04c3c5cf2f26c10a82444d4f9498557c89a4521331dace6427a1eb035327d605

Analysis

max time kernel
165s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Office_2024_EN_64Bits.exe
Size 3.4MB
Sample260801-pflylaan2t
SHA256 04c3c5cf2f26c10a82444d4f9498557c89a4521331dace6427a1eb035327d605
MD5 79dda55ff521d810eb573385a3d199be
SHA1 35bbd616d043182317254929d436dce01e980203
SHA512 bda342cb122eb8462e1407f33789b8103fdf4b00182512403987fe06f4e34e5ac07d7b6a40291eeb1621e5d75d928b04a1571d1d244e2fc9c8ec40b350ccf27b
SSDEEP 98304:2Eou88dAT+XHnlFmP6spyLFuSvoQJa9TBqB5nbEx5e3t:2LByHnlPVpuZv9Yvb6e3t
TLSH
T10DF53305776504B9D4660AF9813AE950CFBAF013ADF0CC0F73A8529D2E92786E5B2F71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\070447F6-1690-444E-B823-3955F6A38680	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	OfficeClickToRun.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeC2RClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OfficeC2RClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVManifest.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVOrchestration.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVShNotify.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-crt-process-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppvIsvSubsystems64_arm64x.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.cs-cz.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.fr-fr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.nl-nl.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.uk-ua.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\msvcp140.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\OfficeC2RCom.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.pt-br.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVIsvSubsystemController.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\OfficeOEMPlugin.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\officesvcmgr.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\repoman_16.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msix.dll.bak	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVClientIsv.man	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-core-localization-l1-2-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-crt-string-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.ru-ru.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RUI.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dll.bak	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-crt-convert-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppvIsvSubsystems32.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\c2r32werhandler.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.hr-hr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.lv-lv.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.nb-no.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.tr-tr.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\RepoMan.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.id-id.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\ServiceWatcherSchedule.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\vcruntime140_1.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVPolicy.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.en-gb.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\i640.hash	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.es-es.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.zh-tw.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\manageability.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\OfficeClickToRun.exe	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-crt-conio-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVIntegration.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RHeartbeatConfig.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\ClientEventLogMessages.man	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\officesvcmgrschedule.xml	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\c2r64werhandler.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.et-ee.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.kk-kz.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.sr-latn-rs.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\ClientCapabilities.json	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe.bak	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-core-file-l1-2-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\api-ms-win-crt-runtime-l1-1-0.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2R64.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.bg-bg.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.sv-se.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.pl-pl.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\ApiClient.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppVIsvStreamingManager.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\AppvIsvSubsystems64.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\C2RINTL.sk-sk.dll	OfficeClickToRun.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.17932.20884OfficeC2RBAB4AC3F-08AB-4D34-9FBC-84B2920F5FC5\officeinventory.dll	OfficeClickToRun.exe

Executes dropped EXE 4 IoCs

pid	Process
4216	setup.exe
5860	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
2700	OfficeC2RClient.exe

Loads dropped DLL 47 IoCs

pid	Process
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Office_2024_EN_64Bits.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\RemoteClearDate = 0040a7e3a36bc901	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17932&crev=3\0\EndDate = 5060c2ea7822dd01	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17932&crev=3\0\Url = "https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.17932&crev=3"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17932&crev=3	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17932&crev=3\0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000008e287ab644d80a4e825c8de183c2db2200000000020000000000106600000001000020000000c3bc08896d4bc25aaae9bba55bac2a370b2f63fe430e4136424e5b57531b6249000000000e800000000200002000000011ffcaccb9663cbd31d505ca872fa1a82b8b524bd375d640bfbb1b1557bf83f450060000dd97acfd991b2c24b22ae6f7f5c6ccfc26870963ef86debb75bb2e99a93e4978e4eb3aa3f5770650c1c1cc7fa61d19649e072d3a9deec4fceba3ac5bebbeb12b03c006251a8a4286e472e96bbb840d7e3b60d5a3072d5c2de302417875fab89c784021700e5b2edd004ad9ac4922a1db4e6f9d8b9bf1c65faf067a415facec1245c4d145bd80451bf7299b34dcd3097a8ddfa959e54e231c50e04eb90e8126b2c0c29a4a905c16ba5c95c1d0d761b4bf9c71003f91dcbda33acb3502c1d31700b6b93d4c5ec9810f7ded2801cd2003b95a4022ca3cc1e1c3d1123768350a4709c9015a908340b8691acd9156e13cf6b082094c2c37748d5950307e2b4433c26ad7f2df5b8a656346ba2926a4eb156a2e8ed86d77b05dc177774fa96d0252dff79532eda5aa040c44d191a9355bff5b39f83ffbe41f4b3e1b1bf5f7ac53256238e19aa355c0fce39c3dcce83f6677e6460d2905bf31c9cc590319606d6c7ece1477a8ea9f8dca7d27b4d109f535d3be69d8a6c1b039b660d84e3a0ab5f2dcfa06ccd022ee61f073e486862e96bb404c608ddf41cb4147fd819dd8556d3d2384bf34de5e44f2e2f2455a367e886b46c0141b9849407b337657c408fc93606642059b7a1d0d92d05feea06bb367f46a369a2731c09946a211d100a1304b0058ddedf7abb3f8044b28bfb02e2dc7ec6cf942bbcb42dba112d6eb035ef556b57f409bfa2e69657bd0036517bdbe903f2fbba424101a1d2122f1ae4646cefd14b80276c493f2a35a92a178821d75b883df10589044d467338ca8c8daa07e4cb9bf0e917963f052c5384f7749ec8d7680ccfd16994fe96f2a954efcf406749a7e465e98a13059632d1f0a5960e617d84a1f6707e04b9af65dfa97eb21d3b16527821a06df62d2cef27af64536db504d25f15b202acbacba31bd4e13e24698cb5eb9181d084fc9f8c65c9aa5956f8120fd848653b1ef3bd465c69d4a87674554da09ad337382bd8e16af4aa1c92b959dbd82c268273a4ac84b3ee2648963d16961be037e8d1168038bfbcbad74f23145a76f2d36f7b241b8a333c4dae5b806e051d476d15a64a0f788976c5288f6cefc7d2c91b793e7235280c1a963627b8b3fe31f1b2935ca38f3e0b06db2850cea3cb71f25c2a009b4faf55f3a3c441461a2db841cfcede7cd36daeff5800cfc0d96c14cbf0578030d1b8f627a4d031cbaa9db14e2c9024566f5aeef5b21f4d58ae635f78bf528682b0e6fecf2e11e925b31e191851cface35c1d70126f51ad616fe4c32c9e0099ea87d83a67dee2ee77538293b34c9c80adb9c77b294f5f11681a5496c4d768dcb8ace11a2c6714c281b2dc873298ad7189ed85d8f89828d2ae6aed592b33543a4d5eb00ddd712416c45fb8f967b2c10a686788b9c1ecbaafdb0bc59aa5a6d37d990cba76314c8d00b2b4fe374fa833a5f8ec3f58b3d070870ab3b07cfa1ad77e4009b8ced5c0044c7d12dc44e21b5ba628f327048c82b44ffef3ae2823f265cdfdd2d5dc7ed3a81e85db913c22dff73a400a50d2d99cae1f3cec7edeacdda7755d4de82154a665ac4a7ed729db5b8296ce0365440a071a337ec39efeb1eb878f8bda2c4a19a9792b2fdff8014e7d6233b28c806231c4691c65218caa3439dd0c45311342c30e7e273a25be44c26cca6831df3ba53f6e08312cdf54f58da101ad30e3a8a8d73ba4bb3f4a7ccffdb3c7284eaa59c52b89fe00ed28cd9e293f0d4055b875e6b22c18d84e3c8131b211d3b2ebf9df3489f263ba033c5c316f6e6dddfc75c25ee2f7c867f2aef585b16315dd3e0462ec6cf594826b6a6ee83babbf00c0e83fa186ff40e097e7d9468ca25d26e5c655b6177a9b1ad048d48d32666242acb949fef033e19ef4e8843880e1be4af4ba2f8788f1e5dd1dc62207c0cf621922622c4411458f08267acaaec7f1294cdb17bb74828827ed0e8aa0aa266b769306733c1cb15fcd49436e8f0621905855018364ea1527a8d64be26929dc52ffcecb2d17a6c67288c1d3fede319b7061b449dd7f4e53162a3bc41cdf5f762f2087d6bcee97000faaa1f2355ebc3591ff5b268d90dc3dbaf01c09cf5c5a4cc16cb14ebf4612939bec3f5605b6677548cbb85781e4556f77ac88db7376abb3380f8824b765bf0a65423c00f2d8ec47abeb61fdfc596cd6f5297b8dc662e3f9878f81f1484e4e2dffa062cb5799e583b5ef2b2908bdef79260489d2c42bfcd83faaaccdb62b7506a9ed915520f30fcec83b4ecc028e9c08562b563a6758669d31c40000000179e06696b69950d54782f51deea9f60f2de6d4a6f683ae3cb317e9151e4cd23f5a531bcbbe7dea028dab66213d44d657b1fd1269e4a8430a34b09ced41d4cd5	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ApplicationUpgradeCandidate	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\00188018EF1A772B = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000008e287ab644d80a4e825c8de183c2db22000000000200000000001066000000010000200000005eb33a3238ee1561fe3ce30d62a58290d477746240883f6af73aea526974b3d9000000000e8000000002000020000000d164aef31e9070012cb19df285ecd689850c1555e12f6e26370ce017e8d49b62800000000e1edab87367c14e20703b8b20de83ac03fde20cf66def5f8ea20f93f31c9e5d397875b711fda8250b9b0235c0e37be7c2590cc6f416af24bd08f5b0d072abac4f418e93f1c235f9b7944a421db1fb9762bcd2a4afb84b3a4c8fe5ef34f6ad1766a7e658be5868f093fcd0484ae0a108b721a935485caeafc4e83bbd36ea18e9400000003bfa760f255bcb47f00d1a83a78598f4dbf78c4253c23890206be2e37a1076a9dd108e7c55995ea32a4ed8b0ddd8bcfa352c1b9321e7468790accd0e89d53f0c	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--syslcid=1033&build=16.0.17932&crev=3\Last = "0"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,940 6,944 50,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ApplicationUpgradeCandidate\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	OfficeClickToRun.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
2700	OfficeC2RClient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
4636	OfficeClickToRun.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4216	setup.exe
1152	OfficeClickToRun.exe
5860	OfficeClickToRun.exe
4636	OfficeClickToRun.exe
2700	OfficeC2RClient.exe
2700	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2888	3664	Office_2024_EN_64Bits.exe	89
PID 2888 wrote to memory of 4216	2888	cmd.exe	91
PID 4216 wrote to memory of 1152	4216	setup.exe	95
PID 4216 wrote to memory of 4636	4216	setup.exe	97

C:\Users\Admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe
"C:\Users\Admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\package\setup.exe
    setup /configure configuration.xml
    3⤵
    - Checks system information in the registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2024Volume.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/7983bac0-e531-40cf-be00-fd24fe66619c baseurl=http://officecdn.microsoft.com/pr/7983bac0-e531-40cf-be00-fd24fe66619c version=16.0.17932.20884 mediatype=CDN sourcetype=CDN productstoremove=AllProducts updatesenabled=True autoactivate=0 forceappshutdown=True sharedcomputerlicensing=0 sclcacheoverride=0 acceptalleulas=True displaylevel=True bitnessmigration=False deliverymechanism=7983BAC0-E531-40CF-BE00-FD24FE66619C devicebasedlicensing=0 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True scenario=CLIENTUPDATE
      4⤵
      Drops file in System32 directory
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:1152
  - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProPlus2024Volume.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/7983bac0-e531-40cf-be00-fd24fe66619c baseurl.16=http://officecdn.microsoft.com/pr/7983bac0-e531-40cf-be00-fd24fe66619c version.16=16.0.17932.20884 mediatype.16=CDN sourcetype.16=CDN productstoremove=AllProducts updatesenabled.16=True autoactivate=0 forceappshutdown=True sharedcomputerlicensing.16=0 sclcacheoverride.16=0 acceptalleulas.16=True displaylevel=True bitnessmigration=False deliverymechanism=7983BAC0-E531-40CF-BE00-FD24FE66619C devicebasedlicensing=0 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4636

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5860

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\lync.exe|root\office16\msaccess.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ApiClient.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
Size 551KB
SHA256 14880d359be913b16eeb49e042c38bea0d8fc7976f546c76d5d87fa94f1e1ad6
MD5 2af68d5eae007083c05e28ac77cf5250
SHA1 5578663b8bbf308d655b82322ed271ee5d6878bb
SHA512 71aa6610cdb25c7e6e95e912728acbfcba95662e99b63266e78d3435f4eec13e9e976818a2daa7b42e354921b99905b4cad43b7f21cf520c40f233db5b81bca7
SSDEEP 12288:5pPpppIpzp8XNOdhbmxfweC/tipEDT0li0yXosX:1OdFmxfaiUoyXX
TLSH
T16DC4D881A3F90765F5F7AB7499778435EA72BCA65A31C21E1290C45E0E33F409D2AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVIsvSubsystemController.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll
Size 950KB
SHA256 a7927aad48be4df721140eb7a079e26997379d74c57fc7e88fa089adc52d5add
MD5 4a84f9223748c05e529fef35e4850e84
SHA1 934b4f62547c2f50e1aa88349fa8649f2204939c
SHA512 dada3a9e7d9aedbf1d5d47d20292c67819c3b70bade17a9544e3b1d4150c8f59234bec8bacb068117c558fc10774056c969751d49beaa07b142cbf5c53158a60
SSDEEP 12288:ss1sbwLGGhoPnMcmFNpEZRO3ZPYDhQzIWb1E66aBVGNUbTgUrr9685Bx8kZyEsaO:sPwLEhZROJPoyzI6R6aBzrRoEsafVJ5U
TLSH
T195255C51DF648165E9ABE6F58A378A32F7B3B8831231930B43A0C51E7F537906A5DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe
Size 5.2MB
SHA256 8a43b3d7e80de78681c0c21719089c8ea08b788946237a8d28969c51a2e8ede7
MD5 833cbbdeaa08bb24e810b55b71531b55
SHA1 6ebf8d5e2bf0bb023b2f6822eeb742c2588bbef8
SHA512 ee01873b9eca42fcc4c188a1e3752ed9ccc30443abf4fba832b01aed8c87bbec7224ec0f27117ecf3cf5a2ed3f39c3f300ed99bef14586f02c8eb2cd12d617b3
SSDEEP 98304:1Qt3QuGsQXs4fv9RYroq1zruaI6HMaJTtGbY:uS84n3YrCaI6HMaJTtGbY
TLSH
T1B1466D5563F841EAE4EBE2788E268532FBB2BC560531974F06A0D75B1F33A604E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIX.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dll
Size 2.0MB
SHA256 b98f108a089b1ee29739be8cafef4b29967fb862c718127d809d47c393a2363b
MD5 7fd4ea88b597ca60f38d889d4cddc7f8
SHA1 f27050b6661ff356ae4be25d91d4077cacd1e1d2
SHA512 7671bbbdf7127bd50bdf14c27cabc3805427e1896a39bf1f794366f2bc1d7ae18a1118b2caed7452114b88b2acafe92d3930fb6a10b3a541482749ab86fd2cda
SSDEEP 24576:K095MtuJ4IC3LI9CF4IdeE7kyrRgBBtEzjjwejHa2KAYK2I:KZ/IC3cAFVeMeBBtEzvb2I
TLSH
T14DA5711666FD4758F1F78ABC9AB7AA018476BC6A9B11C7DF0290410E0D32BD88D74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll
Size 559KB
SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
MD5 c3d497b0afef4bd7e09c7559e1c75b05
SHA1 295998a6455cc230da9517408f59569ea4ed7b02
SHA512 d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
SSDEEP 12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9
TLSH
T1BBC40923B75906A0E195E3B8A1834316D7F0BC4A8322A3C752FBD69D2F673D5673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
Size 116KB
SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
MD5 e9b690fbe5c4b96871214379659dd928
SHA1 c199a4beac341abc218257080b741ada0fadecaf
SHA512 00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
SSDEEP 1536:BqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbHecbWcmpCGtodMzDZ92zfa:BqvQFDUXqWn7CkRG7jecbWb9toaera
TLSH
T1E1C37C4573A402B7D62AC274C1E35A46EB71B5458770ABCF03B689AA0F13BE1AF3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140_1.dll
Size 48KB
SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 eb49c1d33b41eb49dfed58aafa9b9a8f
SHA1 61786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA512 d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
SSDEEP 768:oPIyGVrxmKqOnA4j3z6S2X7pudLAivD9zigElY7ivD9zG:XBr87uWFLpudBvpziZ1vpzG
TLSH
T176236CD057784082E9AB89B0C5E6EE577D7CF6A20B50968B07A1D1981F637C0FB3D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

repoman.dll

Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll
Size 5.9MB
SHA256 8f27e4093be0ef329ef1e76ff3b5896fe9d246b41337346a4695175e72d929f6
MD5 4b1fdb99825120516c72c62d19e4092e
SHA1 25c3c06426bb222121533b64c69de4bcf97e2f40
SHA512 7a8fd322d9353e59edf21ada8a47519e564921d4b4075d06bf2c11481401ebd2ec0853f62500ca9087e5cb5b0e69ac8e5b522a0935852d192a56f6a91bf59dde
SSDEEP 49152:a2YitfTF6FdDZGjFb1RvZ4oanvjUIwWNzjVm0111p37qpMZzNPXspqOaDRnUR:a2llnQv1wWTspFai
TLSH
T113563B6B37A88098E17BD13D9ACBCE4AE2B270054B314BCB16D1439E1E27FD94D79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVCatalog.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll
Size 536KB
SHA256 1d5b3b2ec11826763cd2be67481b3550d5efee4cc8e33de19cf6b223617aa81e
MD5 43c1ce2f3277252688710c8ddb7767a7
SHA1 c9e6353dd9f084c7cf9b8d32c64ac69e4c858e81
SHA512 502e375588fd1b81ce3f0a7d16075a6687c79a30355de42be7a974b83706c225384c2b043fc6f99afeba576b5a376550aba87ffcd401b3e908c75c5f33314000
SSDEEP 12288:94k5aJ7AhNr+0JU/3LJdqGNUbT0QsGk2MR0pyR:Prvq9d2sGOR0pyR
TLSH
T12FC44B659A748621E6BBE6B45B33CA31F77338526271D30BD3A0D1267F13B80765AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVFileSystemMetadata.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll
Size 250KB
SHA256 7c3f346a9e7f6557d4e096a8d1a16622963405193be090be8371a974712f723b
MD5 6a31d52152c7de867e0ff45925d04962
SHA1 838f908d3273090af4ebb420f52f4bbacdd073e3
SHA512 560063002727deefa8b4508e6d45ef54f5da37bdafd256076977923377496a6aa1ecf98f479831f625b267aa51bf9be03bb81783edf412667db278884b036c12
SSDEEP 3072:vruoGqQFZ4yxl93L4UAQKKSWGNU6ITLRK8fWRznMNlyBT2K6L8w/d/:vruoGBF9l2WGNU6ITLnWR4NcBs
TLSH
T18844F767CEB4E423DBBB6DB85733C620EB7239605560930EC268D01D9E477C0AE69F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVIntegration.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll
Size 1.5MB
SHA256 89297167f1a4efc7d2d17127413962838b4a0b5c3aff59d6b04547f09437eedc
MD5 f11d9ff348e601090b6aef1beb97ee93
SHA1 b86e5815ee29ac40811362cd1878a56e624927d3
SHA512 cc8bce0ecce8e7dba0b5009b433882a05913d34d8cf3f7ee6b139d5a7430d88cfc65c6a85cf251d9961e975743c302263a23253903317633390432080be4b71f
SSDEEP 24576:e6jTvqVF0QgWpKx11GMaKvWPUXlRbxagq+t5d7k:e6jTvC2QY1GFKvWUj1agqK5
TLSH
T1E9753B42A7A4C164E5EFE7F59A3B9932F7337C466631930B0390C5162F63B509A6EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVIsvApi.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll
Size 371KB
SHA256 9f10155e989a656499be2c07a6f0402f07867b04c0fda539b5d9aa0425cab0d4
MD5 369361bf549dc602dd1382fe99073cba
SHA1 588239bff3d54bf75cf0615bebe5ab2bede29754
SHA512 6c3f907085e433f75ca7fa89e024d2ccee84e8550c74ab12f3fddcbc1f3fe90bcd6949f9b1cd9c7b212191c6f2900e1dd5538f14987f3b775976533f6b0b6716
SSDEEP 6144:RiJcZXN1tOXEmJctKPw7Hm2TCWGNU6ITLwcjgA2AD7w6:UJcNftOUgpwjhnGNUbTpOyw6
TLSH
T11F840966EE609421EABA9BBC9B37C631E7F375911231D30ED3A0C115AE473C07699F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVIsvStreamingManager.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll
Size 181KB
SHA256 3ccbef8389147c4f4b729c1def5021f95defda500005873ac88f8438af09c747
MD5 55e43a9121bd9a5227d1fd2b253b536f
SHA1 9466988c7df58cbe30043796ba2bf483070af8f6
SHA512 92051f39882b32346a8229231d90676f46b0a40f52fd7333c4026b760134c36093f5fb29bd1f5b8a02eb8102932c82220ae03d48a0dfb20738edd245ae44b953
SSDEEP 3072:37juzHwERo7WGNU6ITLzt1tldVNdVNdVddK9pJZFKCOqdy:37juhsWGNU6ITLztdKPJZkxL
TLSH
T1A904B4BBCD34E413C3BE5CB4A763CF20AB76B6615281220AD275D16D1D433D1AF8AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVIsvVirtualization.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll
Size 475KB
SHA256 5728328ceda6aab51dfeaff14323e075344137d1fc8779b33f440c8e8d8b2ceb
MD5 16114da7b1720576c27e9acea01b45fb
SHA1 53e4375333142756660484570a76fdfaadbe20c0
SHA512 e6f6b5de284e2c2f5ab4a7bdacdebf641c2c9876f761193da0602b8663ee6bcf8fa53e14389bba7ab88cfeb1dbbdf4029aae3435200bc9f20939d468372496f1
SSDEEP 6144:Ux0qMm0+F1qGTSD7JkFcbPc0a4QwkvxXScJDlWGNU6ITLs614r50yt5EJtDL:Ys4YGTiJBjc8JkJXJkGNUbTa5Ej
TLSH
T112A45B66DA748861E6BB9AB49733CB31E7737C1111A0930BE3A0E1652F33FD06659F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVManifest.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll
Size 929KB
SHA256 041ab2ea17b4c38b37da6683200825a6ff91ae87caf7e4a7271763128af85ad5
MD5 68d7cfb17a0b2f386477055958a3053e
SHA1 db9f91ca0dc7cde6a4a788a4616f473608b6cdcd
SHA512 1478be67abb40693ee0c4ced29c467bbe8c20755dfdc06e16a3a1d66e96012b69f4d1e3378eb2dc6864730b1e9a8ca8ed718d713f0870dada4bb7f7bfa17f069
SSDEEP 6144:zRzRYvCG3m0iywCWRi0tVDN0sFQxcLepzo0He/X/A+6TbWGNU6ITLWm/NjJz1k6g:zRzZG3juFQOnA+6TyGNUbTC+R8PnJ
TLSH
T15115B403FBEA0510F6B75AB8D9778970AB777C415930D30E02D8A54E4FA3F409A9AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVOrchestration.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll
Size 770KB
SHA256 c42275a91cedd42aa436a48cf626db619c19813672accffa0f4db38fc58e04cd
MD5 12a2238717c7c5bdfc7ca4a6f0bdfeea
SHA1 295366ac90ef3fe907938945953c7a8463461d16
SHA512 759e2f4eb0399ce4dafa89b8c53cc89e3e069d9e46a94a6607643a3c898fc6d31b846accd7230f4927cebaa0113724572972799559c5499697482d38b80f9999
SSDEEP 12288:DnTfZ9oh+wxGEr9tPJ1LRdLfCBOSrMZPUYGNUbTx7g3sYH9v:DnnG+wJPJVRNDZPSv
TLSH
T184F42A51ABA48160F5BBE7F89A378632F77378566231D30B4390E12B6F12740A99DF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVPolicy.dll

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll
Size 1014KB
SHA256 b4085e55d7093eedee6207dee87a071d99ed510214e312ce25fae40921284418
MD5 e36ea27c0cfbc1562e73512002c0e676
SHA1 6d3004dea8dfe7cd7d46c0cfce0c54cceb2a3999
SHA512 af694c15a3a018d36eabbd93995ee9609b69cd305f2ec492db951154df60c187ddaffbf08738be5fc7874d0a9314430eae0c4171a4ae04e895a808a70ef4ab4c
SSDEEP 24576:swKHTfidD8GUvzZ8/BYYlePkXduZnqQds:sJTfDGUvzZ8/BYYlePkXduZnqEs
TLSH
T10A258303AEEA0114F6B65EB9D9774830EB777C414934E34E02D9A50D4FA3F409AAAF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Size 13.4MB
SHA256 99f446a1a8ebe2edcc01160b096de03d2c6a836742b7c81498cec69c3d00e466
MD5 bfde5df3870ce006812811642b402b64
SHA1 fac02c4c7d13f27a888b935268e130f65915bc71
SHA512 3feac40719ffccc7e4e2c2c868b293d1418b63e03ac86fec0e5f73576ef5b17d920a6d3de12463ad2e4992f3f2149d3166d818e6af7e38931e9a020972fde9e9
SSDEEP 196608:w++3mNWA96ls8HmgetLfz+onSKrYgNaI6HMaJTtGbQ:rN6lIBNVrRG
TLSH
T164E64A05A3F406E2DAF6D1748A364D33E6B1B873653D67AF0660C5660F33B20CE6A791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i640.cab.cat

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.17932.20884\i640.cab.cat
Size 31KB
SHA256 29a553c0069d1752d0cf7adc66f3d879df4a0489d70216b3fd063064c3c371f9
MD5 b6227d8e9a27473bec81e4705aa29754
SHA1 79078bee9e847335a44c6919d5b5bdf4c2ac7218
SHA512 6c8e635da4b8b1ff7818bc89e7f21815da567c8a45c444de6d31ab50749230a472683e7ababbbf48d366f2552879cab0cfddd2f4abf5162a25158ded7aee6947
SSDEEP 384:UIi5xyyXSfeMBR+Ki01qphqN0NemG5lN0Z8goR9zf6hauGU:UISzXWc0sphqeNeu09zeZ
TLSH
T104E2EC2194000283C14F693854AAEA3ED0FB5FBE9056A13EB5BBB7740977291F76F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i640.hash

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.17932.20884\i640.hash
Size 106B
SHA256 7c976569fe94bedecbc813412dc62aad938c25bfb1a78445fa533b2061173d59
MD5 a03074379ee4c6796f1692e1ad3e1f0e
SHA1 c3dc4fb97852ddf556bc27d4505f4ed5436388cc
SHA512 06cdfb09b0b391be4fd97b23555dadec1f64126eec94b5862855b16bb496c637d6060b72fdaf561225c93415e0efa99ecc270796a609e65540d73b4a57d6e9f8
TLSH
T176B0126E44E403331120C102CBC101B7F6005106D4060F384CC37BD611DB08339C396F
MD5 SHA1 SHA512 TLSH

Submit Download

MasterDescriptor.en-us.xml

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F42578F5-35B4-4405-A1E7-AC9F27838FCE\en-us.16\MasterDescriptor.en-us.xml
Size 40KB
SHA256 1f3c2cc26acdb8b662a6d4d7237434daa4083979a30365dffc4a82849a3551bd
MD5 21763e48638a9918636179e22e7cc7d2
SHA1 b349eb9e057daaab3c2d726df1d96c95237ecde8
SHA512 df945bf421cd0aa43a4efc817d4243da435a6b736eec25d5b4c772dc84809bde7a8709fea61bab053e5715f0330f36bf685b17e6521f7d388ce74e4bb903f0c9
SSDEEP 768:hj3csJ3namZRxJpSfiBwQqJrZyWj/0jxQe+OFQdLudiROOqn5yptSEelAaeHbIBP:L
TLSH
T1E603D34070F988D2F3351A46F7E36CEAEE7911F34E262AA5315EAA172F3B9506137443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.x64.en-us.dat.cat

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F42578F5-35B4-4405-A1E7-AC9F27838FCE\en-us.16\stream.x64.en-us.dat.cat
Size 78KB
SHA256 405de336297df98e97b5b2ad6a8adf0640ffe935974f5ce6880228f95991359f
MD5 f0af2384bb9ebe397e46d4fdce4b5fdf
SHA1 63c0fe1a358a83c1cfd1bc4652061fad988baea3
SHA512 818fefebcc6a8b7aa48f29833c06af4881717f9be16ee7e45755ef1096724882ccdf19b984a583b67c08f55a53c6078a6ee22365bc3f5f7b4ab01ff360664854
SSDEEP 1536:tV/rZZSvKK8MFMWnYzozr5A5D0d0b7AzwD:tV/rgKKk0d0Ym
TLSH
T1D9737821A40006C3C14B2938949AFA3DD1FB5FBE9056523EB97BBA744937281F76F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasterDescriptor.x-none.xml

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F42578F5-35B4-4405-A1E7-AC9F27838FCE\x-none.16\MasterDescriptor.x-none.xml
Size 40KB
SHA256 0181acc2affc00a9ef2ed9e08b2a8570029bc7a2282dbf85b1b84520eb74f297
MD5 582ab909b4bc15563dca33671cba31a1
SHA1 156ece2bd5158d33597c5f9ba56f71aae530e9c3
SHA512 7d856bc3e74bee955decb94f697079c3e1d8cc4c16f0866f58e3382606ff44005727c4f5eeeba7033f697b86b0108d75f49d03974860113f78225109ce0b95d0
SSDEEP 768:hrcsJ3namZRxJpSfiBwQqJrZyWj/0jxQe+OFQdLudiROOqn5yptSEelAaeHbIBsU:n
TLSH
T15903D34070F988E2F3351946B7E36CEAEE7850F34E662AB5315EAA172F3B9506137443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.x64.x-none.dat.cat

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F42578F5-35B4-4405-A1E7-AC9F27838FCE\x-none.16\stream.x64.x-none.dat.cat
Size 672KB
SHA256 3c8740a6047bc65de488a5a7aaf516950cfd0d1d170abba88983723c824581b4
MD5 7b21419056bedaa71814c4b69d00e3a7
SHA1 5e806f6f59e736ec88c6291fb3697345a6158479
SHA512 a29c9412ecdeb3c471c242c676a3248d0a9391a551fc4682483efbd754f77fc1f5f01681a9c3738f15d99a9157c86ff4386e2b5debd735539b7d10157cff3e35
SSDEEP 12288:igvgvgHS7SHeTxZuxuV+4MMFkOxtG9GUPe8Z84V:igvgvgHS7SsxZuxuV+bOxIPz
TLSH
T103E43421640006C3C05F693894AABA3DD1F79F7EA095923E79B77A740577280FB5FA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 1KB
SHA256 7935f8563acd826c06983ff95bf27dffd3a9f25d2039fdbc360fa4115b4d9bb2
MD5 4f2b8ebe697e8943f6bc3e030a5dd7a0
SHA1 50a37dd9135b6f8a1e45fa80ad171714fc327242
SHA512 2f56efa4eff32b62afae4c66ff97f21737c813af5e544440cfb5b4dcdeb8261170b5edc62a3ce64cf65979b438ae28c9aad81646061628471d12ca11476e5f26
TLSH
T1A3310943A57814D13E897905A1589A133CBB6A81ACC45C07090CD2702E697F77B1562C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 a4cf22661048ac7deb6a2f401771c572c2c874d0cb76b767bb5d332a8c9797ab
MD5 4718a265d6c0ac5302842f9ee9127666
SHA1 32b50ef75b0e8e76b5f3e657ab75beae94e7f2fc
SHA512 cfa50190c401df50123037960aeba2adc1eff06c8fd16aa1c37fb9f7a1f63a898214694179a984f61334f28669695f6ce40d219833849ed2dc59eb8a88fa5929
TLSH
T137F05C1B90AEC4057E4E8CCC2EA8027A602292A904758A011069C8B20C026FFF66E0F8
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 426B
SHA256 c57e1abd75fdf2bfbfab154122a28f68e2a2eb1c272b58b1b03a36683c9cb2f9
MD5 4d088060842fed4f4feb00b63f82f3b1
SHA1 bfe80a91aa2d0afa924e602e9e6d8f62eef2d722
SHA512 97483c24da7cbdeae39e4a6e4243ba14fed79cae51757ff0e851bca4e661adeae3f76e1092c3a3ad40963e443077452836a28e3b4880293b1535a2171d4afe3b
TLSH
T17EE068342DFE811DE372AABC4BD5452E5A3FE12304049B751B10510C2206C800C32736
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 1c154f987a12289fec0370ea5f8a4eab666f756a78869543567e06aef641ad4f
MD5 d39360706628367d3475b7e58ca7d7da
SHA1 fd47334166e57eb7801b7ce4c89a0b467b6ff0ad
SHA512 5b67b8c1e25801e8b11a0628d88de37c5d53819989ca04ff39df66f4a4929c6230813950be181e283073af3b86214b271510fd26326198f83094d93b04c28119
TLSH
T1C2E0C02415F6021EF0F0D13547D9B5A096AAF0111554E2B22AD47709AA02B04EC11D35
MD5 SHA1 SHA512 TLSH

Submit Download

i640.cab

Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\i640.cab
Size 32.1MB
SHA256 209e643a0990cb026f8fcc8699337287cb821ac1857559ba70220486bd246d13
MD5 f2479402e7e7ddef546e5bc18df8a0aa
SHA1 7003aaa14784982da945a7458e14ca24c0aad322
SHA512 d8f43b462e6eea6eee8fb898846cb2aa550b79778a12fba04b9ddb350d75cae21a616756c6d844446886ac109586ee953c67703679a58f0f6039fd364b9c5b4e
SSDEEP 786432:CVGwGw6rdZeiaD09kMjPkTbNg4SYr2iFUT5uSFVtDVu:cGwGvrdgi2wktbaby23QiDo
TLSH
T1427733F5D4F051AED6CD063E8FDD07193CA6521448447882AF7AA9702BF7F2A80AF764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionDescriptor.xml

Path C:\Users\Admin\AppData\Local\Temp\OfficeC2RB926B82C-E61E-45DE-94D0-00D53E872EA0\VersionDescriptor.xml
Size 25KB
SHA256 87f6876712cdae1647167ef9cd1a76189d3142adeff38df2ed636dac135c38f3
MD5 5692c09906723c6190312a49b318ccd6
SHA1 5bda466f90393a0de3568054ac09aaf66ff09815
SHA512 53c6fa4c11819703961ca4dcfb1d538946257a88704f558b552b63bc01624452ed5e15c11aac9935c8dbc78f34b65a6a01f45f6d4a9ca24a35544c21ea0a5aed
SSDEEP 96:bCBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVItzt3XNIR4ja9a9DMeJVnOY:bG/yZ74
TLSH
T12AC2456BB8D03D1D413477A7E96336E2EF62826396050458F10D738B3FB285DB3AB619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration.xml

Path C:\Users\Admin\AppData\Local\Temp\package\configuration.xml
Size 561B
SHA256 d2332477bef1bea8bad8a04b464e0bbc583a43ea82db42a5e2928ca84ce86e07
MD5 f703bd1cf43492d5ab33eab68c13984b
SHA1 87dc7ec70747829f8b76dc8f7a09983c714c1856
SHA512 8c23164107cb8e73eed527f7a9adbb8dac725627f282a1473ec85a7427eec94bd5237ccfaff69258faa4ea21319095028dedca84f3fd2f1737a640f5e28559e9
TLSH
T1FAF0F0A97AC44C2252B1037ABAFF290CEBA9827395380D49BAAF36574D330101723127
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\package\setup.exe
Size 7.4MB
SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
MD5 7488d696f9a3d74e093b4c31ef7282c6
SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
TLSH
T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\start.bat
Size 49B
SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
MD5 SHA1 SHA512

Submit Download

s640.cab

Path C:\Windows\Temp\OFFICE~1\s640.cab
Size 3.6MB
SHA256 fe96918fa0018038786548935dd100a35eb4f7a2ed96aaaad8cee92b17d4a309
MD5 bc240d5638187ea73ae109d15e194f77
SHA1 7a9ee5b0b9f3cf6014dd1659cfa353e3698189cd
SHA512 09529435a293435cc5f4735e94f55d3372af4ec26d74b297c48f42e0bc1b17f5bfb17b24a12201ccd02e77a95dc27d5818a4b414afa414a2ef779f374d70c2d3
SSDEEP 98304:sRmSnDeivh2vzWdY2j7RbkGioHsqCIvHy/Az20B6vU:sQSvh2vC3jtQGio5H6ol6s
TLSH
T19206337CD91CD787C08EDC3BAB9307716F9FD829A469B702550B9A023A773C0469E6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s641033.cab

Path C:\Windows\Temp\OFFICE~1\s641033.cab
Size 536KB
SHA256 f6c1ac798624769728ec6028c93ad586a076851cd84e64da90aa00936aa6a410
MD5 0eb52c23881608b195df6367fb0ebcb9
SHA1 7a48bc64f0492befe26a6081ebaf33cdd15a753f
SHA512 8bb6f40ae2a1b1fab2357e1a00ff9513b3187e9ed1dee491d9f3c68534dcf5ad611d32580853c1321531cbeab7b53864ab3718b53797b428a7ec49e55b07ca4d
SSDEEP 12288:ltCSMHwk8IDbHLQdQ0MYKTcsBveC+p3yTIiutgFP1gY04vRGm/:jY8I3rQdhMYKTLBvl+pCTOtgFP+cGA
TLSH
T13AC423BACC9D9017EA8B312282355E83D96AD3E350C119B9B4DDA12B5E797FCE10F05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-454-0x00007FFA8A3A0000-0x00007FFA8A3DA000-memory.dmp

Download

memory/1152-488-0x00007FFA8A6F0000-0x00007FFA8A78B000-memory.dmp

Download

memory/1152-486-0x00007FF6BFEC0000-0x00007FF6C0959000-memory.dmp

Download

memory/1152-487-0x00007FFA8FBB0000-0x00007FFA8FBC5000-memory.dmp

Download

memory/1152-489-0x00007FFA8A3A0000-0x00007FFA8A3DA000-memory.dmp

Download

memory/1152-478-0x00007FF6BFEC0000-0x00007FF6C0959000-memory.dmp

Download

memory/1152-451-0x00007FF6BFEC0000-0x00007FF6C0959000-memory.dmp

Download

memory/1152-453-0x00007FFA8A6F0000-0x00007FFA8A78B000-memory.dmp

Download

memory/1152-452-0x00007FFA8FBB0000-0x00007FFA8FBC5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads