39e6d2cfe42c41a7d571ed30431236b6383b064e1ff0b72757457e9cc4ae46c1

General

Target

Order Details89654.rtf
Size

256KB
MD5

fddce2b3c97faecb1feb8fea47edf53e
SHA1

c5fdcd9c686970724faee24edab87663a16e92eb
SHA256

39e6d2cfe42c41a7d571ed30431236b6383b064e1ff0b72757457e9cc4ae46c1
SHA512

d0dec423bd97ba1e435961e9bb3c8382481b7174e0272785e1b2e04e969d8ba6cacd1a93be2a72d57c325ce2b28c19725ebb86c1b1779ea544eb50ec38acbf27
SSDEEP

1536:iXRiI4pd4t55vRvHv6ImzHNIS5rFwOH3GTlXa3wVbUxZVzFz76mAg5eeVhMDw5ww:i4U5UOzypVzFtr5RDAw5wfY

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	968	3624	FLTLDR.EXE	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_28e8	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_28e8\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_28e8	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287\DisplayName = "OICE_16_974FA576_32C1D314_28E8"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287\Moniker = "oice_16_974fa576_32c1d314_28e8"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_28e8\Children	WINWORD.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1828643796-2856272985-1770186458-2557029883-749527505-3225957216-586818287	WINWORD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{D8BECDF5-4D7D-406C-AB7F-25A29FA31265}\FZdtfhgYgeghDz .scT:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3624	WINWORD.EXE
3624	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE
3624	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 968	3624	WINWORD.EXE	84
PID 3624 wrote to memory of 968	3624	WINWORD.EXE	84

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order Details89654.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
  2⤵
  - Process spawned unexpected child process
  PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_28e8\AC\Temp\FL8590.tmp

Filesize
256KB

MD5
a8839b8473f69cc5a00853de9c28d66f

SHA1
9378dc0bf72dae8dda0ce26b68b896d5f36cb472

SHA256
20459eb710cd02978c8a75ff06c4a2b2cce9c912012f7b1ebfb6a7b65e668b7e

SHA512
7c82df6e75de234bb6e86f4ca5b99ed31d34ea092d03e27ccd0b4c89b5b901a04df9e048a81ea046631a42f3d1ffc0fdce2c7a6d635f9e555508dc7c5d3c1a46

Download Submit
memory/968-144-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/968-143-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/968-142-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/968-141-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/3624-135-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/3624-138-0x00007FFD60880000-0x00007FFD60890000-memory.dmp

Filesize
64KB

Download
memory/3624-137-0x00007FFD60880000-0x00007FFD60890000-memory.dmp

Filesize
64KB

Download
memory/3624-136-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/3624-132-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/3624-133-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download
memory/3624-134-0x00007FFD62AD0000-0x00007FFD62AE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads