1d0f4b56524f0e8aa3813ae9f2cdbf5a272167e28f11c3822c95d415347e5ba1

General

Target

SecuriteInfo.com.Troj.XMLDwn-AS.10120.0.rtf
Size

813KB
MD5

03d11e6b979a69b7ebda725436ab236e
SHA1

98ff07105b6e3972f79d9ad872730a2a7da1063d
SHA256

1d0f4b56524f0e8aa3813ae9f2cdbf5a272167e28f11c3822c95d415347e5ba1
SHA512

99a88a180fc52a3f21d68f12d933ec32fedcbe45243a886c9448150a690d4b660ff8385c0c94290c392f37a6defc0cb54da7fe82a61eb8e0f522602591d02e70

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

FLTLDR.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1908	1192	FLTLDR.EXE	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 10 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838\DisplayName = "OICE_16_974FA576_32C1D314_250C"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_250c	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_250c\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_250c	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838\Moniker = "oice_16_974fa576_32c1d314_250c"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_250c\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3918493041-3906361109-514038002-249930727-1766091967-3918423576-1761779838	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{53ED7889-2318-4E2F-8F9F-3BC2F4C9F008}\AbctfhghgdghghŠ.scT:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1192 WINWORD.EXE
1192 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE
1192 WINWORD.EXE

pid	process
1192	WINWORD.EXE
1192	WINWORD.EXE

pid	process
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1192 wrote to memory of 1908	1192	WINWORD.EXE	FLTLDR.EXE
PID 1192 wrote to memory of 1908	1192	WINWORD.EXE	FLTLDR.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.XMLDwn-AS.10120.0.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
2⤵
- Process spawned unexpected child process
PID:1908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_250c\AC\Temp\FL8AC1.tmp
MD5
2939ebd993747d6725257102b96aac0b

SHA1
cf222163f5220c4af74dcbb8eb2c64b0ac31a15a

SHA256
a75e2ab79a749699de62856f22971ed3a10ac5d8dd70c938884cdeb3b4470a41

SHA512
364c07961011eb9205bb8c86f6e71137534d50c687d289c4fe0ea33cab530d662cf47ce09e3d0001af83c333b938422ac4ee76d75ced1a905461b76f5f1daef1

Download Submit
memory/1192-2-0x00007FFC68A60000-0x00007FFC69097000-memory.dmp

Filesize
6.2MB

Download
memory/1192-3-0x000002552EE90000-0x000002552EE94000-memory.dmp

Filesize
16KB

Download
memory/1908-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads