Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-08-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe
Resource
win10v2004-20220812-en
General
-
Target
boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe
-
Size
511KB
-
MD5
7b3c8a33a8607c3b1cabd24ba83a9876
-
SHA1
70a9605990488445f8ae5836b5c92819f93d6355
-
SHA256
2d1d71f05b0ab72e85c649e04f4c78f3007741649b9910be4266fde74504456d
-
SHA512
3c71c27fa650c64a1b10220c5bdc42031a3426745f9a4bfbd128fd4dd7e31098c1049884e977a9b2f52f772229fc94ba44781525cade627ce562a6b663cc6c6c
-
SSDEEP
6144:IeiRWoGu79mhdLRYxJbFP23zKx8t52aXbJdXv+4wNaS:F/oOhdLEwjKx8t52aLJd/3wNaS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
word.exepid process 1556 word.exe -
Loads dropped DLL 2 IoCs
Processes:
boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exepid process 1416 boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe 1416 boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
word.exepid process 1556 word.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exedescription pid process target process PID 1416 wrote to memory of 1556 1416 boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe word.exe PID 1416 wrote to memory of 1556 1416 boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe word.exe PID 1416 wrote to memory of 1556 1416 boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe word.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe"C:\Users\Admin\AppData\Local\Temp\boos直聘-李笙-业务代表岗位-清华大学-工商管理专业.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\programdata\word.exe"C:\programdata\word.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\word.exeFilesize
273KB
MD5773295382ac480e8db8fb2c1efad4cda
SHA1ae7c78724b8e0c946dd12d2ebc61f0f11c911067
SHA2563823a537e612fe6e0453394242999cabb6d5070d49da22950102490d59fc6681
SHA512c0116b326fe1a4adf4b0abcccf1cf14aa0ad3f6762c61650002e524c57d0af296dfbb575eca317cbe8ac144e50fd8d198ef4a62bcb49e47cbd4da26813a3c288
-
\ProgramData\word.exeFilesize
273KB
MD5773295382ac480e8db8fb2c1efad4cda
SHA1ae7c78724b8e0c946dd12d2ebc61f0f11c911067
SHA2563823a537e612fe6e0453394242999cabb6d5070d49da22950102490d59fc6681
SHA512c0116b326fe1a4adf4b0abcccf1cf14aa0ad3f6762c61650002e524c57d0af296dfbb575eca317cbe8ac144e50fd8d198ef4a62bcb49e47cbd4da26813a3c288
-
\ProgramData\word.exeFilesize
273KB
MD5773295382ac480e8db8fb2c1efad4cda
SHA1ae7c78724b8e0c946dd12d2ebc61f0f11c911067
SHA2563823a537e612fe6e0453394242999cabb6d5070d49da22950102490d59fc6681
SHA512c0116b326fe1a4adf4b0abcccf1cf14aa0ad3f6762c61650002e524c57d0af296dfbb575eca317cbe8ac144e50fd8d198ef4a62bcb49e47cbd4da26813a3c288
-
memory/1416-54-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmpFilesize
8KB
-
memory/1556-57-0x0000000000000000-mapping.dmp