Overview
overview
8Static
static
8城区质�...�).doc
windows7-x64
4城区质�...�).doc
windows10-2004-x64
1城区质�...�.xlsx
windows7-x64
1城区质�...�.xlsx
windows10-2004-x64
1城区质�...�.docx
windows7-x64
4城区质�...�.docx
windows10-2004-x64
1城区质�...��.xls
windows7-x64
1城区质�...��.xls
windows10-2004-x64
1城区质�...��.doc
windows7-x64
4城区质�...��.doc
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:27
Behavioral task
behavioral1
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(室分设计方案会审记录表).doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(室分设计方案会审记录表).doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW材料清单.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW材料清单.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW覆盖情况说明.docx
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW覆盖情况说明.docx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW预算.xls
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW预算.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(选址交传输).doc
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(选址交传输).doc
Resource
win10v2004-20220812-en
General
-
Target
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(选址交传输).doc
-
Size
50KB
-
MD5
acd134bb3e1a39a9f4942398aec45250
-
SHA1
2c545acc809bc5448f4a9cf77fb3615107f8a2d0
-
SHA256
7cf8bc8560bdfcf9fa0462e273878ee1c6531a3a89813ddf1791f51d2434ffa0
-
SHA512
ac451356e288ce9776135afa4615718fd76a73d770149a255b4c468417d0a78601b22cf90715b16b11e9c632a9f85fe28aecd7f2fe227fa3296db5c9d0eda111
-
SSDEEP
768:7fNF3QNUyEI/KCouO35ePk+rsUeOt7CoQX/ofuQDTzm+S33kwJ8rYzI8ucE3lFFL:7f4GkChaK
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1048 WINWORD.EXE 1048 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE 1048 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\城区质量技术监督局E-ZLW\城区质量技术监督局E-ZLW(选址交传输).doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-132-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-133-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-134-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-135-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-136-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-137-0x00007FF9E17C0000-0x00007FF9E17D0000-memory.dmpFilesize
64KB
-
memory/1048-138-0x00007FF9E17C0000-0x00007FF9E17D0000-memory.dmpFilesize
64KB
-
memory/1048-140-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-141-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-142-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB
-
memory/1048-143-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmpFilesize
64KB