Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf
Resource
win10v2004-20220812-en
General
-
Target
682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf
-
Size
1.2MB
-
MD5
6e752a28a3d4f61fb158099beab88f90
-
SHA1
d8c18216e718401d37a81674d4f4bb95f16742c6
-
SHA256
682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191
-
SHA512
66bad4bab339a255cded95b6a03df4c149c486deceb23c3fd55080b16d48251bc7ad4db5e5e74c95ad46deebbdbb70fa05ee6fa26ae01e56fa9a89d9ad32e1eb
-
SSDEEP
24576:ko+0Kiy8TOWMRIHjVK+v8GhCXjyx5VqJKnMbYbor+CzzGxp:x
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1988 1044 FLTLDR.EXE 81 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896\DisplayName = "OICE_16_974FA576_32C1D314_1AA1" WINWORD.EXE Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1aa1 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1aa1\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1aa1 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896 WINWORD.EXE Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-467127501-3231536288-1690648539-1353842496-3438320807-3953775451-3146523896\Moniker = "oice_16_974fa576_32c1d314_1aa1" WINWORD.EXE Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1aa1\Children WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1044 WINWORD.EXE 1044 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1044 WINWORD.EXE 1044 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE 1044 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 4216 1044 WINWORD.EXE 93 PID 1044 wrote to memory of 4216 1044 WINWORD.EXE 93 PID 1044 wrote to memory of 1988 1044 WINWORD.EXE 94 PID 1044 wrote to memory of 1988 1044 WINWORD.EXE 94
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\682e7f4053a133c8fe08dfede3962d5af96f01dff69a72ac0b0f0ba8afc57191.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4216
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:1988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5d8a8176ab9e7504d6af2b7216cc6ad1d
SHA1d440f698fd666e11502635bf91ab8a8be3376ccc
SHA256dca454b88ece53b28d84fe6492a94a0b93c91be840d647e2a645fe5f4b8e1f39
SHA512730a10fc2b176c0be3987e7e4321819e454c18d8c0d8ba455d90551bf0f1e29cb5f329e6c245c598196965bacc438a29f6944772fb6ac3755b36e00e6b69c7fc