Edit tour

Windows Analysis Report
3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml

Overview

General Information

Sample name:	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml
Analysis ID:	1562426
MD5:	fcec9d80a1e0c4639171d7612f86ca09
SHA1:	86758b446d54d5ae5fba0236c148ed76c50632b5
SHA256:	450221ee3d9144ca03e1058d3ba0e5ad09b4153341676089db9e244662b89800
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Yara detected HtmlPhish76

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6700 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7060 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "496BE3B6-8479-41AD-AF7D-1A26DD97CC50" "A8FBB843-CAE4-4912-9BC0-F8ECDAF420E9" "6700" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

WINWORD.EXE (PID: 4344 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\Annual_Q4_Benefits__Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

WINWORD.EXE (PID: 7052 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 2860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tenereteam.digidip.net/visit?url=https%3A%2F%2FxdP13PKDCfEsnI6bBHcPFlz3UHVI22unRAv.organizar.arq.br/viramasterigbv/ciekiwktie/zuicoerreatro/Huidwqoplk/MnEfke/ZWQucmlsZXlAbWFpbG9ubGluZS5jby51aw== MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1940,i,13627551089869948691,14086840562024761288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.1.pages.csv	JoeSecurity_HtmlPhish_76	Yara detected HtmlPhish_76	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6700, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6700, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 49698, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 6700, Protocol: tcp, SourceIp: 52.113.195.132, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Yara detected HtmlPhish76

Source: Yara match

File source: 1.1.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 4

Joe Sandbox AI: Screenshot id: 4 contains QR code

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: Highly suspicious sender email domain '720901.com' and obfuscated sender name. Subject line contains random characters and appears deliberately obscured. Attachment name suggests bait related to benefits/bonus but uses suspicious encoding

Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk

HTTP Parser: Number of links: 0

Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk

HTTP Parser: Base64 decoded: function gv() {var vrs = {};var ps = window.location.href.replace(/[?&]+([^=&]+)=([^&]*)/gi, function(m, key, value) {vrs[key] = value;});return vrs;}let cfg = gv()['cfg'];if (typeof cfg === 'undefined'){cfg ...

Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk	HTTP Parser: No <meta name="author".. found
Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk	HTTP Parser: No <meta name="author".. found

Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk	HTTP Parser: No <meta name="copyright".. found
Source: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.113.195.132:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.16:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.6:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.113.195.132:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.6:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.6:443 -> 192.168.2.16:49717 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.52.182.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: tenereteam.digidip.net
Source: global traffic	DNS traffic detected: DNS query: xdp13pkdcfesni6bbhcpflz3uhvi22unrav.organizar.arq.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dentistabarato.com.br
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bc1qlpk73pgj3dz02nq8d9kpdxk.org
Source: global traffic	DNS traffic detected: DNS query: bc1qhz8w6mdv0ty33gusmsuvvqr.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "496BE3B6-8479-41AD-AF7D-1A26DD97CC50" "A8FBB843-CAE4-4912-9BC0-F8ECDAF420E9" "6700" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\Annual_Q4_Benefits__Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: unknown unknown
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tenereteam.digidip.net/visit?url=https%3A%2F%2FxdP13PKDCfEsnI6bBHcPFlz3UHVI22unRAv.organizar.arq.br/viramasterigbv/ciekiwktie/zuicoerreatro/Huidwqoplk/MnEfke/ZWQucmlsZXlAbWFpbG9ubGluZS5jby51aw==
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1940,i,13627551089869948691,14086840562024761288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\Annual_Q4_Benefits__Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" /Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1940,i,13627551089869948691,14086840562024761288,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
tenereteam.digidip.net	18.158.211.73	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
dentistabarato.com.br	177.234.150.226	true	false	unknown
xdp13pkdcfesni6bbhcpflz3uhvi22unrav.organizar.arq.br	108.179.192.137	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
sni1gl.wpc.upsiloncdn.net	152.199.21.175	true	false	high
s-0005.s-dc-msedge.net	52.113.195.132	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	142.250.181.68	true	false	high
bc1qlpk73pgj3dz02nq8d9kpdxk.org	154.216.17.193	true	false	high
bc1qhz8w6mdv0ty33gusmsuvvqr.com	104.21.7.73	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
177.234.150.226	dentistabarato.com.br	Brazil	33182	DIMENOCUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.89.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.158.211.73	tenereteam.digidip.net	United States	16509	AMAZON-02US	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
23.218.208.109	unknown	United States	6453	AS6453US	false
154.216.17.193	bc1qlpk73pgj3dz02nq8d9kpdxk.org	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
104.21.7.73	bc1qhz8w6mdv0ty33gusmsuvvqr.com	United States	13335	CLOUDFLARENETUS	false
52.109.89.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
23.32.239.32	unknown	United States	2828	XO-AS15US	false
2.19.198.9	unknown	European Union	16625	AKAMAI-ASUS	false
172.67.129.248	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
95.101.110.24	unknown	European Union	12956	TELEFONICATELXIUSES	false
52.109.68.130	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
52.113.195.132	s-0005.s-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.179.192.137	xdp13pkdcfesni6bbhcpflz3uhvi22unrav.organizar.arq.br	United States	46606	UNIFIEDLAYER-AS-1US	false
152.199.21.175	sni1gl.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
172.217.17.74	unknown	United States	15169	GOOGLEUS	false
52.168.117.169	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562426
Start date and time:	2024-11-25 15:24:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml
Detection:	MAL
Classification:	mal64.phis.winEML@24/193@32/79
Cookbook Comments:	Found application associated with file extension: .eml

Input	Output
URL: email Model: Joe Sandbox AI	{ "explanation": [ "Highly suspicious sender email domain '720901.com' and obfuscated sender name", "Subject line contains random characters and appears deliberately obscured", "Attachment name suggests bait related to benefits/bonus but uses suspicious encoding" ], "phishing": true, "confidence": 9, "generated_by_ai": false }
{ "date": "Thu, 21 Nov 2024 20:01:22 +0900", "subject": "hk djtnt Rd! Rv nd r nft/n fr nn tvt 4th Qrtr - RhkFR9j==", "communications": [ "External Sender~~\n\n" ], "from": "\"R/r R. \|gt d RhkFR9 =\" <kuma@720901.com>", "to": "ed.riley@mailonline.co.uk", "attachements": [ "Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx" ] }
URL: https://dentistabarato.com.br Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://dentistabarato.com.br
URL: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Enter password" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter password", "prominent_button_name": "Sign in", "text_input_field_labels": [ "Your account or password is incorrect. If you don't remember your password, reset it now." ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk Model: Joe Sandbox AI	{ "brands": [ "DMGT" ] }
	{ "brands": [ "DMGT" ] }
URL: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk Model: Joe Sandbox AI	{ "brands": [ "DMGT" ] }
	{ "brands": [ "DMGT" ] }
URL: https://dentistabarato.com.br/wp-inlcudes/frsedfk/fdsadfghyth/?cfg=ed.riley@mailonline.co.uk Model: Joe Sandbox AI	```json{ "legit_domain": "unknown", "classification": "unknown", "reasons": [ "The brand 'DMGT' is not commonly associated with the URL 'dentistabarato.com.br'.", "The URL 'dentistabarato.com.br' does not match any known domain associated with 'DMGT'.", "The domain 'dentistabarato.com.br' appears to be related to dental services, which does not align with the brand 'DMGT'.", "The presence of a password input field on a site that does not clearly match the brand or purpose raises suspicion.", "The URL does not contain any obvious misspellings or unusual characters, but the brand association is unclear." ], "riskscore": 8}
URL: dentistabarato.com.br Brands: DMGT Input Fields: Enter password
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Word found unreadable content in 'Annual_Q4_Benefits_Bonus_form.docx'. Do you want to recover the contents of this document? If you trust the source of this document, click Yes.", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Access your secure document by scanning the QR code below with your smartphone. This will take you directly to the document review page.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": true }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Mailonline" ] }
	{ "brands": [ "Mailonline" ] }

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.395253788199922
Encrypted:	false
SSDEEP:
MD5:	CB3E349AC9544AA8AC22630CECD54CC9
SHA1:	FA860D27BF4B9E08A33390F39537DBC2348FE35E
SHA-256:	84E1290E0F72F2FCED1FB6DBDAE3073FFD93DA165901054E0FAF1D59C564BF3C
SHA-512:	DB33705F6A9982F5047377F77B7E5B1BEFBF435FD1BAFCC71B8B28E4F1D81505E84EE51765E9C07DA56CEDB38F4F502CA08F3B641D7BBB72510135E99810AC0D
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..u..E?......SM01X...,... E..E?..........IPM.Activity...........h...............h............H..h4.......GR.....h............H..h\cal ...pDat...h.t..0..........hwP............h........_`Rk...h.Q.@...I.lw...h....H...8.Wk...0....T...............d.........2h...............k8.;.....7.3...!h.............. h.LL...........#h....8.........$h........8....."h..............'h..9...........1hwP.<.........0h....4....Wk../h....h.....WkH..h.9..p...4.....-h ............+h.W....(................... ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 13:25:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9856824696436357
Encrypted:	false
SSDEEP:
MD5:	1C12105C9290B0A56A666C5CCD64F8CA
SHA1:	C642363B7083F1DAE8BFA6D8219CAC3B541B4556
SHA-256:	5CD3B7B31D4381DAC0F150C6A46798C042A7BE8A5773B3E0FDBEDFC99B07F772
SHA-512:	D5F1B17B0E16656B570CAB21D7C6EAAD865B30AD87E014DE9299F1AE548C9948E433FB01C4BA8E43B8E60F7C01E11109294818CCAFDB1C3016648FDD559519FE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....."..E?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyY.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY#s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY#s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY#s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY$s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (377), with CRLF, CR line terminators
Entropy (8bit):	6.054513143697263
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml
File size:	138'955 bytes
MD5:	fcec9d80a1e0c4639171d7612f86ca09
SHA1:	86758b446d54d5ae5fba0236c148ed76c50632b5
SHA256:	450221ee3d9144ca03e1058d3ba0e5ad09b4153341676089db9e244662b89800
SHA512:	936d4230970add69bc2f16ee45662d0cba72a764ce6d66cdaf47e11a6eedd25bfc4c6f0db5a679d16e25b95b8e8ed7dfac114e3d919654b7fb0c9951a896b475
SSDEEP:	1536:8LukB/XhA4Ebj+1oZjwgZWv7cnbVBRkvVwb497LaOHuwK9WMadEmWy619fBhvejb:8CkuQoZVZWzcnbydpa4wdaMNddK
TLSH:	8BD36934210218E2B14B597EC812A163CD28E1123F932DE617D741B9BF9ACE779EB4DD
File Content Preview:	Received: from DB9PR05MB10374.eurprd05.prod.outlook.com (2603:10a6:10:463::22).. by HE1PR0502MB3643.eurprd05.prod.outlook.com with HTTPS; Thu, 21 Nov 2024.. 11:07:07 +0000..Received: from AM0PR10CA0051.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:150::31).. b

Subject:	hk djtnt Rd! Rv nd r nft/n fr nn tvt 4th Qrtr - RhkFR9j==
From:	"R/r R. \|gt d RhkFR9 =" <kuma@720901.com>
To:	ed.riley@mailonline.co.uk
Cc:
BCC:
Date:	Thu, 21 Nov 2024 20:01:22 +0900
Communications:	External Sender~~
Attachments:	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx

Key	Value
Received	from unknown (HELO ?100.64.100.6?) (kyodo-c@ao-re.jp@50.114.45.161) by 0 with SMTP; 21 Nov 2024 20:01:20 +0900
Authentication-Results	spf=pass (sender IP is 150.60.232.67) smtp.mailfrom=720901.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=720901.com;compauth=pass reason=109
Received-SPF	Pass (protection.outlook.com: domain of 720901.com designates 150.60.232.67 as permitted sender) receiver=protection.outlook.com; client-ip=150.60.232.67; helo=mta.ham1002.secure.ne.jp; pr=C
From	"R/r R. \|gt d RhkFR9 =" <kuma@720901.com>
To	ed.riley@mailonline.co.uk
Subject	hk djtnt Rd! Rv nd r nft/n fr nn tvt 4th Qrtr - RhkFR9j==
Content-Type	multipart/mixed; boundary="000000000000706x202411p02024"
Message-Id	<20241121110122.05EC1520D1E@mta.ham1002.secure.ne.jp>
Date	Thu, 21 Nov 2024 20:01:22 +0900
Return-Path	kuma@720901.com
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	0f3a4c64-4dc5-4a76-8d41-52d85ca158a5:0
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	AM2PEPF0001C713:EE_\|DB9PR05MB10374:EE_\|HE1PR0502MB3643:EE_
X-MS-Office365-Filtering-Correlation-Id	2f163f3f-c3a0-448e-c7ab-08dd0a1bd758
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-Microsoft-Antispam	BCL:0;ARA:13230040\|12012899012\|5062899012\|3072899012\|2092899012\|41022699024\|8096899003\|95630200002;
X-Forefront-Antispam-Report	CIP:150.60.232.67;CTRY:JP;LANG:el;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta.ham1002.secure.ne.jp;PTR:ham1002.secure.ne.jp;CAT:NONE;SFS:(13230040)(12012899012)(5062899012)(3072899012)(2092899012)(41022699024)(8096899003)(95630200002);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	21 Nov 2024 11:01:24.0730 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	2f163f3f-c3a0-448e-c7ab-08dd0a1bd758
X-MS-Exchange-CrossTenant-Id	0f3a4c64-4dc5-4a76-8d41-52d85ca158a5
X-MS-Exchange-CrossTenant-AuthSource	AM2PEPF0001C713.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DB9PR05MB10374
X-MS-Exchange-Transport-EndToEndLatency	00:05:43.0882067
X-MS-Exchange-Processed-By-BccFoldering	15.20.8158.023
Importance	high
X-Priority	1
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	ihqwcqQHjQHwsqHJeYQK7HOYlAjhN6XnrJ+7/kAB7KTTOGcWIeFZ+yIS0U8nfZiNNbW75Qe4W1tbFQWwO1NbRrWxFD/RtlcNLFVAm0AwpUAC9671mTY/sMksaHDF+eoMezGYLiW1DexD9UKwXdJhYoNXp2MlPzlpscJVBCI1iZDp4lNZVCk8GAyniQzEis3FWMJqV7x7AeHZ+X5xA42hT+17SyBO9IH8kseHfq1F+E/NtcabLmH2Ejl+Xg0uk7+AzY0zQo6OnGu6xIUm5WByrRejWJEav9IdYQyc/P4/B6O31+t5eLXAL6pztQ6G0i5L7yCnZP1+0bkJ+5PjmE1p41DTpvz2Q8mC+SCkgGoHWRGQUKVIeUTvXow/1+FonSFqJOV2doWjX9gTZYI2N+qzsH7RLlfNFxkv+OqEBtbqmVeWh3zhNqjfbIMZGNqWggvbBu9fHqJzwZ90UroCRHNEDoPG6731bdDI5X77koIgjMyffTCE3bARveHMAG6b3tfBqHJu/FLl3tu/+0d2Wj/PkBrQazMY2M8bdxSr+dr74ikUcsLqp0lUgi1lFuWGtQtwGLbkPh6aWu5GtFLburNm43RzQ3mKuXYWmlDXpWR6y0r07AU3qT/DXaLcARkkSduMwAYBCGdyMk1A/PPoeTE/skHe7xWXoqEB35/CBEJ1nCL1GnlZLEzyQpnI0zLBk4lY4qtZesC82cgazeKtIqixFGqrVpIgQOH9GnmRmezaFiXn3SrYHXiU+EVeg2QSW00Ae7rAqIxj3CaWzCvLohoJCHtSJKNGBfCV4MNm3wMGhbQ2RN7yXpy2Pbm+Pz1+RbvoB8wTpM2IYJMs74smgGMFZ8JPyLciuXN2ouCCrhB50eiU27loQRUTTfnRweEVFDgQEe/wP85vFlFgkgJYjrn/KTRypJex1s5vpEv6ScAe7xMWE6yaTPakTB6M/O2zPZafXJF+xqnqTUNODGCqy5YaRDW7reMvxapC1JsIFgOtENvXvex2gvS84soJv1ns8BA7UtMrD/EeUJYAGnIack7xWLrZ6QYb9vdxh4juHLEvck9b/Wffn45fe9DrO9/mPPfzdIvVDzBGE0Gly6u0Jt6fI7PVEbEDLnrqStJylbfnnoADy49QSDyZnTjv8LCcXbqz+fR4irsm71gtyW+QZGtLGu5uEiR/eVbU2wLQVB4/XZQX58YNk3tl7fG383En+4ULkXXaNzy9GuDH7kvf/MYoo0TbFlpn2rd2ipHMCxYWtW0jFEne0lQZbDsS1hjcGY5H1Dcfi4O9QiU/2pGd3p7t62jKCxTpq6PHu6lLfvGEz/m+3Z4oARSTgo2I1iz4HeGyhwrxwTtLxdiCk6nTgA4o3jGTVBx19yYIZVKpRe1gNXVipf3GJf5lpYEM2wubsZPUSZ1/EGwyFGLaPdaCDBGppmzwutWuFkyyRTahaxO4lWqWPXZXZ/UktbPbefMRg2ll2C98XH3/VtmXDqfHLNQzoB2SQlcOzCWWX1jU4yi8GxPzCe3M5lomwaSiC0ENTGQrmfOq/YRd+lwkT7DFRggZbMmp7dFsl/s3Ew6d0dUsYLc56K/Gcs4maGca4dHDnTVpSNFZwMqkqNGORumXGcW23BdEkkNvnOXDEEKac0fjfrwr3lRGroLL7RejGrPmiYJ2xiMzi0pb23/F+i2GeC/E/HMDeSY2ED054PwDVBsGANwGHTwt/jfODeNXJ+yxnph2bYDkT9rsqjj4rKgxL6sVejzfl5BQMMRjdhEHBEzDMfJ/O4dirdJeRqXCcQWz5UA6uYDKaSdZmY8Dda1t3BPrl5YG1KErBzNUTRN//xKgdH3/Vo7MKx8gAfrgIimWqHZxC6JgitHrCPR/STRrPb5cm2JCs4QKgcYkP6ZPST9r+RUtyVIDMLiahywX+UFZ7lTKF0zPtlqaaZ8aUKSVC704zqhenSzW1nm7XMiVABEoIFc=
MIME-Version	1.0

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9B175574-8952-4660-9E60-18844365AA76

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoFA39.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\Annual_Q4_Benefits__Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw (002).docx:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZTGOF43\Annual_Q4_Benefits__Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw.docx

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2c1a\AC\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2c1a\AC\Microsoft\Office\OTele\winword.exe.db-journal

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2c1a\AC\Temp\449A38BA.docx:Zone.Identifier

C:\Users\user\AppData\Local\Packages\oice_16_974fa576_32c1d314_2c1a\AC\Temp\msoFFA9.tmp

C:\Users\user\AppData\Local\Temp\TCD3E8B.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3E8B.tmp\PictureFrame.glox

C:\Users\user\AppData\Local\Temp\TCD3E8D.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3E8D.tmp\InterconnectedBlockProcess.glox

C:\Users\user\AppData\Local\Temp\TCD3E9F.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3E9F.tmp\HexagonRadial.glox

C:\Users\user\AppData\Local\Temp\TCD3EC5.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3EC5.tmp\RadialPictureList.glox

C:\Users\user\AppData\Local\Temp\TCD3EC9.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3EC9.tmp\gostname.xsl

C:\Users\user\AppData\Local\Temp\TCD3ECA.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3ECA.tmp\ThemePictureGrid.glox

C:\Users\user\AppData\Local\Temp\TCD3EDC.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3EDC.tmp\ThemePictureAccent.glox

C:\Users\user\AppData\Local\Temp\TCD3EF1.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD3EF1.tmp\architecture.glox

C:\Users\user\AppData\Local\Temp\TCD3F11.tmp\Content.inf

Windows Analysis Report
3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre