Analysis
-
max time kernel
299s -
max time network
272s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 19:13
Static task
static1
Behavioral task
behavioral1
Sample
7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd.docx
Resource
win10v2004-20240709-en
General
-
Target
7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd.docx
-
Size
905KB
-
MD5
6fa501f6303fefe00c4bcd61f171f8a3
-
SHA1
b4151487cff2c6f01d12d248c360846f433810a2
-
SHA256
7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd
-
SHA512
f38a49948c56902c1ab3b98b94700b59a769e52722d0fcb5bb1a0212d6fb9bad61028de1e9d331a78cc83f5f890b91eb387dd4de202b8cf35fd158e2c32378e4
-
SSDEEP
24576:BeBDheimd2LjEv8dBvdfsDCpqkJJNyhZf:BeOdr8dFtOZf
Malware Config
Signatures
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3996 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3620 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4428 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2128 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4104 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4772 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1876 4868 FLTLDR.EXE 83 Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 648 4868 FLTLDR.EXE 83 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2e5e WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_326c WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838\Moniker = "oice_16_974fa576_32c1d314_1fed" WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838\DisplayName = "OICE_16_974FA576_32C1D314_1FED" WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2e5e WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-177034371-3707442939-1444219325-1101018263-439872561-1154889826-1723090632\Moniker = "oice_16_974fa576_32c1d314_2db3" WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1098192840-1724626829-173293784-2244613847-2060153772-175751425-1617914674 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2465741767-1041698008-2239896071-3701840478-670257635-3731260628-1129288071 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143\DisplayName = "OICE_16_974FA576_32C1D314_3F62" WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_326c WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_326c\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1ae2 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_25db\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-177034371-3707442939-1444219325-1101018263-439872561-1154889826-1723090632\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2db3\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3de9 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-177034371-3707442939-1444219325-1101018263-439872561-1154889826-1723090632 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-177034371-3707442939-1444219325-1101018263-439872561-1154889826-1723090632\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-177034371-3707442939-1444219325-1101018263-439872561-1154889826-1723090632 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f62 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1ae2\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3de9\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2db3 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143\Moniker = "oice_16_974fa576_32c1d314_3f62" WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1098192840-1724626829-173293784-2244613847-2060153772-175751425-1617914674\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_25db WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773\DisplayName = "OICE_16_974FA576_32C1D314_3DE9" WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f62\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1fed\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_326c\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1fed\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1098192840-1724626829-173293784-2244613847-2060153772-175751425-1617914674\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2e5e\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_25db WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434\Moniker = "oice_16_974fa576_32c1d314_326c" WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_1ae2\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-408623329-1271228218-1987827072-3586061433-1902265105-3641709203-3526883543\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773 WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3f62 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-4088316956-2522972089-1306603642-2796451600-176083062-3138916371-575931143 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_3de9\Children WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2e5e\Children WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2465741767-1041698008-2239896071-3701840478-670257635-3731260628-1129288071\Moniker = "oice_16_974fa576_32c1d314_25db" WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2465741767-1041698008-2239896071-3701840478-670257635-3731260628-1129288071\Children WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2465741767-1041698008-2239896071-3701840478-670257635-3731260628-1129288071 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-408623329-1271228218-1987827072-3586061433-1902265105-3641709203-3526883543\DisplayName = "OICE_16_974FA576_32C1D314_2E5E" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1098192840-1724626829-173293784-2244613847-2060153772-175751425-1617914674\Moniker = "oice_16_974fa576_32c1d314_1ae2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-963426468-3989212197-1784635010-3999252651-1386302543-1276965557-3306139773\Moniker = "oice_16_974fa576_32c1d314_3de9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1578668838-4143351286-4284235721-206557621-2205489684-2501244258-4024879434\DisplayName = "OICE_16_974FA576_32C1D314_326C" WINWORD.EXE Key created \Registry\User\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-37452109-630906211-54192586-659780464-635354206-2451060458-3146906838 WINWORD.EXE Key deleted \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_2db3\Children WINWORD.EXE -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\https:\moitt.paknavy-govpk.info\22259257-moitt\file.rtf WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4868 WINWORD.EXE 4868 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeAuditPrivilege 4868 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE 4868 WINWORD.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3996 4868 WINWORD.EXE 87 PID 4868 wrote to memory of 3996 4868 WINWORD.EXE 87 PID 4868 wrote to memory of 3620 4868 WINWORD.EXE 91 PID 4868 wrote to memory of 3620 4868 WINWORD.EXE 91 PID 4868 wrote to memory of 4428 4868 WINWORD.EXE 95 PID 4868 wrote to memory of 4428 4868 WINWORD.EXE 95 PID 4868 wrote to memory of 2128 4868 WINWORD.EXE 96 PID 4868 wrote to memory of 2128 4868 WINWORD.EXE 96 PID 4868 wrote to memory of 4104 4868 WINWORD.EXE 100 PID 4868 wrote to memory of 4104 4868 WINWORD.EXE 100 PID 4868 wrote to memory of 4772 4868 WINWORD.EXE 101 PID 4868 wrote to memory of 4772 4868 WINWORD.EXE 101 PID 4868 wrote to memory of 1876 4868 WINWORD.EXE 102 PID 4868 wrote to memory of 1876 4868 WINWORD.EXE 102 PID 4868 wrote to memory of 648 4868 WINWORD.EXE 103 PID 4868 wrote to memory of 648 4868 WINWORD.EXE 103
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:3996
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:3620
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:4428
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:2128
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:4104
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:4772
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:1876
-
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\JPEGIM32.FLT2⤵
- Process spawned unexpected child process
PID:648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5a471d39c02ee8428702b468c843c62e3
SHA191e6f53c4dce4d7822f120da20a75113e5a7dced
SHA2560c9a8ce9516edb686faf2bee4bd9dc3285207031fe5f2f742accf4a525518d8e
SHA512806dd530ce299b765554bb6ae827506d63b9d8a24294df4e827ca8b808894c2b8845009239f80282f522177de483d95099e74ef797e6f3b15a2b54f92dffc03b
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84