Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 02:54
Behavioral task
behavioral1
Sample
11温州市中小学骨干考核 (1).doc
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
11温州市中小学骨干考核 (1).doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
11温州市中小学骨干考核.doc
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
11温州市中小学骨干考核.doc
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
新秀中坚宿将考核表11.xls
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
新秀中坚宿将考核表11.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
马上用三个层次(骨干考核).xls
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
马上用三个层次(骨干考核).xls
Resource
win10v2004-20221111-en
General
-
Target
11温州市中小学骨干考核 (1).doc
-
Size
41KB
-
MD5
fbada3563affbe76265b03e5e58edbb0
-
SHA1
72ca88b7ef4ab8f69fdbfda95798145995022eb0
-
SHA256
4910727a53e45779cd447279f3489b63f7976da5f1c86cb551319dd033bfb875
-
SHA512
b432b7661ad30af50c196b609897f1d6db9e49ef202ee1a7a2cb902213d990a47c4e7595fa571e7e708ecdc12e8de31c0d9f7e82f22d36ca944a5ddde47cd7f3
-
SSDEEP
192:9le7KKKLWhc0HroZytdPU1iLK9m+iaLzxyuAe2l2xjHFdaqovbWWNM5aaaano1PZ:9A7D2oroKJVNGRweqvgoWJwLFWH
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1648 WINWORD.EXE 1648 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
WINWORD.EXEpid process 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE 1648 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\11温州市中小学骨干考核 (1).doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-132-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-133-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-134-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-135-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-136-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-137-0x00007FFF18990000-0x00007FFF189A0000-memory.dmpFilesize
64KB
-
memory/1648-138-0x00007FFF18990000-0x00007FFF189A0000-memory.dmpFilesize
64KB
-
memory/1648-140-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-141-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-142-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB
-
memory/1648-143-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmpFilesize
64KB