Overview
overview
8Static
static
8城区质�...�).doc
windows7-x64
4城区质�...�).doc
windows10-2004-x64
1城区质�...�.xlsx
windows7-x64
1城区质�...�.xlsx
windows10-2004-x64
1城区质�...�.docx
windows7-x64
4城区质�...�.docx
windows10-2004-x64
1城区质�...��.xls
windows7-x64
1城区质�...��.xls
windows10-2004-x64
1城区质�...��.doc
windows7-x64
4城区质�...��.doc
windows10-2004-x64
1Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:27
Behavioral task
behavioral1
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(室分设计方案会审记录表).doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(室分设计方案会审记录表).doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW材料清单.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW材料清单.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW覆盖情况说明.docx
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW覆盖情况说明.docx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW预算.xls
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW预算.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(选址交传输).doc
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW(选址交传输).doc
Resource
win10v2004-20220812-en
General
-
Target
城区质量技术监督局E-ZLW/城区质量技术监督局E-ZLW材料清单.xlsx
-
Size
21KB
-
MD5
f69209557413e6965447c0f15e70ecd8
-
SHA1
d195258d5ae92bc7859ca70ac28126621be6c5d5
-
SHA256
6137e2572fe675037ff040803418a00e12e647a2c0df25023978df75c03b57b9
-
SHA512
9818b499e4c5ff74988ca74051e2846e62d3c57814d6c7bf43f9594b9dd48ab5688a8d345cafd760fc3cfb7c964dd2ec143c50f37ee2ea952bb5f9535abb6916
-
SSDEEP
384:jyzTYdPOn8a9pnO10dTaRobu20FfNTEZ3Ts5HqqsChC66dtdpHFc:jyzTgOnhO6Ta7JVAZ3WHu166TnHFc
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EXCEL.EXEpid process 4876 EXCEL.EXE
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4876-132-0x00007FF99C110000-0x00007FF99C120000-memory.dmpFilesize
64KB
-
memory/4876-133-0x00007FF99C110000-0x00007FF99C120000-memory.dmpFilesize
64KB
-
memory/4876-134-0x00007FF99C110000-0x00007FF99C120000-memory.dmpFilesize
64KB
-
memory/4876-135-0x00007FF99C110000-0x00007FF99C120000-memory.dmpFilesize
64KB
-
memory/4876-136-0x00007FF99C110000-0x00007FF99C120000-memory.dmpFilesize
64KB
-
memory/4876-137-0x00007FF9997B0000-0x00007FF9997C0000-memory.dmpFilesize
64KB