Analysis
-
max time kernel
153s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 12:42
Behavioral task
behavioral1
Sample
开心炉石 V3.51_破解版/dm.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
开心炉石 V3.51_破解版/dm.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
开心炉石 V3.51_破解版/使用前必看.doc
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
开心炉石 V3.51_破解版/使用前必看.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
开心炉石 V3.51_破解版/开心炉石 v3.51.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
开心炉石 V3.51_破解版/开心炉石 v3.51.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
最新QQ软件下载.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
最新QQ软件下载.url
Resource
win10v2004-20220901-en
General
-
Target
开心炉石 V3.51_破解版/使用前必看.doc
-
Size
638KB
-
MD5
9398f1e04bf34b39c56ee2d0823b9d9e
-
SHA1
926365f2186b0a63e5d5b42933499f42df993344
-
SHA256
10db95c9a3235bd88f7cf5e6d9da3aabb9461da6bbd6515701ef3e66656a92fd
-
SHA512
143d24888eb28d4ee436b4ec6e6d63658bebd931de98ea1b429d07f2e486e92ac60d55b7cf4ff53094c87dad72c72812a58c403c0ce03069cdc0eccd62e6e2fc
-
SSDEEP
12288:EN9fHq6WBhPtK6s/c6F79SGsYMAp1tXSiZEYw2XGarRjNAJW4QoFB1v:MtTWBhDG/VAcMAp14ehNA4K
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1668 WINWORD.EXE 1668 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE 1668 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\开心炉石 V3.51_破解版\使用前必看.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1668