFA06A01DB46B71FCC6B0AD7138BA6F
File Content Preview:	PK........,.CY................[Content_Types].xml...N.0.E.%..5n.@....!..J..p.Ik.{,{...3Ih..$...H...{}c+.......h.M.Q6L.p..q.i....\...d....nuq.n....Qm............a-.T.r.b<.^......*F:..B.....-/7.<.&7M_%5M...Q..,...q0@.;&...fo.i-...'n.........i`....Uiy$.U^F..

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tbconsulting Company Guidelines Employee Handbook.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Temp\TCD333F.tmp\BracketList.glox

C:\Users\user\AppData\Local\Temp\TCD333F.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3343.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3343.tmp\iso690nmerical.xsl

C:\Users\user\AppData\Local\Temp\TCD3355.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3355.tmp\ieee2006officeonline.xsl

C:\Users\user\AppData\Local\Temp\TCD3357.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3357.tmp\sist02.xsl

C:\Users\user\AppData\Local\Temp\TCD3358.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3358.tmp\gostname.xsl

C:\Users\user\AppData\Local\Temp\TCD3359.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3359.tmp\ConvergingText.glox

C:\Users\user\AppData\Local\Temp\TCD335A.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD335A.tmp\turabian.xsl

C:\Users\user\AppData\Local\Temp\TCD337A.tmp\APASixthEditionOfficeOnline.xsl

C:\Users\user\AppData\Local\Temp\TCD337A.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD33AE.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD33AE.tmp\PictureFrame.glox

C:\Users\user\AppData\Local\Temp\TCD33AF.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD33AF.tmp\VaryingWidthList.glox

C:\Users\user\AppData\Local\Temp\TCD33BF.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD33BF.tmp\TabbedArc.glox

C:\Users\user\AppData\Local\Temp\TCD33C1.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD33C1.tmp\TabList.glox

C:\Users\user\AppData\Local\Temp\TCD3401.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3401.tmp\ThemePictureAlternatingAccent.glox

C:\Users\user\AppData\Local\Temp\TCD3402.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3402.tmp\ThemePictureAccent.glox

C:\Users\user\AppData\Local\Temp\TCD3403.tmp\CircleProcess.glox

C:\Users\user\AppData\Local\Temp\TCD3403.tmp\Content.inf

Windows Analysis Report
Tbconsulting Company Guidelines Employee Handbook.docx

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre