Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows10_x64 -
resource
win10-en -
submitted
06-09-2021 11:42
Static task
static1
Behavioral task
behavioral1
Sample
paymen_invoice.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
paymen_invoice.doc
Resource
win10-en
General
-
Target
paymen_invoice.doc
-
Size
340KB
-
MD5
285d05dd2a3a053e5095f09b609fca64
-
SHA1
668f3a6f6fa038bdbcd0e57d32783f37c259469d
-
SHA256
e31f5bfd01e6d5876991d6aae68921b7510090d880d2602ed57032e7d14a9cae
-
SHA512
1db0f843078059020981aba55b5fe40d72ec5cc1aa0903353bde23e28299cfd732435760f80e7423c7b999e64e810090bfbaa2f90609aa426cd79074c655c407
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
FLTLDR.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1796 4688 FLTLDR.EXE WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 10 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \Registry\User\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795\DisplayName = "OICE_16_974FA576_32C1D314_11EB" WINWORD.EXE Key created \Registry\User\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_11eb\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_11eb\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_11eb WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795\Moniker = "oice_16_974fa576_32c1d314_11eb" WINWORD.EXE Key created \Registry\User\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_11eb WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2999783567-2264058475-21098770-740799494-2830717941-1318343047-441730795 WINWORD.EXE -
NTFS ADS 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{70922355-85E2-4456-A90E-A1E0C202428A}\abdtfhghgdghgh.ScT:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4688 WINWORD.EXE 4688 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE 4688 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4688 wrote to memory of 1796 4688 WINWORD.EXE FLTLDR.EXE PID 4688 wrote to memory of 1796 4688 WINWORD.EXE FLTLDR.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\paymen_invoice.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_11eb\AC\Temp\FLB1.tmpMD5
ae720cf66d854deb4ecea0095c029628
SHA13b44dfbafab60de167791c77bf3f614ee0d55835
SHA256511bf1022bab4c800620456e839abb2320e913d6e6ef8f4e093801e6b96d09b8
SHA5121d1e001028c2100a73fff478c39914bb0dc48c584aeed22eed899627851e3d325125a08541d174dbcf2d09c060a2377bcd96c38ddcce075ab7c44a5350773350
-
memory/1796-293-0x0000000000000000-mapping.dmp
-
memory/1796-311-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/1796-304-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/1796-329-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/1796-308-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-119-0x00007FFAC7E90000-0x00007FFACA9B3000-memory.dmpFilesize
43.1MB
-
memory/4688-124-0x00007FFAC0400000-0x00007FFAC22F5000-memory.dmpFilesize
31.0MB
-
memory/4688-123-0x00007FFAC2C50000-0x00007FFAC3D3E000-memory.dmpFilesize
16.9MB
-
memory/4688-118-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-117-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-115-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-116-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-120-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-471-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-472-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-473-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB
-
memory/4688-474-0x00007FFAA7060000-0x00007FFAA7070000-memory.dmpFilesize
64KB