Edit tour

Windows Analysis Report
phish_alert_iocp_v1.4.48 (19).eml

Overview

General Information

Sample name:	phish_alert_iocp_v1.4.48 (19).eml
Analysis ID:	1528479
MD5:	87d182741a2211dc340ba22b94ea0a3e
SHA1:	1b7e0a99537763c1b1a57768338218e8b08ca768
SHA256:	76a8c3dea860c57bd75a372914b0ef1bf60a96463a46171ab532dd4679ba0f50
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6872 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 (19).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "45E6D4BA-5F4E-4862-8731-1813FFDDFF47" "207B9D15-1F5E-4857-9DF0-B8EFF8DEACA4" "6872" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

Acrobat.exe (PID: 4880 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ENIKZ14D\Wiley Receipt 9300207546.PDF" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1564,i,10266607786451334295,11852839139659706369,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6872, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ENIKZ14D\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6872, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.172.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_iocp_v1.4.48 (19).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "45E6D4BA-5F4E-4862-8731-1813FFDDFF47" "207B9D15-1F5E-4857-9DF0-B8EFF8DEACA4" "6872" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "45E6D4BA-5F4E-4862-8731-1813FFDDFF47" "207B9D15-1F5E-4857-9DF0-B8EFF8DEACA4" "6872" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ENIKZ14D\Wiley Receipt 9300207546.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1564,i,10266607786451334295,11852839139659706369,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 44E2D029E60773121D8B4F419935670B
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ENIKZ14D\Wiley Receipt 9300207546.PDF"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1564,i,10266607786451334295,11852839139659706369,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
52.202.204.11	unknown	United States	14618	AMAZON-AESUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
52.109.28.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.217.172.185	unknown	United States	16625	AKAMAI-ASUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
52.109.89.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.69.116.108	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.76.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528479
Start date and time:	2024-10-08 00:08:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	phish_alert_iocp_v1.4.48 (19).eml
Detection:	CLEAN
Classification:	clean1.winEML@21/59@3/116
Cookbook Comments:	Found application associated with file extension: .eml

Input	Output
URL: Email Model: jbxai	{ "brand":["John Wiley & Sons"], "contains_trigger_text":true, "trigger_text":"Attached is your documentation for your most recent transaction with John Wiley & Sons.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "text":"Dear Wiley Customer, Attached is your documentation for your most recent transaction with John Wiley & Sons. Thank you for your business, John Wiley & Sons ** Please do not reply to this email, as we are unable to respond from this address. The contents of this email and any attachments are confidential and intended only for the person or entity to whom it is addressed. If you are not the intended recipient, any use, review, distribution, reproduction or any action taken in reliance upon this message is strictly prohibited. If you received this message in error, please immediately notify the sender and permanently delete all copies of the email and any attachments.", "has_visible_qrcode":false}

URL: PDF document Model: jbxai	{ "brand":["Wiley"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"John Wiley & Sons, Inc. 111 River Street Hoboken, NJ 07030, USA Customer Service: cssupport@wiley.com Date: 07-Oct-2024 Account: Purchase Order: Our Tax ID: Bill to: HR DIRECTOR LARRY THOMPSON HR Director Larry Thompson PO BOX 239 MCMINNVILLE OR 97128-0239 Ship to: First Federal HR Director Larry Thompson 118 NE 3RD ST. McMinnville OR 97128-4902 Description Illinois Bankers Association Digital Product Description:Career Center Advertiser:First Federal Business Stream:Advertising Headline:Corporate Risk Manager - Banking Paid Position:Recruitment Posting Service Period:20241007 20241206 Type:Job post 284711", "has_visible_qrcode":false}

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.18268583982767
Encrypted:	false
SSDEEP:
MD5:	FFC9FE546F4F20097FFE97DF91EFFE95
SHA1:	BF915E4546282EFC11070C5F9F2F0C06C1E6AD05
SHA-256:	C4B8F1DA400A75BA94008A7A4AAB05A0829F8221FAFA16F0CD0C03E218EE7C76
SHA-512:	EA9E4CA5349A1D4E364488AEFDDAD5933AA930646EDB58DD0A4A877DAB88F347A26BE6398849845E2893EC8338A3620BFEF464D9E5602972805C7B6727908950
Malicious:	false
Reputation:	unknown
Preview:	2024/10/07-18:09:34.277 112c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-18:09:34.279 112c Recovering log #3.2024/10/07-18:09:34.279 112c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.384733733956636
Encrypted:	false
SSDEEP:
MD5:	67EBFDA1BACADF5B99C2644D71575081
SHA1:	D800E9718AB8B60B22A976F851CF93D6D7AEC040
SHA-256:	220D1C63A2F89B0C779D41A0C6740C1CE0BB6517A24D9321721DA82A1ADC811B
SHA-512:	1D61E551082C26DBE842490245A50948617D8716B2A30F1581C3ECFFA88DB38D5A661F598F978E0CB2667328E1EA119DC20416E25CD7EC9D0211EA35965E8E18
Malicious:	false
Reputation:	unknown
Preview:	TH02...... .0d..........SM01X...,...`..............IPM.Activity...........h...............h............H..hL........a.....h...........H..h\cal ...pDat...h.mx.0..........h.zBi...........h........_`Pk...h.yBi@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h.Z.(..........#h....8.........$h.......8....."h.I......HH....'h..M...........1h.zBi<.........0h....4....Uk../h....h.....UkH..h....p...L.....-h ............+hZ{Bi....@................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

File type:	RFC 822 mail, ASCII text, with very long lines (352), with CRLF line terminators
Entropy (8bit):	6.107431390297279
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	phish_alert_iocp_v1.4.48 (19).eml
File size:	53'255 bytes
MD5:	87d182741a2211dc340ba22b94ea0a3e
SHA1:	1b7e0a99537763c1b1a57768338218e8b08ca768
SHA256:	76a8c3dea860c57bd75a372914b0ef1bf60a96463a46171ab532dd4679ba0f50
SHA512:	c5b2371fad43b51ea3d211406f22bab92f75af24f8bd8a566bd17aef4df56c6cc15432f9abd0fa01cd6e2f6412570f026dd8e470fab23741373f0870af106bb6
SSDEEP:	768:oXE25J04uO/HERUAfWthlLGA+JKIiFcBss7ayzj1RSFh/LnsMfIzbKZ61WqL+R5E:oU25JPuOcRUFnlLGAX6ZXgLv846
TLSH:	EA335C389E5E0C64E760B19E16EDBCE7D90C7B4F08E38981723A058D17C909B16DE99F
File Content Preview:	Received: from PH7PR22MB5266.namprd22.prod.outlook.com.. (2603:10b6:510:310::21) by SN7PR22MB3885.namprd22.prod.outlook.com with.. HTTPS; Mon, 7 Oct 2024 21:33:05 +0000..ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;.. b=vtKeF7

Subject:	Wiley Receipt: 9300207546
From:	Wiley Customer Service <no-reply@WILEY.COM>
To:	Larry Thompson <lthompson@firstfedweb.com>
Cc:
BCC:
Date:	Mon, 07 Oct 2024 14:30:06 -0700
Communications:	[EXTERNAL EMAIL: Take caution with links and attachments. ] Dear Wiley Customer, Attached is your documentation for your most recent transaction with John Wiley & Sons. Thank you for your business, John Wiley & Sons ** Please do not reply to this email, as we are unable to respond from this address -------------------------------------------------------------------------------------------------------------- The contents of this email and any attachments are confidential and intended only for the person or entity to whom it is addressed. If you are not the intended recipient, any use, review, distribution, reproduction or any action taken in reliance upon this message is strictly prohibited. If you received this message in error, please immediately notify the sender and permanently delete all copies of the email and any attachments. --------------------------------------------------------------------------------------------------------------
Attachments:	Wiley Receipt 9300207546.PDF

Key	Value
Received	Mon, 7 Oct 2024 14:33:06 -0700
ARC-Seal	i=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1728336673; cv=none; b=EOn3XMWWyZ7MP95ku4HuQObQNfmWX//cKvO0r32LI4OWOE33vgUo8RVbix8+ndihRTpQwIZqF8gamCTySoc5WIoerjk2Wv/+tHTdDTuQ8Z0VqRQIMKP9GC888MLWc6sm5BonQWsIqliXk1iG6lWhhmQM9Dh9mHVZbS3kt+c6UlE=
ARC-Message-Signature	i=1; a=rsa-sha256; d=silversky.com; s=silversky-20150623192408; t=1728336673; c=relaxed/simple; bh=iZMTazkdn8wuohNMp9dAhL/FNFKt19E1oNwAdhPkhJw=; h=Date:From:Subject:To; b=Ggt1S1qAc8+ygcbpx3kPZnPB1zv/CKwg7X2znEMjoquUbEosdx43i7vngBrImSQsasN9UgoLiF7+6+tq+HvABYUx9Dl7GB97XeFTER5SqqL2PYorRC4rnDi+xj+msun1d4Lxsx7K4N9kNgIqFhl4kNS5RIxdcX5nobEdHhpKoio=
ARC-Authentication-Results	i=1; gwsin.silversky.com; dmarc=pass policy.dmarc=none header.from=WILEY.COM; dkim=pass header.d=wiley.com; spf=pass smtp.mailfrom=WILEY.COM; arc=none smtp.remote-ip=205.220.166.236
authentication-results	spf=softfail (sender IP is 165.212.64.87) smtp.mailfrom=WILEY.COM; dkim=pass (signature was verified) header.d=wiley.com;dmarc=pass action=none header.from=WILEY.COM;compauth=pass reason=100
received-spf	SoftFail (protection.outlook.com: domain of transitioning WILEY.COM discourages use of 165.212.64.87 as permitted sender)
x-usanet-received	from emd2.mbox.net [165.212.64.9] by gws7.mbox.net via mtad (GIT.BUILD.5.0.3133) with ESMTP id 792CJgVEE2000Ms7; Mon, 07 Oct 2024 21:30:29 -0000
X-USANET-TAP-Score	0
X-USANET-Received	from emd2.mbox.net [165.212.64.9] by gws7.mbox.net via mtad (GIT.BUILD.5.0.3133) with ESMTP id 792CJgVEE2000Ms7; Mon, 07 Oct 2024 21:30:29 -0000
Authentication-Results-Original	ppops.net; spf=softfail smtp.mailfrom=no-reply@WILEY.COM
x-usanet-routed	100 IN-RELAY R:gwsin-int:625
X-USANET-Routed	100 IN-RELAY R:gwsin-int:625
X-USANET-GWS2-Service	gwsdin-tap preclick-never
X-USANET-GWS2-Tenant	firstfedweb.com
X-USANET-GWS2-Tagid	FF1001
X-USANET-GWS2-MailFromDnsResult	DnsFound
X-USANET-GWS2-Security	TLSv1.2;ECDHE-RSA-AES256-GCM-SHA384
x-usanet-source	205.220.166.236 IN no-reply@WILEY.COM mx0a-0053b403.pphosted.com TLS
x-usanet-msgid	XID947CJgVEE5504Xd2
X-BAEAI-Trust-Score	89
X-BAEAI-Trust-Reasons	SNDRAUTH; PRIORITY; SNDRNEW; DOMRARE,wiley.com; RCPTVIP;
dkim-signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=wiley.com; h= content-type:date:from:message-id:mime-version:subject:to; s= 10212020-Select1; bh=iZMTazkdn8wuohNMp9dAhL/FNFKt19E1oNwAdhPkhJw =; b=tkKjdxljyIleELMimVsBVjdDCgQYldHnkOwUpmaG6quj1zsU7rnTVQGNsuc k0brdgfb3Tb0De/SZu1egaSWqd7n/guq0fFKRQ37TY4ssUmk27ra6ErL0P8gCt7Y wylqL3W0GiwRmzH4fyUeqSX5ifo/5uF94RbURIhXiy9Yv447r+58JHNAHC5YkSL2 r0F42Xqc0HKpebxolaIRE46CWv6VZq7FldI3oJE4fprNFt5YW9WoEKyKA4QnBd0D u304n0aKJuoJTpEJ+FPlUzREsKRzT1HTHPUDRbuTMZqsTNQUjuUyEg2O+Eif6WG2 Ji0R3D68kxZZbqSmJAR2/GNKj3A==
Importance	Normal
X-Proofpoint-GUID	PJpb_vh7-96JUYlNjNYkhvpaPxgwTrjN
X-Proofpoint-ORIG-GUID	PJpb_vh7-96JUYlNjNYkhvpaPxgwTrjN
X-Proofpoint-Virus-Version	vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.60.29 definitions=2024-09-06_09,2024-09-06_01,2024-09-02_01
X-Proofpoint-Spam-Details	rule=notspam policy=default score=0 adultscore=0 bulkscore=0 spamscore=0 phishscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2409260000 definitions=main-2410070147
X-Cloudmark-Tracker	v=2.4 cv=SPWJV/vH c=1 sm=1 tr=0 ts=670452f6 cx=a_idp_d a=MB3AYM4z36ju7uCAmL1wtA==:117 a=MB3AYM4z36ju7uCAmL1wtA==:17 a=DAUX931o1VcA:10 a=MJHwTsuriLkA:10 a=g8TUdU_LZmEA:10 a=JJsAEOkpCHsKMv8CqgoA:9 a=CjuIK1q_8ugA:10 a=zgiPjhLxNE0A:10 a=y6GQGeDuo7MZ8d4xboMA:9 a=n3BslyFRqc0A:10 a=rls1ZAiwvL0A:10
X-LASED-Version	Antispam-Engine: 5.1.4, AntispamData: 2024.10.7.210916
X-LASED-SpamProbability	0.085099
X-LASED-Spam	NonSpam
X-LASED-Hits	BODYTEXTP_SIZE_3000_LESS 0.000000, BODY_SIZE_10000_PLUS 0.000000, BODY_SIZE_25K_PLUS 0.000000, DATE_TZ_NA 0.000000, DKIM_ALIGNS 0.000000, DKIM_SIGNATURE 0.000000, FROM_NAME_PHRASE 0.000000, HTML_00_01 0.050000, HTML_00_10 0.050000, HTML_ATTACHED_NEG 0.000000, INVOICE_ATTACHMENT 0.100000, KNOWN_MTA_TFX 0.000000, MAY_BE_FORGED 0.000000, MULTIPLE_ATTACHMENTS 0.000000, NO_CTA_URI_FOUND 0.000000, NO_URI_FOUND 0.000000, NO_URI_HTTPS 0.000000, PDF_ATTACHED 0.000000, PDF_ATTACHED_1 0.000000, PHISH_TRUSTED_RDNS 0.000000, SENDER_NO_AUTH 0.000000, SUPERLONG_LINE 0.050000, SUSP_DH_NEG 0.000000, SXL_IP_TFX_WM 0.000000, TRANSACTIONAL 0.000000, X_PRIORITY_HIGH 0.000000, __ATTACHMENT_NOT_IMG 0.000000, __ATTACHMENT_PHRASE 0.000000, __ATTACHMENT_SIZE_25_50K 0.000000, __ATTACH_CTE_BASE64 0.000000, __ATTACH_CTE_QUOTED_PRINTABLE 0.000000, __BODY_NO_MAILTO 0.000000, __CT 0.000000, __CTYPE_HAS_BOUNDARY 0.000000, __CTYPE_MULTIPART 0.000000, __CTYPE_MULTIPART_MIXED 0.000000, __DKIM_ALIGNS_1 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FOOTER_DISCLAIMER 0.000000, __FRAUD_INTRO 0.000000, __FRAUD_URGENCY 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FROM_NOREPLY 0.000000, __FUR_HEADER 0.000000, __FUR_RDNS_PROOFPOINT 0.000000, __HAS_ATTACHMENT 0.000000, __HAS_ATTACHMENT1 0.000000, __HAS_ATTACHMENT2 0.000000, __HAS_FROM 0.000000, __HAS_MSGID 0.000000, __HAS_X_MAILER 0.000000, __HAS_X_PRIORITY 0.000000, __HTML_ATTACHED_BOUND_NEG 0.000000, __INVOICE_MULTILINGUAL 0.000000, __MIME_ATTACHMENT_1_N 0.000000, __MIME_ATTACHMENT_N_1 0.000000, __MIME_ATTACHMENT_N_2 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_TEXT_P2 0.000000, __MIME_VERSION 0.000000, __MSGID_32_64_CAPS 0.000000, __NO_HTML_TAG_RAW 0.000000, __PHISH_PHRASE7 0.000000, __PHISH_SPEAR_GREETING 0.000000, __RCVD_FROM_DOMAIN 0.000000, __SANE_MSGID 0.000000, __SEO_WEBSITE 0.000000, __SPEAR_FROM_NAME 0.000000, __STOCK_CRUFT 0.000000, __SUBJ_TRANSACTIONAL 0.000000, __SUBJ_TR_GEN 0.000000, __THANKING_PHRASE 0.000000, __TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_NO_MAILTO 0.000000, __X_PRI_HI 0.000000
X-LASED-Impersonation	False
X-Sophos-Tracker	0.085099 fd4a6c31a6a87697ee53abb7b8e9f5e089d3fa86
X-BAEAI-Source-GeoIP	"US" "N/A" "N/A"
X-BAEAI-SPF	PASS
X-BAEAI-DKIM	PASS
X-BAEAI-DMARC	pass
X-SilverSky-ARC	none
X-BAEAI-Authentication-Rating	strong
X-BAEAI-Trust-Level	green
Return-Path	no-reply@WILEY.COM
X-MS-Exchange-Organization-ExpirationStartTime	07 Oct 2024 21:31:14.4948 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	42efc625-5a76-4169-805e-08dce7175f10
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	3778f0b2-789a-4d43-b25e-d4fe25a4c3c0:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
x-ms-publictraffictype	Email
X-MS-TrafficTypeDiagnostic	BN2PEPF000044A1:EE_\|PH7PR22MB5266:EE_\|SN7PR22MB3885:EE_
x-ms-exchange-organization-authsource	BN2PEPF000044A1.namprd02.prod.outlook.com
x-ms-exchange-organization-authas	Anonymous
X-MS-Office365-Filtering-Correlation-Id	42efc625-5a76-4169-805e-08dce7175f10
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	-1
X-MS-Exchange-Organization-BypassClutter	$true
X-Microsoft-Antispam	BCL:0;ARA:13230040\|12012899012\|2092899012\|5062899012\|3072899012\|82310400026\|3613699012;
x-forefront-antispam-report	CIP:165.212.64.87;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:postin03.mbox.net;PTR:postin03.mbox.net;CAT:NONE;SFS:(13230040)(12012899012)(2092899012)(5062899012)(3072899012)(82310400026)(3613699012);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	07 Oct 2024 21:31:14.2761 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	42efc625-5a76-4169-805e-08dce7175f10
X-MS-Exchange-CrossTenant-Id	3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
X-MS-Exchange-CrossTenant-AuthSource	BN2PEPF000044A1.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	PH7PR22MB5266
X-MS-Exchange-Transport-EndToEndLatency	00:01:51.2519647
X-MS-Exchange-Processed-By-BccFoldering	15.20.8026.020
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	O54nVe1paQSLoeENoTkyBToiGjyxKFXQuhNPYuRb4baejHmvKE1WetbJzlp8Eeeu8yrHmqHz8PCk+aquJ2N7FZEGGJx/lP2P6njvuKuML6kSbxp1iGgpwKMUUF1+sehniIfMzPdWVQsm8pwEDfWVCEL7AQNdVblWhm8Z+UAd5+iGLson1RlgTO1SKcC530+EXnxzn6mOKaekGx2aQ9I8UF05H/UmgElqLIxUFjNluYfaDSdAOzY8RX3WSz3zkLyJCy12ZSHs3ojQ9xNdHG4vmIIhBjoKLGGjFxI8FCflhZ7w7gKtR4YDdEq4n8fm2F7cieZBtDoyhMY1+W6ZXCYk773kkGrRBCnl58qTYNJyQbu1Z8BNpKypGwoJYjoYgnd6uyfOWa8S/6Tom91mkgwhNAYwOKx4gohK+iz6hVUdDcTJ3sFak3WEZcGr6yL6G/3RGvxjbOZwMUCZrjkpFXToLaFw9c6hQ6neiO5X7Lc26J4rRINUlGtP+9WQRd77wRHBYvbwBiyqRoaQkuTEjzexAbmIq1rYWkHxtR4oFDMAzT/ewLKknvduBFv25RfF42WkDiVa3I+K7qsvT5CIeVENAy4PzZLulWnYdmD+NVzCzL11F5wMDRjhOpcC783FNN8qGXuJeutk07N7bPchBbaRmNqVxP5viYSqJY8fj+w3AijnmrTd5qTnIFq4EL3Yd4lcWSFtPFmLUgBTN+lAG98i/LgkD0MCvCf/spJ4DzsTx3mNeTXvgyd1DGYx9U8bxEDQi2qIivJlb2R92FulWEEXiaRnWqWNaM5iEgNCCzG3A57u5Ok/pLUWGLImhxFcsuQzS5lM4yL9XvB0rDIxDGAO49cXtLd2JvRXGkCl/voXZ6AjPhKBAUzdiKfP8Z6O1/PzIIH1bw6s5lyyjkzgeSt8aYLNpHOBUb4Qckl26HbRC9naPBPlhJlxxVUWEX5MFm+dG9SSii0VLm9XrjP96djvUD8jW/9KA/ykargeOEo2r6M1Z2yRXbthB6Itqv2cdurNJhsUX135CWJhPy9s1YyCLe0kOqjy96knWVrCHQy4f+Troearia1uDxB0DG9IXCRb/0xAxsJdTUgbHuzOx+Pf7nyyGbYNXqb4hDdM/+VcGb+7Uu0IzjNwoc2nFyrohATLbs6aH2+QWG4WK9RwyCwiITjmlJcfMi/aD1AMURCEGGarBpTEa8dRkZDzRwJrmoAO4eUsmqBbhYuDI1g7nbeQOkOx76hi3/gQsnZrKbau42TpeHptiVHjJLBeS3zR4bK+md1RoeHrV1dMBDcSypAMl4B4oFflXmejWCYYjW3lF0pbQ8I2YSHBeBzqo4LYn3f0fBXzENn6oGEID/wxBAivGcUja2Mq2CKvXLQazMKR6xCInx4EpNFfyTjt6Vu9mDdlJQUpMGUp5B4vTKIjGK1wgZ2jpKVnGBMZ2Yid6L1AbSuP6hJ4P2E3eQGqcDsMCfrrbQSxKNBq4RJhts03E4NqSWhUu40u5okSYaqJEWXULBjf/+KXueFw1xN/yR3ADAwRCaiC3bSZS6tIY9Yvgvfge+NMDDtCE2GS38Cj6qVz9b1CrPRIloPbQnyveGHUnOqPrPxZKqoF7Z2FtEtww34TBwcLxR2UaUkjwz5EFwMFk3kKaYC82JqksoVj3MYFuDsG28cTVUQDEeTTPSeibSI95DOipQKvERnvseeV7FuxH3hF7jlMZauee+Prc0QIM9K6I5UJ9RaDEXLhYaJtspNB41gmTlvmn8yC9iTthfHmMvmvGOvkrTP5H/aMaKICHv1R1WsESE2CYXAamAiOalnK+O9eWuJ+VYzdGiQCFSyImrvtKvze50XlpXPp+l6cmc1uq9WjMfJAtp0gHtkbYJMr9zboGjyLuCYuqa2J4EhHxj3um26gov1Yt+X08w1hvfz3fPTXdXav6EKQofRxuBbtD4f5/TUy9m8W1bLBzV15dz7f+1gIVZhYFQuaeIuYR3cDDVlbI1W8AhL5VMAxyW+PlrzKN6asuTalcsasowDcW+TvVdN41iNeoqO+OslptRu1VXunWk/WaQwSMseucMyH+wZHc08VjQHw4LDXX5oPDPxETPynGq9fm3xe5HjXkTvnANsMWM9lFjdYxWBoI4KVKosgVwFiTghGyvjtNFshMnu9sF0wm++5lLAGEqXPdjwsRFRH1EA6j1eY7VC6u13xTPRCsNo+uy1NPwPNk75Jztg=
x-ms-exchange-organization-originalclientipaddress	165.212.64.87
x-ms-exchange-organization-originalserveripaddress	10.167.243.152
X-Priority	3
X-MSMail-Priority	Normal
Thread-Index	AQHbGQB+lw7ZsBytfkGLnMgnYRc6Cg==
Message-ID	<ADR49000000760759400005056896FCA1EDFA19E6BE89BF449B8@WILEY.COM>
From	Wiley Customer Service <no-reply@WILEY.COM>
To	Larry Thompson <lthompson@firstfedweb.com>
Subject	Wiley Receipt: 9300207546
Date	Mon, 07 Oct 2024 14:30:06 -0700
MIME-Version	1.0
Content-type	Multipart/mixed; charset="us-ascii"; boundary="00B0FEED_message_boundary"
Content-Description	Multipart message

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phish_alert_iocp_v1.4.48 (19).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\99038087-eac8-458c-b823-1857127c6462.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e619a82-bd3e-46dc-8e0a-c5d31e70c79e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3fcd21.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241007220937Z-165.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1216

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Windows Analysis Report
phish_alert_iocp_v1.4.48 (19).eml

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre