Analysis
-
max time kernel
150s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:57
Behavioral task
behavioral1
Sample
2015届学生毕业设计指导老师安排表.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2015届学生毕业设计指导老师安排表.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
2015届毕业生就业证明函/2015届毕业生就业证明函模板.doc
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
2015届毕业生就业证明函/2015届毕业生就业证明函模板.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
2015届毕业生就业证明函/说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
2015届毕业生就业证明函/说明.doc
Resource
win10v2004-20221111-en
General
-
Target
2015届毕业生就业证明函/2015届毕业生就业证明函模板.doc
-
Size
19KB
-
MD5
e2848f1423c6d74d1d22ab7b5038b204
-
SHA1
f54af0ba347f8f24f5dfdaf6aa3aa722408de771
-
SHA256
133a78014d4c9845d72ce20351d4707d5ce59d778412491fcfb2b42e7d725801
-
SHA512
611f129beb58e93b29c6959aa8d878319738b7dcf546b404971837b6d46b11f3878550c4ac739887fee6e24d8601d41f9c607fa59a340bf7550eb2987e74a562
-
SSDEEP
192:wP74Wq3drb/LPqOLHpuI+MVZ4ryNcLlQMIs4Z65JwAMcQcQAun4VVE9hyiV0h319:24l31brETyKRq6GRE9000Q1xbmXBq
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4680 WINWORD.EXE 4680 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
WINWORD.EXEpid process 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2015届毕业生就业证明函\2015届毕业生就业证明函模板.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4680-132-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/4680-133-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/4680-134-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/4680-135-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/4680-136-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/4680-137-0x00007FFD3E6B0000-0x00007FFD3E6C0000-memory.dmpFilesize
64KB
-
memory/4680-138-0x00007FFD3E6B0000-0x00007FFD3E6C0000-memory.dmpFilesize
64KB