Analysis
-
max time kernel
99s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:29
Static task
static1
Behavioral task
behavioral1
Sample
白莲小学综合楼施工图/浠水白莲中心小学修改/节能(修改-01a)/白莲小学综.rtf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
白莲小学综合楼施工图/浠水白莲中心小学修改/节能(修改-01a)/白莲小学综.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
白莲小学综合楼施工图/浠水白莲中心小学修改/节能(修改-01a)/白莲小学综.doc
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
白莲小学综合楼施工图/浠水白莲中心小学修改/节能(修改-01a)/白莲小学综.doc
Resource
win10v2004-20220901-en
General
-
Target
白莲小学综合楼施工图/浠水白莲中心小学修改/节能(修改-01a)/白莲小学综.doc
-
Size
63KB
-
MD5
d57b96ca16e5533bfc724c109a2d957f
-
SHA1
0b7e7779a31a0930d499c0ec5a64a6e4cf754463
-
SHA256
9af95ed3c0dc8deaf5444b72a7a648f7150d7a4b2ccb131f295da10133001e7a
-
SHA512
01d2098053b560b5771f31fea7347dc59e16cc24de2e419b68c10345e3ac05a3b42ae588099198739496c13b91c4163b6710ac6c8dca128a48977d56d1b50efe
-
SSDEEP
384:WKn9KjiorvxKB+Upd9xQltAduaQaJaxaoagafJkrlbDNyGcSxwAjLDY3g/yNE:W89Kjiorv4B+Up/q6JJkrlbDzfd
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4512 WINWORD.EXE 4512 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE 4512 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\白莲小学综合楼施工图\浠水白莲中心小学修改\节能(修改-01a)\白莲小学综.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4512-132-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-133-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-134-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-135-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-136-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-137-0x00007FFDF4E50000-0x00007FFDF4E60000-memory.dmpFilesize
64KB
-
memory/4512-138-0x00007FFDF4E50000-0x00007FFDF4E60000-memory.dmpFilesize
64KB
-
memory/4512-140-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-141-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-142-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB
-
memory/4512-143-0x00007FFDF6EB0000-0x00007FFDF6EC0000-memory.dmpFilesize
64KB