Analysis
-
max time kernel
114s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:24
Behavioral task
behavioral1
Sample
《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
附件3.贵州省农村信用社诉讼代理情况统计表.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
附件3.贵州省农村信用社诉讼代理情况统计表.xls
Resource
win10v2004-20220812-en
General
-
Target
《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc
-
Size
85KB
-
MD5
f51364aa94ae2d01d8e4c7904ed65fa1
-
SHA1
24ea243201b923774498652839a5c1aa7448b9d4
-
SHA256
9b2db3b1004f0848ab99e899d55186352d8b74c67c8455cafcafce2b3017e332
-
SHA512
8da7583025d9d6941e91ca3276a02b58b5082efdf0ce3841b9996006d004260dff891df8035ca2c2835499a76800589b3ab35635a89b5c47e3120610e06f34bd
-
SSDEEP
768:q9ux9EGPlTcWdtkN65A9TI/Yq0U9QgcrZwcgDe+kZsQNbK5Z:qW9EGzkruYjU9QgcNwcH+kZs8
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4512 WINWORD.EXE 4512 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4512-134-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-135-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-136-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-137-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-138-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-139-0x00007FFA94040000-0x00007FFA94050000-memory.dmpFilesize
64KB
-
memory/4512-140-0x00007FFA94040000-0x00007FFA94050000-memory.dmpFilesize
64KB
-
memory/4512-142-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-143-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-144-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB
-
memory/4512-145-0x00007FFA96230000-0x00007FFA96240000-memory.dmpFilesize
64KB