Overview
overview
7Static
static
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
7附件2:...��.doc
windows10-2004-x64
7附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1附件2:...��.doc
windows7-x64
4附件2:...��.doc
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 04:24
Static task
static1
Behavioral task
behavioral1
Sample
附件2:业绩表/中级业绩表/67王佳艺.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
附件2:业绩表/中级业绩表/67王佳艺.doc
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
附件2:业绩表/中级业绩表/68黎荣.doc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
附件2:业绩表/中级业绩表/68黎荣.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
附件2:业绩表/中级业绩表/69沈陈锋.doc
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
附件2:业绩表/中级业绩表/69沈陈锋.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
附件2:业绩表/中级业绩表/70杨子奇.doc
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
附件2:业绩表/中级业绩表/70杨子奇.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
附件2:业绩表/中级业绩表/71许莹莹.doc
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
附件2:业绩表/中级业绩表/71许莹莹.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
附件2:业绩表/中级业绩表/72张华.doc
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
附件2:业绩表/中级业绩表/72张华.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
附件2:业绩表/中级业绩表/73朱竞.doc
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
附件2:业绩表/中级业绩表/73朱竞.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
附件2:业绩表/中级业绩表/74杨星星.doc
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
附件2:业绩表/中级业绩表/74杨星星.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
附件2:业绩表/中级业绩表/75吴平辉.doc
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
附件2:业绩表/中级业绩表/75吴平辉.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
附件2:业绩表/中级业绩表/76杨俊凯.doc
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
附件2:业绩表/中级业绩表/76杨俊凯.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
附件2:业绩表/中级业绩表/77陆小慧.doc
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
附件2:业绩表/中级业绩表/77陆小慧.doc
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
附件2:业绩表/中级业绩表/78张爱华.doc
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
附件2:业绩表/中级业绩表/78张爱华.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
附件2:业绩表/中级业绩表/79蔡永皓.doc
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
附件2:业绩表/中级业绩表/79蔡永皓.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
附件2:业绩表/中级业绩表/80冯旻涛.doc
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
附件2:业绩表/中级业绩表/80冯旻涛.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
附件2:业绩表/中级业绩表/81王凤玲.doc
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
附件2:业绩表/中级业绩表/81王凤玲.doc
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
附件2:业绩表/中级业绩表/82姜亦炜.doc
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
附件2:业绩表/中级业绩表/82姜亦炜.doc
Resource
win10v2004-20240419-en
General
-
Target
附件2:业绩表/中级业绩表/74杨星星.doc
-
Size
148KB
-
MD5
d26d2cc82e091f8e40266d378fa43dfb
-
SHA1
b05d98902a3f83a3e25e00cb70069aa7952ef369
-
SHA256
b499346f17e23309b268baa87cdc245907333faea6f0633b058df9bac6f16790
-
SHA512
9a4e5176d509dbbf6b461977b8bbfb4669c3adbd9dbd90ed5dcb657b428c52b2f3ad4d301d08db3474e1cf639970ee834c3583fd02a6caaaa3e9c8feb89d36f8
-
SSDEEP
768:kb4HOvE4Hqh3sD72rDYyvDYOjsODsvK4NsAf0cvuSFJQPhNGh9vzY5Vpgu+W7PIC:hHfypTiPhNGhtzY50z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4600 WINWORD.EXE 4600 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE 4600 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\附件2:业绩表\中级业绩表\74杨星星.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e