Analysis

  • max time kernel
    135s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 04:24

General

  • Target

    附件2:业绩表/中级业绩表/74杨星星.doc

  • Size

    148KB

  • MD5

    d26d2cc82e091f8e40266d378fa43dfb

  • SHA1

    b05d98902a3f83a3e25e00cb70069aa7952ef369

  • SHA256

    b499346f17e23309b268baa87cdc245907333faea6f0633b058df9bac6f16790

  • SHA512

    9a4e5176d509dbbf6b461977b8bbfb4669c3adbd9dbd90ed5dcb657b428c52b2f3ad4d301d08db3474e1cf639970ee834c3583fd02a6caaaa3e9c8feb89d36f8

  • SSDEEP

    768:kb4HOvE4Hqh3sD72rDYyvDYOjsODsvK4NsAf0cvuSFJQPhNGh9vzY5Vpgu+W7PIC:hHfypTiPhNGhtzY50z

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\附件2:业绩表\中级业绩表\74杨星星.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDAAAE.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/4600-18-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-544-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-16-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-0-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-5-0x00007FF89B78D000-0x00007FF89B78E000-memory.dmp

    Filesize

    4KB

  • memory/4600-6-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-8-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-10-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-11-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-9-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-7-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-13-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-12-0x00007FF859470000-0x00007FF859480000-memory.dmp

    Filesize

    64KB

  • memory/4600-14-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-4-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-20-0x00007FF859470000-0x00007FF859480000-memory.dmp

    Filesize

    64KB

  • memory/4600-1-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-19-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-21-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-22-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-17-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-23-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-15-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-301-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-311-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4600-3-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-540-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-541-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-543-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-542-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB

  • memory/4600-2-0x00007FF85B770000-0x00007FF85B780000-memory.dmp

    Filesize

    64KB