Analysis
-
max time kernel
171s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:24
Behavioral task
behavioral1
Sample
《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
《贵州省农村信用社诉讼代理管理(暂行)办法》(征求意见稿).doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
附件3.贵州省农村信用社诉讼代理情况统计表.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
附件3.贵州省农村信用社诉讼代理情况统计表.xls
Resource
win10v2004-20220812-en
General
-
Target
关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc
-
Size
20KB
-
MD5
6590c677d3878e8d59971fef22ada318
-
SHA1
6bee73835e296cb21ccfd1c055e8802fbbcf367a
-
SHA256
a61f6316e55c9d505ce7454c8f2527a4e2f42754ee4b4c81580bedd29dbfcb8d
-
SHA512
fcd6559ae075e47fec1902c2cdfe9709c1f3cdb443069260847eaa2d9b9b9722438ec9a1f047cb9932ed24b385527d7af5f3aa4c2ef91c6a568a728841ea9f4b
-
SSDEEP
96:O5pYOtmgsSqr25eyZLWdugj/O5W/riGypw/CJ1mz:O2S55v69biKipL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4308 WINWORD.EXE 4308 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\关于征求《贵州农村信用社诉讼代理管理(暂行)办法》意见的通知.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4308-132-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmpFilesize
64KB
-
memory/4308-133-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmpFilesize
64KB
-
memory/4308-134-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmpFilesize
64KB
-
memory/4308-135-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmpFilesize
64KB
-
memory/4308-136-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmpFilesize
64KB
-
memory/4308-137-0x00007FFF15A20000-0x00007FFF15A30000-memory.dmpFilesize
64KB
-
memory/4308-138-0x00007FFF15A20000-0x00007FFF15A30000-memory.dmpFilesize
64KB