89d4d85592bf0b5e8b55c2d62c9050bfa8c3017f9f497134dbacbb2a0f13a09e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mof-npd-circ20240103.docx
Size

1.6MB
MD5

8202209354ece5c53648c52bdbd064f0
SHA1

683210af38ef15f1bacb67ddc42f085bee05cf35
SHA256

89d4d85592bf0b5e8b55c2d62c9050bfa8c3017f9f497134dbacbb2a0f13a09e
SHA512

df8d1aaf4798541f25797c2928db9c90f03f534f5a326d05e160ae4f293fd0abd68b5e4ac9468da7a6af82a5b6eb2a79395367b2cdb514b57c76e5bb958cb47a
SSDEEP

49152:JJb+67s4Y+WJ9UhMQzTDdwPaQx3fNdK1HAgCclqDhDAy:/f2mhMQ3DEaG3eHAgCclgEy

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

FLTLDR.EXEFLTLDR.EXEFLTLDR.EXEFLTLDR.EXEFLTLDR.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3968	5076	FLTLDR.EXE	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3132	5076	FLTLDR.EXE	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1824	5076	FLTLDR.EXE	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1348	5076	FLTLDR.EXE	WINWORD.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3632	5076	FLTLDR.EXE	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 30 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3089022357-667453316-2938916772-4067754302-2891087373-594883181-952257924\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3425736716-840377540-1747596136-1659102868-3001323485-797945769-1517707699	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2932721281-4123580714-486800523-999901861-1463164423-2221398819-1371171741\DisplayName = "OICE_16_974FA576_32C1D314_8CB"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2225159333-668981489-1778837674-2167024750-2824049580-242041481-3120789713\DisplayName = "OICE_16_974FA576_32C1D314_357D"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2225159333-668981489-1778837674-2167024750-2824049580-242041481-3120789713\Moniker = "oice_16_974fa576_32c1d314_357d"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_357d	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_8cb\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_323e\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3706570926-2332840808-1194410588-368590742-286532082-3383513053-404661924\DisplayName = "OICE_16_974FA576_32C1D314_3C75"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2932721281-4123580714-486800523-999901861-1463164423-2221398819-1371171741\Moniker = "oice_16_974fa576_32c1d314_8cb"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_357d\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3706570926-2332840808-1194410588-368590742-286532082-3383513053-404661924\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3425736716-840377540-1747596136-1659102868-3001323485-797945769-1517707699\DisplayName = "OICE_16_974FA576_32C1D314_30A9"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_30a9\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2932721281-4123580714-486800523-999901861-1463164423-2221398819-1371171741	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3089022357-667453316-2938916772-4067754302-2891087373-594883181-952257924\DisplayName = "OICE_16_974FA576_32C1D314_323E"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2225159333-668981489-1778837674-2167024750-2824049580-242041481-3120789713	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_323e	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3c75	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3c75\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3425736716-840377540-1747596136-1659102868-3001323485-797945769-1517707699\Moniker = "oice_16_974fa576_32c1d314_30a9"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_8cb	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2225159333-668981489-1778837674-2167024750-2824049580-242041481-3120789713\Children	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3089022357-667453316-2938916772-4067754302-2891087373-594883181-952257924\Moniker = "oice_16_974fa576_32c1d314_323e"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3706570926-2332840808-1194410588-368590742-286532082-3383513053-404661924\Moniker = "oice_16_974fa576_32c1d314_3c75"	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3425736716-840377540-1747596136-1659102868-3001323485-797945769-1517707699\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_30a9	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2932721281-4123580714-486800523-999901861-1463164423-2221398819-1371171741\Children	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3089022357-667453316-2938916772-4067754302-2891087373-594883181-952257924	WINWORD.EXE
Key created	\Registry\User\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3706570926-2332840808-1194410588-368590742-286532082-3383513053-404661924	WINWORD.EXE

NTFS ADS 1 IoCs

Processes:

WINWORD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\https:\president-gov-lk.donwloaded.net\a4884a53\file.rtf	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5076 WINWORD.EXE
5076 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 5076 WINWORD.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE
5076 WINWORD.EXE

pid	process
5076	WINWORD.EXE
5076	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	5076	WINWORD.EXE

pid	process
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE
5076	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 5076 wrote to memory of 3968	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 3968	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 1824	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 1824	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 3132	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 3132	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 1348	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 1348	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 3632	5076	WINWORD.EXE	FLTLDR.EXE
PID 5076 wrote to memory of 3632	5076	WINWORD.EXE	FLTLDR.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\mof-npd-circ20240103.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT
2⤵
- Process spawned unexpected child process
PID:3968

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT
2⤵
- Process spawned unexpected child process
PID:3132

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT
2⤵
- Process spawned unexpected child process
PID:1824

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT
2⤵
- Process spawned unexpected child process
PID:1348

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT
2⤵
- Process spawned unexpected child process
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-67-0x00007FF95C910000-0x00007FF95CBD9000-memory.dmp

Filesize
2.8MB

Download
memory/1348-66-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/1348-68-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/1824-44-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/1824-45-0x00007FF95C910000-0x00007FF95CBD9000-memory.dmp

Filesize
2.8MB

Download
memory/1824-46-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3132-53-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3132-52-0x00007FF95C910000-0x00007FF95CBD9000-memory.dmp

Filesize
2.8MB

Download
memory/3132-51-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3632-73-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3632-75-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3632-74-0x00007FF95C910000-0x00007FF95CBD9000-memory.dmp

Filesize
2.8MB

Download
memory/3968-31-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3968-35-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/3968-33-0x00007FF95C910000-0x00007FF95CBD9000-memory.dmp

Filesize
2.8MB

Download
memory/3968-34-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/3968-32-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-18-0x00007FF91CF80000-0x00007FF91CF90000-memory.dmp

Filesize
64KB

Download
memory/5076-16-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-4-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/5076-5-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-6-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/5076-7-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-8-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/5076-10-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-14-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-15-0x00007FF91CF80000-0x00007FF91CF90000-memory.dmp

Filesize
64KB

Download
memory/5076-0-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/5076-3-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-17-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-58-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-59-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-60-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-11-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-13-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-12-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-9-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download
memory/5076-2-0x00007FF91F090000-0x00007FF91F0A0000-memory.dmp

Filesize
64KB

Download
memory/5076-1-0x00007FF95F010000-0x00007FF95F205000-memory.dmp

Filesize
2.0MB

Download