2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

max time kernel
151s
max time network
163s
platform
windows10_x64
resource
win10v20210408
submitted
30-07-2021 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf
Size

662KB
MD5

47a5e618c809f1f37bccced9d3536deb
SHA1

da3a6f5851537edffcc29e9bf4282d552090ce6e
SHA256

57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752
SHA512

0d4f429f517b2d2045ef32e3a8e3f86b9a250e7f666398d88409a9a56e2a155baef2decf3c167941cd7da28b503241a6f9553d3ca06094bb965781097cb7a18c

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

FLTLDR.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3644	784	FLTLDR.EXE	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 10 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\MAPPINGS\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502\CHILDREN	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502\Moniker = "oice_16_974fa576_32c1d314_1e11"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1e11	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1e11	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1e11\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\OICE_16_974FA576_32C1D314_1E11\CHILDREN	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502\DisplayName = "OICE_16_974FA576_32C1D314_1E11"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2798741541-1756884518-3467925786-3194416866-1105858778-295669072-3630435502\Children	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{683C9910-647D-49CA-B8ED-A9F2AE771570}\abdtfhghgdghghœ.ScT:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

784 WINWORD.EXE
784 WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description pid process target process

PID 784 wrote to memory of 3644 784 WINWORD.EXE FLTLDR.EXE
PID 784 wrote to memory of 3644 784 WINWORD.EXE FLTLDR.EXE

description	pid	process	target process
PID 784 wrote to memory of 3644	784	WINWORD.EXE	FLTLDR.EXE
PID 784 wrote to memory of 3644	784	WINWORD.EXE	FLTLDR.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
2⤵
- Process spawned unexpected child process
PID:3644

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_1e11\AC\Temp\FLD509.tmp
MD5
263ff32cc8b100ddcef2fede237bdcbb

SHA1
3faab71d14c778b6d7090e508dc68c6fc1a738fe

SHA256
acb51bb46e7b6f5c713c68b63c9193516fae376b7214fb102700d08097ad33e2

SHA512
bde84fc92350935f7e5e4edc15095568bb33463ce427a97d54b28d4873231ee70cfea682aae75f0d50d9ad9bc4bd986bc8a529b71ff3dcbbeb450e48b9b273fe

Download Submit
memory/784-125-0x00007FFDF4780000-0x00007FFDF586E000-memory.dmp

Filesize
16.9MB

Download
memory/784-119-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-120-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-121-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-122-0x00007FFDF8250000-0x00007FFDFAD73000-memory.dmp

Filesize
43.1MB

Download
memory/784-117-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/784-126-0x00007FFDF2250000-0x00007FFDF4145000-memory.dmp

Filesize
31.0MB

Download
memory/784-118-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/3644-363-0x0000000000000000-mapping.dmp

Download
memory/3644-365-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/3644-366-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/3644-367-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/3644-369-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads