Overview
overview
6Static
static
1.bat
windows7_x64
11.bat
windows10-2004_x64
1AFUEFI.exe
windows7_x64
AFUEFI.exe
windows10-2004_x64
HPUSBFW/DO...ND.com
windows7_x64
HPUSBFW/DO...ND.com
windows10-2004_x64
制作纯D...ND.com
windows7_x64
制作纯D...ND.com
windows10-2004_x64
制作纯D...20.exe
windows7_x64
6制作纯D...20.exe
windows10-2004_x64
6制作纯D...OS.exe
windows7_x64
制作纯D...OS.exe
windows10-2004_x64
制作纯D...10.bat
windows7_x64
1制作纯D...10.bat
windows10-2004_x64
1HPUSBFW/DO...20.exe
windows7_x64
6HPUSBFW/DO...20.exe
windows10-2004_x64
6HPUSBFW/DO...OS.exe
windows7_x64
HPUSBFW/DO...OS.exe
windows10-2004_x64
HPUSBFW/DO...10.bat
windows7_x64
1HPUSBFW/DO...10.bat
windows10-2004_x64
1HPUSBFW/HPUSBFW.exe
windows7_x64
3HPUSBFW/HPUSBFW.exe
windows10-2004_x64
3manual.docx
windows7_x64
4manual.docx
windows10-2004_x64
1Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 03:00
Static task
static1
Behavioral task
behavioral1
Sample
1.bat
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
AFUEFI.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
AFUEFI.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
HPUSBFW/DOS/COMMAND.com
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
HPUSBFW/DOS/COMMAND.com
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
制作纯DOS启动U盘刷新BIOS/DOS/COMMAND.com
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
制作纯DOS启动U盘刷新BIOS/DOS/COMMAND.com
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
制作纯DOS启动U盘刷新BIOS/HP优盘格式化工具HPUSBFW 2.20.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
制作纯DOS启动U盘刷新BIOS/HP优盘格式化工具HPUSBFW 2.20.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
制作纯DOS启动U盘刷新BIOS/af10_bios/AFUDOS.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
制作纯DOS启动U盘刷新BIOS/af10_bios/AFUDOS.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
制作纯DOS启动U盘刷新BIOS/af10_bios/af10.bat
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
制作纯DOS启动U盘刷新BIOS/af10_bios/af10.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/HP优盘格式化工具HPUSBFW 2.20.exe
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/HP优盘格式化工具HPUSBFW 2.20.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/af10_bios/AFUDOS.exe
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/af10_bios/AFUDOS.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/af10_bios/af10.bat
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
HPUSBFW/DOS1/制作纯DOS启动U盘刷新BIOS/af10_bios/af10.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
HPUSBFW/HPUSBFW.exe
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
HPUSBFW/HPUSBFW.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
manual.docx
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
manual.docx
Resource
win10v2004-20220414-en
General
-
Target
manual.docx
-
Size
512KB
-
MD5
48f9b5e18c5f9cc30e78de66950710a6
-
SHA1
e286e4644c2f0ead02f499ca50f672f232ed003b
-
SHA256
b2762afba9d5e982cd8f131b21ed03e01b89363406217f0f819adfaccca108bb
-
SHA512
e904fe44d1a257ece21d625848c7c184e16c8ee452fe3bc3c834e74eedc2941f34082551af697bc7e89d30734d53131c5c50bf1c94080851c3568e7fc253b513
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3388 WINWORD.EXE 3388 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE 3388 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\manual.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3388-130-0x00007FF92C6D0000-0x00007FF92C6E0000-memory.dmpFilesize
64KB
-
memory/3388-131-0x00007FF92C6D0000-0x00007FF92C6E0000-memory.dmpFilesize
64KB
-
memory/3388-132-0x00007FF92C6D0000-0x00007FF92C6E0000-memory.dmpFilesize
64KB
-
memory/3388-133-0x00007FF92C6D0000-0x00007FF92C6E0000-memory.dmpFilesize
64KB
-
memory/3388-134-0x00007FF92C6D0000-0x00007FF92C6E0000-memory.dmpFilesize
64KB
-
memory/3388-135-0x00007FF929D70000-0x00007FF929D80000-memory.dmpFilesize
64KB
-
memory/3388-136-0x00007FF929D70000-0x00007FF929D80000-memory.dmpFilesize
64KB