Analysis
-
max time kernel
117s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 18:23
Behavioral task
behavioral1
Sample
编审说明.doc
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
编审说明.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
西环岛绿道工程一标段/一标段汇总表.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
西环岛绿道工程一标段/一标段汇总表.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
西环岛绿道工程一标段/西环岛“绿道”工程一标段.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
西环岛绿道工程一标段/西环岛“绿道”工程一标段.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
西环岛绿道工程一标段/西环岛绿道工程编制说明.doc
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
西环岛绿道工程一标段/西环岛绿道工程编制说明.doc
Resource
win10v2004-20221111-en
General
-
Target
编审说明.doc
-
Size
22KB
-
MD5
e575841bdf52cda69edc53d4824d5fd6
-
SHA1
1906d59fe2d6614bac44db6f6fae21639f2f60f7
-
SHA256
9af39ce86f0a21d7598792fd2135bf33d8b05b3aa7687a52467d73292c471fd9
-
SHA512
0b4e48a54b1aa4fb526329ef670849f1cce7f4f8681ca17d55138ba2e6336dd6df00d2250cd185f5897fbaedf24777682fd4f098873950eb94a5860f47cb89c1
-
SSDEEP
96:ivbbvbEbbDbbsCIGFV2ZwOBfWXsgGKckqASr6grHVsV9xp+5wF/dueTz:5HV2tf3gvlDhgJsC5Gp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2140 WINWORD.EXE 2140 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
WINWORD.EXEpid process 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE 2140 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\编审说明.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2140-132-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-133-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-134-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-135-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-136-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-137-0x00007FFBA4B80000-0x00007FFBA4B90000-memory.dmpFilesize
64KB
-
memory/2140-138-0x00007FFBA4B80000-0x00007FFBA4B90000-memory.dmpFilesize
64KB
-
memory/2140-140-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-141-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-142-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB
-
memory/2140-143-0x00007FFBA7350000-0x00007FFBA7360000-memory.dmpFilesize
64KB