91b82611b21bf9b93959caa9f41e02d1cfe589ffba89ebbd37ddc99d70203340

Analysis

max time kernel
118s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

册2 相关支持性材料/4-2-1 国内流行病学数据或销量数据等支撑材料/抗抑郁药的销量数据.docx
Size

1.5MB
MD5

122569f4ed2036ffa8adcb7a48db3e81
SHA1

adbce96f63c1f0201d443e4cfe6bcb11c0099d06
SHA256

cfa01655e5d8af15095cdfd204e3134dab5bf99ec836ab54251343fd851d86a4
SHA512

625ab99f7cf1b60ab7b970bd3c77cf264e52ee1a66e4950040106a1e8605ad78c2462fd00161ebb5614e6e147c8af73a313a516747c10befc61e3abdc9a1e1f5
SSDEEP

24576:gafDaT77Hq2JV4TpTMCMhbZhCG8iCxDF5j+3e++4W:3fDaT77HqKV4Tpj2C4CxDF5Ch+x

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5004 WINWORD.EXE
5004 WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXEEXCEL.EXE

pid	process
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
4456	EXCEL.EXE
4456	EXCEL.EXE
4456	EXCEL.EXE
4456	EXCEL.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE
5004	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\册2 相关支持性材料\4-2-1 国内流行病学数据或销量数据等支撑材料\抗抑郁药的销量数据.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
e9e54ef0f8aecc8567774c8a008d5d95

SHA1
04d5e91c25a14529775027b8079eb275e8a0f824

SHA256
8569e2b57c5512b4a7182434823e8461b9ed242c613d5396a2ce3a89e3df1df6

SHA512
e561b3cfd3fdd7073048581ea137734104e6ae0a720cf05fb7b86e7fc7e4d790b5d283939af32359ad80822ebb8bfc104f6a7965cb0dc65b5153025b7b81afaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
958fb5b428a151ccfb0206e5255f9821

SHA1
910ad90289811dd931abd0b3ba4def27c70604d5

SHA256
f012f941abc53895d4d483366cf02a8845a696a4d053ae10cd0e866ed02b7263

SHA512
75539676f9cc55d3ad1402db674ce7c1ad0e1cb479447abba6a87a5f280c64e29ff4cf56f3c792a44bf7642f8eb139716e166b43ee51b2abd2a9104b44b7c362

Download Submit
memory/4456-152-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/4456-151-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/4456-150-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/4456-149-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/5004-135-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/5004-138-0x00007FF85A490000-0x00007FF85A4A0000-memory.dmp

Filesize
64KB

Download
memory/5004-137-0x00007FF85A490000-0x00007FF85A4A0000-memory.dmp

Filesize
64KB

Download
memory/5004-136-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/5004-132-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/5004-134-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download
memory/5004-133-0x00007FF85CAD0000-0x00007FF85CAE0000-memory.dmp

Filesize
64KB

Download