Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941.rtf
Resource
win10v2004-20220812-en
General
-
Target
8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941.rtf
-
Size
447KB
-
MD5
9eb2158d227eff7fc4a332bb82f0cd90
-
SHA1
b00650953c80493ff396ce0b20c59929b898e941
-
SHA256
8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941
-
SHA512
7fe51c8c873f448ff00197e1e2208be733fae246095438aa0e953c7cc8dac82e59d9f6ea6faaad36c3f6752a9b08f0aeac51931e04732e31d4353685a3829b04
-
SSDEEP
6144:qaEwDKFznFIzXFUc4crsdYIaAeM3pQw7RUejwJHYmbEbkO98uaFDFLSVh/rnH:vtScbEbkLDxSVVrH
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
FLTLDR.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4136 2672 FLTLDR.EXE WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 10 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1458 WINWORD.EXE Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1458\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1458 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460 WINWORD.EXE Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460\DisplayName = "OICE_16_974FA576_32C1D314_1458" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460\Moniker = "oice_16_974fa576_32c1d314_1458" WINWORD.EXE Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1458\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-27934063-2200865700-65708438-1407198444-2321903328-487339318-438654460\Children WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2672 WINWORD.EXE 2672 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WINWORD.EXEpid process 2672 WINWORD.EXE 2672 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
Processes:
WINWORD.EXEpid process 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE 2672 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 2672 wrote to memory of 3944 2672 WINWORD.EXE splwow64.exe PID 2672 wrote to memory of 3944 2672 WINWORD.EXE splwow64.exe PID 2672 wrote to memory of 4136 2672 WINWORD.EXE FLTLDR.EXE PID 2672 wrote to memory of 4136 2672 WINWORD.EXE FLTLDR.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_1458\AC\Temp\FLC289.tmpFilesize
25KB
MD5d8a8176ab9e7504d6af2b7216cc6ad1d
SHA1d440f698fd666e11502635bf91ab8a8be3376ccc
SHA256dca454b88ece53b28d84fe6492a94a0b93c91be840d647e2a645fe5f4b8e1f39
SHA512730a10fc2b176c0be3987e7e4321819e454c18d8c0d8ba455d90551bf0f1e29cb5f329e6c245c598196965bacc438a29f6944772fb6ac3755b36e00e6b69c7fc
-
memory/2672-138-0x00007FFFBAAF0000-0x00007FFFBAB00000-memory.dmpFilesize
64KB
-
memory/2672-134-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-135-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-136-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-137-0x00007FFFBAAF0000-0x00007FFFBAB00000-memory.dmpFilesize
64KB
-
memory/2672-133-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-132-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-151-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-148-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-149-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/2672-150-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/3944-139-0x0000000000000000-mapping.dmp
-
memory/4136-140-0x0000000000000000-mapping.dmp
-
memory/4136-145-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4136-144-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4136-142-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB
-
memory/4136-143-0x00007FFFBCD90000-0x00007FFFBCDA0000-memory.dmpFilesize
64KB