153d0278268d1ba4248fcc47b93d6098c023c22ae0148e570e5f97810ae1dc4a

General

Target

180421 PDA Request for Quotation.doc
Size

295KB
MD5

dbecba4a6211aba561e0d36f9db4b1d2
SHA1

f808acedb937fcf07cd2b2c801a84cf290272b65
SHA256

153d0278268d1ba4248fcc47b93d6098c023c22ae0148e570e5f97810ae1dc4a
SHA512

a3217a7c1b41cbf262c3b31e296244abb602a5fede6b402efde3f949df65ac29fea3a316b1ef7ebd6e6c121ff0a959129b62569261a15db895500e81fe0d693e

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

FLTLDR.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2200	800	FLTLDR.EXE	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 10 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1d9e	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\MAPPINGS\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285\CHILDREN	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285\Moniker = "oice_16_974fa576_32c1d314_1d9e"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1d9e\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\OICE_16_974FA576_32C1D314_1D9E\CHILDREN	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1d9e	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1454448119-3012562400-3006674066-3999691987-3827213251-3157489193-2668191285\DisplayName = "OICE_16_974FA576_32C1D314_1D9E"	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{3A2D66F6-04EA-49BA-BEDC-55D6F4D183E2}\Abctfhghgdghgh‹.scT:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

800 WINWORD.EXE
800 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE
800	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description pid process target process

PID 800 wrote to memory of 2200 800 WINWORD.EXE FLTLDR.EXE
PID 800 wrote to memory of 2200 800 WINWORD.EXE FLTLDR.EXE

description	pid	process	target process
PID 800 wrote to memory of 2200	800	WINWORD.EXE	FLTLDR.EXE
PID 800 wrote to memory of 2200	800	WINWORD.EXE	FLTLDR.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\180421 PDA Request for Quotation.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
2⤵
- Process spawned unexpected child process
PID:2200

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_1d9e\AC\Temp\FLB106.tmp
MD5
781004586f3c935817bf63d3e6929900

SHA1
94b9fda5e0874c1e985da5f507771807dd4926e0

SHA256
047be765c0e73c25341de9f00c34984cd5015a5593e8f2b95b75d6744013e04e

SHA512
61c8be5446bb06ff49ce98a1512d4b77ac13c6bae353fba7be88df7bde255b3e4176d157612abeaf98174f1a6ca68516d0911be014ede085c18da04e2c951625

Download Submit
memory/800-114-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download
memory/800-115-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download
memory/800-116-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download
memory/800-117-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download
memory/800-118-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download
memory/800-119-0x00007FFB9CE30000-0x00007FFB9F953000-memory.dmp

Filesize
43.1MB

Download
memory/800-122-0x00007FFB98300000-0x00007FFB993EE000-memory.dmp

Filesize
16.9MB

Download
memory/800-123-0x00007FFB95D10000-0x00007FFB97C05000-memory.dmp

Filesize
31.0MB

Download
memory/2200-179-0x0000000000000000-mapping.dmp

Download
memory/2200-181-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads