Overview
overview
7Static
static
6A60-Tools-v2.exe
windows7-x64
1A60-Tools-v2.exe
windows10-2004-x64
1adb/AdbWinApi.dll
windows7-x64
3adb/AdbWinApi.dll
windows10-2004-x64
3adb/AdbWinUsbApi.dll
windows7-x64
1adb/AdbWinUsbApi.dll
windows10-2004-x64
3adb/adb.exe
windows7-x64
1adb/adb.exe
windows10-2004-x64
1adb/flash_image
debian-9-armhf
adb/root
debian-9-armhf
1adb/sqlite3
debian-9-armhf
soft/Br.apk
soft/Br.apk
android-10-x64
soft/Br.apk
android-11-x64
soft/RE.apk
soft/RE.apk
android-10-x64
soft/RE.apk
android-11-x64
soft/busybox
debian-9-armhf
1soft/su
debian-9-armhf
soft/superuser.apk
soft/superuser.apk
android-10-x64
soft/superuser.apk
android-11-x64
�...��.doc
windows7-x64
4�...��.doc
windows10-2004-x64
1�...l6.msi
windows7-x64
7�...l6.msi
windows10-2004-x64
7驱动教�...v2.exe
windows7-x64
1驱动教�...v2.exe
windows10-2004-x64
1驱动教�...pi.dll
windows7-x64
3驱动教�...pi.dll
windows10-2004-x64
3驱动教�...pi.dll
windows7-x64
1驱动教�...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
A60-Tools-v2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
A60-Tools-v2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
adb/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
adb/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
adb/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
adb/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
adb/adb.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
adb/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
adb/flash_image
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral10
Sample
adb/root
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral11
Sample
adb/sqlite3
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral12
Sample
soft/Br.apk
Behavioral task
behavioral13
Sample
soft/Br.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral14
Sample
soft/Br.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral15
Sample
soft/RE.apk
Behavioral task
behavioral16
Sample
soft/RE.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral17
Sample
soft/RE.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral18
Sample
soft/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral19
Sample
soft/su
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral20
Sample
soft/superuser.apk
Behavioral task
behavioral21
Sample
soft/superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral22
Sample
soft/superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral23
Sample
/A60߲20110830.doc
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
/A60߲20110830.doc
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
/msxml6/msxml6.msi
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
/msxml6/msxml6.msi
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
驱动教程ROOT/A60-Tools-v2.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
驱动教程ROOT/A60-Tools-v2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
驱动教程ROOT/adb/AdbWinApi.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
驱动教程ROOT/adb/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
驱动教程ROOT/adb/AdbWinUsbApi.dll
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
驱动教程ROOT/adb/AdbWinUsbApi.dll
Resource
win10v2004-20231222-en
General
-
Target
/A60߲20110830.doc
-
Size
1.0MB
-
MD5
6a2d9ad5b4eedb6cf0bbf0f7eb8fc63e
-
SHA1
348ca9f10803c8a4dec7489538ca6a4ed8d58863
-
SHA256
6ae1c570387dfc23776b3492b8d1607753b5da4b04d5f5d26057847f7c4524eb
-
SHA512
72dd227494334fb42bf1ca0bb4f50fc7c3743fe74f918a587dce03250320744866e072779b9ed28cf3f289d624b883fa735b15eb2c522ec1ec031698069427d3
-
SSDEEP
24576:v4SsEXe7TCP3xCIiByixbGl2VUHJPrp70Qp0fJ9uk83tyq0X6r0H:v4We/CfXiXCsVcCQpy83oPy
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4092 WINWORD.EXE 4092 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE 4092 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\\A60߲20110830.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84