c18bc6e272cd38c813e31957f86aead59ce378171c3ec0b4df1de502b0602482

General

Target

Detailed Check Remittance Information from Henry Schein, Inc.rtf
Size

216KB
MD5

4e30d8835ea27787c2f51e0f5d1e4c66
SHA1

c29a1a5121d39c50bde3b3fd3dbd9895d5435198
SHA256

c18bc6e272cd38c813e31957f86aead59ce378171c3ec0b4df1de502b0602482
SHA512

22ae386327f2bb875bc10ba1c738d4f340368f7c34c645a4dda6b570fa4cbc7faca636e8c771d2d32d291e562de753f7777c3205089d27ab7fe825fba51823fe
SSDEEP

1536:97LuNH5B8eHZbv7bpKsukgw/mUr1n2E+EEiZVzFz76mAg5eeVhMDw5wfL0:9uJVzFtr5RDAw5wfQ

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	812	3680	FLTLDR.EXE	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2cb0	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2cb0\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2cb0	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699\DisplayName = "OICE_16_974FA576_32C1D314_2CB0"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3458083664-2180852377-4197165184-2631865702-1085954171-4191354832-373021699\Moniker = "oice_16_974fa576_32c1d314_2cb0"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2cb0\Children	WINWORD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{A12C66D6-F5C7-4DD1-8EC5-7D4207FA2B53}\DZdtfhgYgeghD{ .scT:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3680	WINWORD.EXE
3680	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE
3680	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 812	3680	WINWORD.EXE	87
PID 3680 wrote to memory of 812	3680	WINWORD.EXE	87

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Detailed Check Remittance Information from Henry Schein, Inc.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
  2⤵
  - Process spawned unexpected child process
  PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_2cb0\AC\Temp\FLBB08.tmp

Filesize
256KB

MD5
cc9a65b8cdde582ad961f371b9d87cd4

SHA1
531cb9e8a5d5ea8e144c55250c802967618bf6ae

SHA256
99bca5a81933c110450dc5f5d17a580e8f6cea917865e85ec8c23d284f59b433

SHA512
36c3307e3267cf8f7224eb84822582ef31999abb42dea1f6892065e10fe143dc6bd7bba5c25689dedfb2803edd24854648a0d762ae7ad54bb44702a6f1207145

Download Submit
memory/812-144-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/812-143-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/812-141-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/812-142-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/3680-135-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/3680-138-0x00007FF9A4260000-0x00007FF9A4270000-memory.dmp

Filesize
64KB

Download
memory/3680-137-0x00007FF9A4260000-0x00007FF9A4270000-memory.dmp

Filesize
64KB

Download
memory/3680-136-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/3680-132-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/3680-134-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download
memory/3680-133-0x00007FF9A63F0000-0x00007FF9A6400000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads