Overview
overview
7Static
static
7SuperTest.exe
windows7-x64
1SuperTest.exe
windows10-2004-x64
1supertest.chm
windows7-x64
1supertest.chm
windows10-2004-x64
1vbrun.exe
windows7-x64
7vbrun.exe
windows10-2004-x64
7计算机�...01.doc
windows7-x64
4计算机�...01.doc
windows10-2004-x64
1计算机�...01.doc
windows7-x64
4计算机�...01.doc
windows10-2004-x64
1计算机�...01.xls
windows7-x64
1计算机�...01.xls
windows10-2004-x64
1计算机�...01.xls
windows7-x64
1计算机�...01.xls
windows10-2004-x64
1计算机�...02.doc
windows7-x64
4计算机�...02.doc
windows10-2004-x64
1计算机�...02.doc
windows7-x64
4计算机�...02.doc
windows10-2004-x64
1计算机�...02.xls
windows7-x64
1计算机�...02.xls
windows10-2004-x64
1计算机�...02.xls
windows7-x64
1计算机�...02.xls
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 23:59
Behavioral task
behavioral1
Sample
SuperTest.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SuperTest.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
supertest.chm
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
supertest.chm
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
vbrun.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
vbrun.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
计算机基本技能/操作题/01.doc
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
计算机基本技能/操作题/01.doc
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
计算机基本技能/操作题/01.doc
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
计算机基本技能/操作题/01.doc
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
计算机基本技能/操作题/01.xls
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
计算机基本技能/操作题/01.xls
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
计算机基本技能/操作题/01.xls
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
计算机基本技能/操作题/01.xls
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
计算机基本技能/操作题/02.doc
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
计算机基本技能/操作题/02.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
计算机基本技能/操作题/02.doc
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
计算机基本技能/操作题/02.doc
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
计算机基本技能/操作题/02.xls
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
计算机基本技能/操作题/02.xls
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
计算机基本技能/操作题/02.xls
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
计算机基本技能/操作题/02.xls
Resource
win10v2004-20240412-en
General
-
Target
计算机基本技能/操作题/01.doc
-
Size
19KB
-
MD5
2c069a36e452e3c503aad567f6c4aa07
-
SHA1
d0a0df1d0b8ea06496c71197bb29c9c1fc3b887b
-
SHA256
1e51ab6b857ffef25a706f03e804f586cf3c8f6e87fbeae8c28be92372e20181
-
SHA512
5d7d13ec2697d8a483b4ee1cda97eaa6244312a5d7bdbac1de9ed7d11586aefb20906cec5b175ada04c408417a92ad1cfe05ff0aacd08278436bdd5212b4f228
-
SSDEEP
96:FGntDcvLf1K1sGYbL7i+lc4Vo9hJh/ZYAAdn3Va:FGntQvj1E0PiedlV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3300 WINWORD.EXE 3300 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE 3300 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\计算机基本技能\操作题\01.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e