Analysis
-
max time kernel
135s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18-03-2024 11:54
General
-
Target
ha_Photilla-v1.0/Photilla 1.00/汉化说明.rtf
-
Size
22KB
-
MD5
9369fa1610033b179d935c6a7004e577
-
SHA1
e68fbbe81f7f9ceaa3d3c7b6d8a4dac4cca40744
-
SHA256
c668e7e4e53fb9e60d1f93e848e90c2988d5e3b96139dd82087cdd92ec88df0e
-
SHA512
b53f2342ded4c76b412100583f006506a5502fec7af58b080e858bcd97ac45f52a8cc5864a3020195105c5865dcbb045bd1d126edf0f9c44c431cc0f6e23d503
-
SSDEEP
192:BTdDY93rit0N1yPfyNccTN6KyzcBv//sPT6tTfRzlY6kJ3qCg9yPYaAk5kxin1tC:BTdDu9RkJ3qCgaas1tC
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ha_Photilla-v1.0\Photilla 1.00\汉化说明.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB