Edit tour

Windows Analysis Report
PO-070-2024 EXW.docx

Overview

General Information

Sample name:	PO-070-2024 EXW.docx
Analysis ID:	1525993
MD5:	ec393bad7364db40b4fb1d07a654ec54
SHA1:	b51e6d26528e3667e87c29672dec312a6f4d7a90
SHA256:	b36248f2e24e6ac7fa34c51336c87b0564f566bf37e4f80010ecffc0baf77986
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Microsoft Office launches external ms-search protocol handler (WebDAV)

Contains an external reference to another file

Office viewer loads remote template

Document misses a certain OLE stream usually present in this Microsoft Office document type

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3520 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 3520, Protocol: tcp, SourceIp: 213.183.76.22, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3520, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3520, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 213.183.76.21:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 213.183.76.22:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 213.183.76.21:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 213.183.76.22:443 -> 192.168.2.22:49161 version: TLS 1.2

Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io
Source: global traffic	DNS query: name: stylite.io

Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 213.183.76.21:443
Source: global traffic	TCP traffic: 213.183.76.21:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 213.183.76.22:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 213.183.76.22:443

Source: Joe Sandbox View

ASN Name: PFALZKOM-NETKoschatplatz1DE PFALZKOM-NETKoschatplatz1DE

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /G2eK HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: stylite.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: stylite.ioConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 213.183.76.21:443 -> 192.168.2.22:49162 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 213.183.76.22:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 213.183.76.21:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C5D7766F-BCC3-4F8D-B0D1-2EF8DB43D0A9}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /G2eK HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: stylite.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: stylite.ioConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: stylite.io

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 4645Content-Type: text/html; charset=utf-8Date: Fri, 04 Oct 2024 14:32:21 GMTEtag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8"Strict-Transport-Security: max-age=15552000; includeSubDomainsVary: Accept-EncodingX-Content-Type-Options: nosniffX-Dns-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Powered-By: Next.jsX-Xss-Protection: 1; mode=blockConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 144Content-Security-Policy: default-src 'none'Content-Type: text/html; charset=utf-8Date: Fri, 04 Oct 2024 14:32:26 GMTStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-Dns-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 144Content-Security-Policy: default-src 'none'Content-Type: text/html; charset=utf-8Date: Fri, 04 Oct 2024 14:32:28 GMTStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-Dns-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Date: Fri, 04 Oct 2024 14:32:30 GMTEtag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8"Strict-Transport-Security: max-age=15552000; includeSubDomainsVary: Accept-EncodingX-Content-Type-Options: nosniffX-Dns-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Powered-By: Next.jsX-Xss-Protection: 0Connection: closeTransfer-Encoding: chunked

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown

HTTPS traffic detected: 213.183.76.22:443 -> 192.168.2.22:49161 version: TLS 1.2

Source: ~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp.1.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal56.evad.winDOCX@1/16@7/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$-070-2024 EXW.docx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRB940.tmp

Jump to behavior

Source: PO-070-2024 EXW.docx	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.1.dr	OLE indicator, Word Document stream: true

Source: PO-070-2024 EXW.docx	OLE document summary: title field not present or empty
Source: ~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp.1.dr	OLE document summary: title field not present or empty
Source: ~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp.1.dr	OLE document summary: edited time not present or 0
Source: ~WRD0000.tmp.1.dr	OLE document summary: title field not present or empty

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: PO-070-2024 EXW.LNK.1.dr

LNK file: ..\..\..\..\..\Desktop\PO-070-2024 EXW.docx

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PO-070-2024 EXW.docx	Initial sample: OLE zip file path = word/_rels/footer2.xml.rels
Source: PO-070-2024 EXW.docx	Initial sample: OLE zip file path = word/media/image3.emf
Source: PO-070-2024 EXW.docx	Initial sample: OLE zip file path = word/media/image2.emf
Source: PO-070-2024 EXW.docx	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/_rels/footer2.xml.rels
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/embeddings/Microsoft_Excel_Worksheet2.xlsx
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/embeddings/Microsoft_Excel_Worksheet1.xlsx
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/media/image2.emf
Source: ~WRD0000.tmp.1.dr	Initial sample: OLE zip file path = word/media/image3.emf

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: PO-070-2024 EXW.docx

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: \Device\RdpDr\;:1\stylite.io@SSL\DavWWWRoot

Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://stylite.io/g2ek

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: ~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp.1.dr

Stream path '_1789543103/Package' entropy: 7.94289414861 (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Exploitation for Client Execution	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	14 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO-070-2024 EXW.docx	11%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
stylite.io	213.183.76.22	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://stylite.io/G2eK	false		unknown
https://stylite.io/404	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.183.76.22	stylite.io	Germany		15945	PFALZKOM-NETKoschatplatz1DE	true
213.183.76.21	unknown	Germany		15945	PFALZKOM-NETKoschatplatz1DE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525993
Start date and time:	2024-10-04 16:31:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-070-2024 EXW.docx
Detection:	MAL
Classification:	mal56.evad.winDOCX@1/16@7/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PO-070-2024 EXW.docx

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.183.76.22	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse
213.183.76.22	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse
213.183.76.21	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse
213.183.76.21	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stylite.io	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	213.183.76.21
stylite.io	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	213.183.76.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PFALZKOM-NETKoschatplatz1DE	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	213.183.76.21
	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	213.183.76.21
	yakov.mpsl.elf	Get hash	malicious	Mirai	Browse	94.176.172.127
	154.216.18.223-mips-2024-08-17T03_44_00.elf	Get hash	malicious	Mirai	Browse	77.72.217.98
	file.exe	Get hash	malicious	Unknown	Browse	213.206.184.75
	http://internet-scanner.com/?rid=ecXtVpP	Get hash	malicious	Unknown	Browse	213.183.73.232
	KCM5U9fQEI.elf	Get hash	malicious	Moobot	Browse	213.183.70.203
	http://gslb00.www.bancsabadell.com.as60813.net	Get hash	malicious	Phisher	Browse	45.148.222.10
	WCJX7dbLAq.elf	Get hash	malicious	Mirai, Moobot	Browse	213.183.70.201
PFALZKOM-NETKoschatplatz1DE	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	213.183.76.21
	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	213.183.76.21
	yakov.mpsl.elf	Get hash	malicious	Mirai	Browse	94.176.172.127
	154.216.18.223-mips-2024-08-17T03_44_00.elf	Get hash	malicious	Mirai	Browse	77.72.217.98
	file.exe	Get hash	malicious	Unknown	Browse	213.206.184.75
	http://internet-scanner.com/?rid=ecXtVpP	Get hash	malicious	Unknown	Browse	213.183.73.232
	KCM5U9fQEI.elf	Get hash	malicious	Moobot	Browse	213.183.70.203
	http://gslb00.www.bancsabadell.com.as60813.net	Get hash	malicious	Phisher	Browse	45.148.222.10
	WCJX7dbLAq.elf	Get hash	malicious	Mirai, Moobot	Browse	213.183.70.201

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	213.183.76.22 213.183.76.21
	GEJMING DUO USD 20241002144902.docx.doc	Get hash	malicious	Remcos	Browse	213.183.76.22 213.183.76.21
	Swift Copy.xls	Get hash	malicious	Unknown	Browse	213.183.76.22 213.183.76.21
	PO-00536.xls	Get hash	malicious	Remcos	Browse	213.183.76.22 213.183.76.21
	Formularz instrukcji p#U0142atno#U015bci Millennium.xls	Get hash	malicious	Remcos	Browse	213.183.76.22 213.183.76.21
	MT103-93850.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.183.76.22 213.183.76.21
	StatementXofXaccount.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.183.76.22 213.183.76.21
	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	213.183.76.22 213.183.76.21
	CxVokk1Xp2.rtf	Get hash	malicious	Remcos	Browse	213.183.76.22 213.183.76.21
7dcce5b76c8b17472d024758970a406b	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	213.183.76.22
	PO20241003.xls	Get hash	malicious	Unknown	Browse	213.183.76.22
	GEJMING DUO USD 20241002144902.docx.doc	Get hash	malicious	Remcos	Browse	213.183.76.22
	PO20241003.xls	Get hash	malicious	Unknown	Browse	213.183.76.22
	Swift Copy.xls	Get hash	malicious	Unknown	Browse	213.183.76.22
	PO-00536.xls	Get hash	malicious	Remcos	Browse	213.183.76.22
	Formularz instrukcji p#U0142atno#U015bci Millennium.xls	Get hash	malicious	Remcos	Browse	213.183.76.22
	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	213.183.76.22
	Request For Quotation- PO22719.xlsx	Get hash	malicious	FormBook	Browse	213.183.76.22

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02573908657392288
Encrypted:	false
SSDEEP:	6:I3DPcVQJBaWvxggLRJcUy6OssDRXv//4tfnRujlw//+GtluJ/eRuj:I3DPEQbmKOss1vYg3J/
MD5:	E4721111BF3701C41F9098F89A0F94B0
SHA1:	B2236F1BF555541FACFADD8B63772AAE1FF4274A
SHA-256:	A368586B6B3E1A0C13015704837FC6E398ED82EDE911B6F6B60985361DCB47C2
SHA-512:	5DF3170D1749E96FA92845E618B6C7A59B2D8397BA959254BDCE1EB58549CDD58E259D42CB902C5117C38C7FEFB05C9F451062183B221E5008199C44D0EDD7BB
Malicious:	false
Reputation:	low
Preview:	......M.eFy...zRu,t>..C.$.^HZ.S,...X.F...Fa.q............................^."..hoA.[.+rb.V........=..)./lO..{.;.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1DB59C6B.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	484160
Entropy (8bit):	3.8864316104704324
Encrypted:	false
SSDEEP:	1536:6lGUVs3QKMY4ELH5RQVKTT1HXxlUL7z5likIUvIfxT0kPrS2:ZLZRQVGB4fj2
MD5:	A61798BF257485BAA37AD0863DFDA9C6
SHA1:	6356E87D0D93FD7DAAF225AF3DFCCA27705A2717
SHA-256:	1AE272725C8CC33D6CA16533E9BFE2B91885C1F8926F13D8F3475192174BFA54
SHA-512:	E1FBE16E09A75D6C1A98F9EC9224350214B0E34EC0049870CAE03D90CF78BE5FFF3ECE69E4149729DF6F731D0E7630A64C800DFCA63EF06A862D512C30E3FC68
Malicious:	false
Reputation:	low
Preview:	....l................................... EMF....@c..........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...............:...............T...!..............?...........?................................'.............../T......%...........(.................../T..L...d...........l...:...............

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5345CD92.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1256732
Entropy (8bit):	3.82589372392918
Encrypted:	false
SSDEEP:	12288:c3t3bECFzKzjLBMc0GtIRabD8R1AZJBa5jB7gOaOG/:cBACi8BiJK+d
MD5:	082E8FBE73D98FD6C861150EF1FC0905
SHA1:	C91ECCF6C9A73B74D9D1442EB72A8D6F650EDC64
SHA-256:	574EF96FEF6B764D4047BB2D714AB5D753EC81E87BC9F5AD1526DB74446E3B13
SHA-512:	AFEE4534199071801E19AE9D8E57B396989746E3F9D7081337B85B4B2108625849364BD04AFBA41261CC731BD54A83D8269A5EF74EE1878B157628C34240E751
Malicious:	false
Reputation:	low
Preview:	....l............................H...@.. EMF.....-..U.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0410895.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7388
Entropy (8bit):	3.4978769133855403
Encrypted:	false
SSDEEP:	48:JI37fPfjYzJSEfNjyyeffffffffffffffffffffffVa7FyltyzzlYYqEVPq6Bl6N:O3TWGy9B6YkyJiEf1U0i
MD5:	7E1524EDF040EB5EDBD1BED6E70730B4
SHA1:	1C8B74CE483139667E3C99CFDEFD780B6CC83C96
SHA-256:	AED73DE15274C7EFD791BE09A2DD14579E49B567958A54EAFC39AA7CDA0F1F81
SHA-512:	2A8497100334680D6CCF7A8C353F3796D6B158337645B735914B1C8520B5664069E4B062DAA9D76452C8517B3FFC9785A1E0FA5A5747DB9C75C98BD8BDA203AC
Malicious:	false
Reputation:	low
Preview:	....l...............<...........O....... EMF................................8...X....................?..................................C...R...p...................................S.e.g.o.e. .U.I...................................................p.6.).X.....m.d...................t.:.0.:....t....\...t.:.....t.:..:.7..t....t.:.L].v?..t.......t0.p...fw..............:...cw....$.....&.d.........:.*X.t.....X.t@........qk.....-....:.6=bw................<..u.[7w....X..V....0.p.......................8wdv......%...................................r.......`...........'...`.......(...(..................?...........?................l...4...........(...(...(...(...(..... .................................................................................................................................................................................................................................... .. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. ".. "........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	7.83885305146706
Encrypted:	false
SSDEEP:	6144:MlNJQEA/8vLYjE7yeVDxHg9VImcfl7CTjQQm:aJNQU9XHgrImckAQm
MD5:	D6CD67EE581035CF9DA53E872FD9A874
SHA1:	650B06F1BCCFD095AE536F8777634E4447FB4DC2
SHA-256:	40B6F94A4398E71D513EFBCB0F028C60F7E639550FF4C6577EA679B390A98A4D
SHA-512:	C2EBB8C50964D94F963D6EEBCF6B2C2B4375754FF3D642C2CFA390328F4D05043AF67E03718E8E193AF605FBC13BFB3E25BA12BBB93887DC1A7E70904F5679F6
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................g....................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...................k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{537E1DDC-F469-4035-8F88-E4CF06BBC501}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	2.9224663475921906
Encrypted:	false
SSDEEP:	24:9naGMCleK+KslMb8jjHl+8HLHr9Dryn/n:9dSl48jjHl+AVa/
MD5:	48209ABC7CBA4D3C6666C7E52CEE5D37
SHA1:	EBA07D8797F60AAB19A8EDD7C6A8029E754E2F5F
SHA-256:	0EF88EB7F39465C30420CE0B8CD740893DE4FCE3870E06CE57249514CB051623
SHA-512:	72DA5775CFE0E7FC961D5600E0BB3FA860CBF10E558738730CB414EF96FA52503029B7CBD72076AEDB22331F856837D2524E35EB1FE3CA241B8400206AB39B40
Malicious:	false
Preview:	.................................................................. .!.".#.$.%.&.'.(.).*.+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.........................E.M.B.E.D. .P.a.c.k.a.g.e..... . .....E.M.B.E.D. .E.x.c.e.l...S.h.e.e.t...1.2..... . .....E.M.B.E.D. .E.x.c.e.l...S.h.e.e.t...1.2..... . ...5.e.+.5.N.5.[.=.5.X.=.0.5.[.5.[.5.X.5.e.5.X.5.N.5.[.."5.X...........................................................................................................................................................................................................................`...b...d...f...j...n...r....................................................................................................................................................................................................................................................................................................................................................................................................d........gdWX......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C5D7766F-BCC3-4F8D-B0D1-2EF8DB43D0A9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{7651D4AF-37E3-48AB-BBA3-80AEFB43EF85}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02573908657392288
Encrypted:	false
SSDEEP:	6:I3DPcVQJBaWvxggLRJcUy6OssDRXv//4tfnRujlw//+GtluJ/eRuj:I3DPEQbmKOss1vYg3J/
MD5:	E4721111BF3701C41F9098F89A0F94B0
SHA1:	B2236F1BF555541FACFADD8B63772AAE1FF4274A
SHA-256:	A368586B6B3E1A0C13015704837FC6E398ED82EDE911B6F6B60985361DCB47C2
SHA-512:	5DF3170D1749E96FA92845E618B6C7A59B2D8397BA959254BDCE1EB58549CDD58E259D42CB902C5117C38C7FEFB05C9F451062183B221E5008199C44D0EDD7BB
Malicious:	false
Preview:	......M.eFy...zRu,t>..C.$.^HZ.S,...X.F...Fa.q............................^."..hoA.[.+rb.V........=..)./lO..{.;.......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9C827400-DDDB-4AEC-9921-0C9EAC1257D8}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02570204774814565
Encrypted:	false
SSDEEP:	6:I3DPcpn9ZqR5HvxggLR/oNvfFRXv//4tfnRujlw//+GtluJ/eRuj:I3DP4n9ZqfPTmXbvYg3J/
MD5:	A3D260F83F1E423E566B4B052795FCA1
SHA1:	6EDAB22F727894D4967F065DBCDF6AEE44B56344
SHA-256:	00A58D7E247D468E3E83EBB01990E001D156C6BA4EAA455FB7F9F3611525D42A
SHA-512:	45C8A6B565025F86B3D8C501C2F6D4F6681C56CCCAE27897463B329DBD5F7F6C726729309199E67BE5A164B56F22468DA82F6C6F9D7AA3075E98B61A9BC44FD2
Malicious:	false
Preview:	......M.eFy...zn.`...{C..vk.\6!S,...X.F...Fa.q..............................c...B..............m.t...N.a.....\|.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO-070-2024 EXW.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:14 2023, mtime=Fri Aug 11 15:42:14 2023, atime=Fri Oct 4 13:32:05 2024, length=458184, window=hide
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.523489311449114
Encrypted:	false
SSDEEP:	12:8z57LSK6hgXg/XAlCPCHaXeIBO1B/VoX+WByfHc8MhSTkicvbz/dl2mNDtZ3Yiln:8t7rS/XTOI41M/y0STePPdDv3qwti57u
MD5:	6817927283F3F900076A5B6DEC58A4EE
SHA1:	A513EEA8B4ACB07CA742EC217D3FDF631E472938
SHA-256:	0F9FEC1316F55E41A1FD76F812B80E3145E7508E7CAFF45F30730E7344877FFD
SHA-512:	552564ED282138D15B4FFE8A2FA44D490B998D56A4A20A627E617F892D40FBC27FD034E3862E11EC6C60D6AF0833ED61825A799B8C4341849A0B15D8F304B25D
Malicious:	false
Preview:	L..................F.... ...Tn..r...Tn..r....w\|/j................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....DY.t..user.8......QK.XDY.t...&=....U...............A.l.b.u.s.....z.1......WJ...Desktop.d......QK.X.WJ...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....r.2.....DY.t .PO-070~1.DOC..V.......WH..WH..........................P.O.-.0.7.0.-.2.0.2.4. .E.X.W...d.o.c.x.......~...............-...8...[............?J......C:\Users\..#...................\\506013\Users.user\Desktop\PO-070-2024 EXW.docx.+.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.P.O.-.0.7.0.-.2.0.2.4. .E.X.W...d.o.c.x.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......506013..........D_....3N...W...9..W.e8..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.6685216591823
Encrypted:	false
SSDEEP:	3:H+MVItj/pulm4YPVItj/pulv:Hc/AGK/A1
MD5:	69A8027DD969F55C758F182BEF5CF96B
SHA1:	D31483783E488E663779755B43C39F91C8852AC3
SHA-256:	0EF79362195421BAE0520ACE450D8A335B5F19EE0C35930674D482F29284AF8D
SHA-512:	D7F59D6C04808BE7B0DB197A4658D2062DF758FF2C2561C7855F9F08147EDBF254146D447DDE94A779492DC136CEC321AB06C6878B221A4EFB22018A215C1176
Malicious:	false
Preview:	[misc]..PO-070-2024 EXW.LNK=0..[folders]..PO-070-2024 EXW.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707526
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVybAyaHgdWM2qFfln:vdsCkWt4aAB9l
MD5:	0242FE15C357E1F4F690389FA2A5D79D
SHA1:	A45B5C025BF4B6F9CD21A65AE6FFA6EB99BD46AC
SHA-256:	4FEB171EECBB41AC06DA90CFD42C190C3FFC40A8187406C1AE8D4EFE5BEE0162
SHA-512:	605CEDA901D869E1E562947187FEE88B1A95A47F9E06D3C144895D16A7DF25AE41E54702A88840C67D4374479D068182DBD851536937BB66004A8162F01645BB
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\PO-070-2024 EXW.docx (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	529558
Entropy (8bit):	7.955947071682177
Encrypted:	false
SSDEEP:	12288:VmckAQmgQU9XHgrdg6KUONqta0GCSSFhaGPONT+srQ4E8VM:VmckL5QUur2QONqg0GQM53iIM
MD5:	3397DE5A24FF54A1CEB764ED1BADC838
SHA1:	61391537626A672FA2268892FE22CDB155DFF52A
SHA-256:	B1897F18A913A629F13ECD7707D3A5FABA65DB0A5FAD440C2C19D8A71D6AF42C
SHA-512:	1131B4053EA406B6569E54C60A0AC729CFAB895C5CDDD8EFFB326786905519EDF636336E902050251B8A93022CB29C518F0C58206223626B73DF378FBD529932
Malicious:	false
Preview:	PK..........!.................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................VMo.0.....0t.l..0.C.....X..........&.~...].D..........E..V.#x.....Leki.%.....f..aj....m.......r..3.6X.6...s.Z......Jc...>..;Q.5........`B.".[.B#.T.n6..W...e...HU2...$.?.z.$.M#+.m......nW..........K..m.r8.........c+.~ k.0..Y..S.9......Qc....w.xK'....;..w........>.V.&.h...........4;.....U...U..#.....4...1J4.1.x..f...1$.w.~s.c:>#'%<...d^.'.4..c......"...i.!'%.../...=.H..7..$..8...m..G..e....O.?2..F..X)8...

C:\Users\user\Desktop\~$-070-2024 EXW.docx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707526
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVybAyaHgdWM2qFfln:vdsCkWt4aAB9l
MD5:	0242FE15C357E1F4F690389FA2A5D79D
SHA1:	A45B5C025BF4B6F9CD21A65AE6FFA6EB99BD46AC
SHA-256:	4FEB171EECBB41AC06DA90CFD42C190C3FFC40A8187406C1AE8D4EFE5BEE0162
SHA-512:	605CEDA901D869E1E562947187FEE88B1A95A47F9E06D3C144895D16A7DF25AE41E54702A88840C67D4374479D068182DBD851536937BB66004A8162F01645BB
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	529558
Entropy (8bit):	7.955947071682177
Encrypted:	false
SSDEEP:	12288:VmckAQmgQU9XHgrdg6KUONqta0GCSSFhaGPONT+srQ4E8VM:VmckL5QUur2QONqg0GQM53iIM
MD5:	3397DE5A24FF54A1CEB764ED1BADC838
SHA1:	61391537626A672FA2268892FE22CDB155DFF52A
SHA-256:	B1897F18A913A629F13ECD7707D3A5FABA65DB0A5FAD440C2C19D8A71D6AF42C
SHA-512:	1131B4053EA406B6569E54C60A0AC729CFAB895C5CDDD8EFFB326786905519EDF636336E902050251B8A93022CB29C518F0C58206223626B73DF378FBD529932
Malicious:	false
Preview:	PK..........!.................[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................VMo.0.....0t.l..0.C.....X..........&.~...].D..........E..V.#x.....Leki.%.....f..aj....m.......r..3.6X.6...s.Z......Jc...>..;Q.5........`B.".[.B#.T.n6..W...e...HU2...$.?.z.$.M#+.m......nW..........K..m.r8.........c+.~ k.0..Y..S.9......Qc....w.xK'....;..w........>.V.&.h...........4;.....U...U..#.....4...1J4.1.x..f...1$.w.~s.c:>#'%<...d^.'.4..c......"...i.!'%.../...=.H..7..$..8...m..G..e....O.?2..F..X)8...

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.99374264934029
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	PO-070-2024 EXW.docx
File size:	458'184 bytes
MD5:	ec393bad7364db40b4fb1d07a654ec54
SHA1:	b51e6d26528e3667e87c29672dec312a6f4d7a90
SHA256:	b36248f2e24e6ac7fa34c51336c87b0564f566bf37e4f80010ecffc0baf77986
SHA512:	884a96308b7fa83f47db4006fe0c5ca8ce92143f534447826ed5f43efcaef6cefd1592b56fdbd02248df7080f3ca0b51d3f72886564dad95b24aec51e2c93e79
SSDEEP:	12288:GMY4Eg5/Y+vnfrYbCGGmdq/c2KoTQkBaJhR+6EiXyC:GlBwL3rYbCGGyyLKcd8JhxEiXyC
TLSH:	7DA423E5F44C2C655E85083E05159E14B3AFDF9FC0071AAF3779092AE9A684EEF580CE
File Content Preview:	PK........&.CY...k....'.......[Content_Types].xmlUT......f...f...f.V.n.0....?......(..r.].M...@.#.-E..Ib.}..c.A"9u._$..............._.y5..x....Z...V~....F....[@q.\|.nq.....=..%...D.B....<G..:E...2*.[.A^.f.....SI.C,.7l Y...J.]u.#.C2...\| ...D...e.Z.......\|..

File Icon


Icon Hash:	65e6a3a3afb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "PO-070-2024 EXW.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	2
Total Edit Time:	2
Create Time:	2024-10-03T12:13:00Z
Last Saved Time:	2024-10-03T12:15:00Z
Number of Pages:	1
Number of Words:	0
Number of Characters:	0
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 50644

General
Stream Path:	\x1Ole10Native
CLSID:
File Type:	data
Stream Size:	50644
Entropy:	7.724951216605807
Base64 Encoded:	True
Data ASCII:	. . . . 0 0 5 0 0 _ 8 0 0 9 _ 1 7 7 7 _ 2 4 _ 2 5 . p d f . C : \\ U s e r s \\ 9 1 9 7 4 \\ O n e D r i v e \\ D e s k t o p \\ W o r d F i l e \\ N E W F I L E S \\ 0 0 5 0 0 _ 8 0 0 9 _ 1 7 7 7 _ 2 4 _ 2 5 . p d f . . . . . < . . . C : \\ U s e r s \\ 9 1 9 7 4 \\ A p p D a t a \\ L o c a l \\ T e m p \\ 0 0 5 0 0 _ 8 0 0 9 _ 1 7 7 7 _ 2 4 _ 2 5 . p d f . . . % P D F - 1 . 3 . % . . 1 0 o b j . < < . / T y p e / P a g e . / M e d i a B o x [ 0 0 5 9 4 . 3 6 8 4 0 . 6 0 ] . / C r o p B o x [ 0 0 5
Data Raw:	d0 c5 00 00 02 00 30 30 35 30 30 5f 38 30 30 39 5f 31 37 37 37 5f 32 34 5f 32 35 2e 70 64 66 00 43 3a 5c 55 73 65 72 73 5c 39 31 39 37 34 5c 4f 6e 65 44 72 69 76 65 5c 44 65 73 6b 74 6f 70 5c 57 6f 72 64 46 69 6c 65 5c 4e 45 57 46 49 4c 45 53 5c 30 30 35 30 30 5f 38 30 30 39 5f 31 37 37 37 5f 32 34 5f 32 35 2e 70 64 66 00 00 00 03 00 3c 00 00 00 43 3a 5c 55 73 65 72 73 5c 39 31 39

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 0d 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 16:32:17.079583883 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:17.079638004 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:17.079698086 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:17.085063934 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:17.085077047 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:17.944055080 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:17.944134951 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:17.950207949 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:17.950220108 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:17.950668097 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:17.950720072 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.082678080 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.127403975 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:18.275810003 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:18.275892973 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:18.275949001 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.276355982 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.281133890 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.281162024 CEST	443	49161	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:18.281174898 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.281213999 CEST	49161	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:18.868993998 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:18.869045019 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:18.869118929 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:18.869616032 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:18.869637966 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:19.734695911 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:19.734836102 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:19.739082098 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:19.739094019 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:19.739545107 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:19.746021986 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:19.787412882 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.015954971 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.016032934 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.016098022 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.016168118 CEST	49162	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.016189098 CEST	443	49162	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.018182039 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.018224001 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.018275023 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.018481016 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.018488884 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.847182035 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.848875999 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.848903894 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:20.849580050 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:20.849585056 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:21.122380018 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:21.122466087 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:21.122585058 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:21.122647047 CEST	49163	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:21.122669935 CEST	443	49163	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:24.401870012 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:24.401913881 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:24.402013063 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:24.402627945 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:24.402646065 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.250042915 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.250210047 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:25.254211903 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:25.254221916 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.254527092 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.270648956 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:25.311418056 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.527854919 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.528026104 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.528090954 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:25.528170109 CEST	49164	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:25.528189898 CEST	443	49164	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:25.918452978 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:25.918502092 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:25.918800116 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:25.919276953 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:25.919289112 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:26.764673948 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:26.764822006 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:26.770452976 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:26.770472050 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:26.770776987 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:26.773542881 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:26.819405079 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.040249109 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.040333986 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.040803909 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.074502945 CEST	49165	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.074541092 CEST	443	49165	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.086997032 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.087047100 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.087125063 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.087409019 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.087424040 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.912971973 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.913439035 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.913455009 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:27.914093971 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:27.914100885 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:28.197087049 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:28.197160006 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:28.197267056 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:28.198507071 CEST	49166	443	192.168.2.22	213.183.76.21
Oct 4, 2024 16:32:28.198527098 CEST	443	49166	213.183.76.21	192.168.2.22
Oct 4, 2024 16:32:28.234616995 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:28.234662056 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:28.234738111 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:28.235024929 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:28.235044003 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.086785078 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.088686943 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.090430021 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.090455055 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.091896057 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.091917038 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.364873886 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.364964962 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.365016937 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.365223885 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.365861893 CEST	49167	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.365884066 CEST	443	49167	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.366663933 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.366697073 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:29.366755009 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.367058992 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:29.367074966 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.211733103 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.211853981 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.215343952 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.215356112 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.216748953 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.216770887 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497659922 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497725964 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497771978 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497791052 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.497807026 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497819901 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.497819901 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.497848988 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.497855902 CEST	443	49168	213.183.76.22	192.168.2.22
Oct 4, 2024 16:32:30.497895956 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.498173952 CEST	49168	443	192.168.2.22	213.183.76.22
Oct 4, 2024 16:32:30.498195887 CEST	49168	443	192.168.2.22	213.183.76.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 16:32:17.036381960 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:17.076277971 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:18.839365959 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:18.851174116 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:18.853276968 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:18.868464947 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:24.385238886 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:24.392152071 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:24.393754005 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:24.401473045 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:25.900036097 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:25.907402992 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 4, 2024 16:32:25.908814907 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 4, 2024 16:32:25.916390896 CEST	53	49881	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 16:32:17.036381960 CEST	192.168.2.22	8.8.8.8	0xebec	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.839365959 CEST	192.168.2.22	8.8.8.8	0x5258	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.853276968 CEST	192.168.2.22	8.8.8.8	0x313d	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.385238886 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.393754005 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.900036097 CEST	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.908814907 CEST	192.168.2.22	8.8.8.8	0x9c5b	Standard query (0)	stylite.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 16:32:17.076277971 CEST	8.8.8.8	192.168.2.22	0xebec	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:17.076277971 CEST	8.8.8.8	192.168.2.22	0xebec	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.851174116 CEST	8.8.8.8	192.168.2.22	0x5258	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.851174116 CEST	8.8.8.8	192.168.2.22	0x5258	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.868464947 CEST	8.8.8.8	192.168.2.22	0x313d	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:18.868464947 CEST	8.8.8.8	192.168.2.22	0x313d	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.392152071 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.392152071 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.401473045 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:24.401473045 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.907402992 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.907402992 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.916390896 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	stylite.io	213.183.76.21	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:32:25.916390896 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	stylite.io	213.183.76.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

stylite.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	213.183.76.22	443	3520	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:18 UTC	132	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: stylite.io Content-Length: 0 Connection: Keep-Alive
2024-10-04 14:32:18 UTC	408	IN	HTTP/1.1 200 OK Allow: GET,HEAD Content-Length: 8 Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:18 GMT Etag: W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Connection: close
2024-10-04 14:32:18 UTC	8	IN	Data Raw: 47 45 54 2c 48 45 41 44 Data Ascii: GET,HEAD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	213.183.76.21	443	3520	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:19 UTC	115	OUT	HEAD /G2eK HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: stylite.io
2024-10-04 14:32:20 UTC	397	IN	HTTP/1.1 301 Moved Permanently Content-Length: 38 Content-Type: text/plain; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:19 GMT Location: /404 Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49163	213.183.76.21	443	3520	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:20 UTC	114	OUT	HEAD /404 HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: stylite.io
2024-10-04 14:32:21 UTC	448	IN	HTTP/1.1 404 Not Found Content-Length: 4645 Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:21 GMT Etag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8" Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Powered-By: Next.js X-Xss-Protection: 1; mode=block Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49164	213.183.76.22	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:25 UTC	127	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: stylite.io
2024-10-04 14:32:25 UTC	408	IN	HTTP/1.1 200 OK Allow: GET,HEAD Content-Length: 8 Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:25 GMT Etag: W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Connection: close
2024-10-04 14:32:25 UTC	8	IN	Data Raw: 47 45 54 2c 48 45 41 44 Data Ascii: GET,HEAD

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49165	213.183.76.21	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:26 UTC	157	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 73 74 79 6c 69 74 65 2e 69 6f 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: stylite.io
2024-10-04 14:32:27 UTC	404	IN	HTTP/1.1 404 Not Found Content-Length: 144 Content-Security-Policy: default-src 'none' Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:26 GMT Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Connection: close
2024-10-04 14:32:27 UTC	144	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.22	49166	213.183.76.21	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:27 UTC	157	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 73 74 79 6c 69 74 65 2e 69 6f 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: stylite.io
2024-10-04 14:32:28 UTC	404	IN	HTTP/1.1 404 Not Found Content-Length: 144 Content-Security-Policy: default-src 'none' Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:28 GMT Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Connection: close
2024-10-04 14:32:28 UTC	144	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49167	213.183.76.22	443	3520	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:29 UTC	345	OUT	GET /G2eK HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: stylite.io Connection: Keep-Alive
2024-10-04 14:32:29 UTC	385	IN	HTTP/1.1 301 Moved Permanently Content-Length: 38 Content-Type: text/plain; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:29 GMT Location: /404 Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Connection: close
2024-10-04 14:32:29 UTC	38	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 34 30 34 Data Ascii: Moved Permanently. Redirecting to /404

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49168	213.183.76.22	443	3520	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:32:30 UTC	344	OUT	GET /404 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: stylite.io Connection: Keep-Alive
2024-10-04 14:32:30 UTC	442	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Date: Fri, 04 Oct 2024 14:32:30 GMT Etag: "1225-4lR+8o8+z0M1Iq6OMuNgxAtPjT8" Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Powered-By: Next.js X-Xss-Protection: 0 Connection: close Transfer-Encoding: chunked
2024-10-04 14:32:30 UTC	2372	IN	Data Raw: 31 32 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 75 6e 64 65 66 69 6e 65 64 20 69 73 20 61 20 66 72 65 65 20 61 6e 64 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 55 52 4c 20 73 68 6f 72 74 65 6e 65 72 20 77 69 74 68 20 63 75 73 74 6f 6d 20 64 6f 6d 61 Data Ascii: 1225<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/><meta name="description" content="undefined is a free and open source URL shortener with custom doma
2024-10-04 14:32:30 UTC	1724	IN	Data Raw: 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 32 30 36 2c 20 31 32 25 2c 20 39 35 25 29 3b 66 6f 6e 74 3a 31 36 70 78 2f 31 2e 34 35 20 26 71 75 6f 74 3b 4e 75 6e 69 74 6f 26 71 75 6f 74 3b 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 63 6f 6c 6f 72 3a 68 73 6c 28 32 30 30 2c 20 33 35 25 2c 20 32 35 25 29 22 3e 3c 64 69 76 20 69 64 3d 22 5f 5f 6e 65 78 74 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 52 6f 62 6f 74 6f 2c 20 26 71 75 6f 74 3b 53 65 67 6f 65 20 Data Ascii: gin:0;background-color:hsl(206, 12%, 95%);font:16px/1.45 "Nunito", sans-serif;overflow-x:hidden;color:hsl(200, 35%, 25%)"><div id="__next"><div style="color:#000;background:#fff;font-family:-apple-system, BlinkMacSystemFont, Roboto, "Segoe
2024-10-04 14:32:30 UTC	557	IN	Data Raw: 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 66 72 61 6d 65 77 6f 72 6b 2e 62 32 65 63 33 32 36 37 31 37 37 33 66 65 32 33 33 33 63 30 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 63 6f 6d 6d 6f 6e 73 2e 63 66 31 62 65 33 31 34 65 62 31 35 65 30 62 38 61 66 64 63 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 38 36 38 64 32 62 37 36 34 33 61 66 62 33 38 61 63 33 34 65 37 33 32 38 35 31 36 38 31 34 39 32 66 32 63 64 32 35 34 30 2e 37 64 37 61 32 30 61 37 30 30 Data Ascii: cript src="/_next/static/chunks/framework.b2ec32671773fe2333c0.js" async=""></script><script src="/_next/static/chunks/commons.cf1be314eb15e0b8afdc.js" async=""></script><script src="/_next/static/chunks/868d2b7643afb38ac34e732851681492f2cd2540.7d7a20a700

Target ID:	1
Start time:	10:32:06
Start date:	04/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f4c0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-070-2024 EXW.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1DB59C6B.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5345CD92.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0410895.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D9F34C1E-4854-4139-A8B6-41A439905E70}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{537E1DDC-F469-4035-8F88-E4CF06BBC501}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C5D7766F-BCC3-4F8D-B0D1-2EF8DB43D0A9}.tmp

C:\Users\user\AppData\Local\Temp\{7651D4AF-37E3-48AB-BBA3-80AEFB43EF85}

C:\Users\user\AppData\Local\Temp\{9C827400-DDDB-4AEC-9921-0C9EAC1257D8}

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO-070-2024 EXW.LNK

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\Desktop\PO-070-2024 EXW.docx (copy)

C:\Users\user\Desktop\~$-070-2024 EXW.docx

C:\Users\user\Desktop\~WRD0000.tmp

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Static File Info

General

File Icon

Static OLE Info

General

OLE File "PO-070-2024 EXW.docx"

Indicators

Summary

Document Summary

Streams

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 50644

General

Windows Analysis Report
PO-070-2024 EXW.docx