b0cfdcf69000bd3019797036ae343156b90a08db707d3c9bd3557fe3e689ce07

General

Target

投诉举报信/投诉举报.docx.lnk
Size

1KB
MD5

74d87654703bd0f0d1b195e1aee796b1
SHA1

96c49465e9835e5e5cb486bcbda8722bacdbff20
SHA256

50a93c94854a0693b440f8084ace7efd8e70c0170dcd5c66ec1f4af74c237195
SHA512

8b4d9ae85d3d0570c95ddabc51afd7dd76d308b330a7058136c047519f8f9722ea47532c640dff057f32d9a28e6ba697e36a71ad6433665a3ee5ff01bd1cc9e4

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2580	live.exe

Loads dropped DLL 1 IoCs

pid	Process
2580	live.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Silverlight.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	live.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	Silverlight.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2156	WINWORD.EXE
2156	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2156	WINWORD.EXE
2156	WINWORD.EXE
2156	WINWORD.EXE
2156	WINWORD.EXE
2156	WINWORD.EXE
2156	WINWORD.EXE
2156	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4164	1416	cmd.exe	84
PID 1416 wrote to memory of 4164	1416	cmd.exe	84
PID 5096 wrote to memory of 4312	5096	explorer.exe	88
PID 5096 wrote to memory of 4312	5096	explorer.exe	88
PID 5096 wrote to memory of 4312	5096	explorer.exe	88
PID 4312 wrote to memory of 2580	4312	Silverlight.exe	91
PID 4312 wrote to memory of 2580	4312	Silverlight.exe	91
PID 4312 wrote to memory of 2580	4312	Silverlight.exe	91
PID 4312 wrote to memory of 2156	4312	Silverlight.exe	96
PID 4312 wrote to memory of 2156	4312	Silverlight.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\投诉举报信\投诉举报.docx.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" __MACOS\Silverlight.exe
  2⤵
  PID:4164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\投诉举报信\__MACOS\Silverlight.exe
  "C:\Users\Admin\AppData\Local\Temp\投诉举报信\__MACOS\Silverlight.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Public\live.exe
    C:\Users\Public
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\投诉举报信\__MACOS\temp.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD42C3.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Public\bin.dat

Filesize
477KB

MD5
d00c9345f1a2f62293ce28d8d9d5a8bb

SHA1
58de8f672bbf5309278096e526596156cc01c171

SHA256
cf448de1cb1ad1b191656b753a7ccc06703ea0763058d442f3063e2fa46d13ff

SHA512
c879129f185392bfa72758e85eca4d876b50110b3a0a1dd3d15717992c9cc173fab660ee684d461f4c8051571caf7874e7cf2a502c68b1c1282052caa02a1e30

Download Submit
C:\Users\Public\coreclr.dll

Filesize
94KB

MD5
627daded4357e26919d071b0c8a60a42

SHA1
02262b139b43788eb8b97fd6e551192189523114

SHA256
3cd7109bc2f60897bedc381b319dda79e0f6695ced7d00d60a8e0eadd9f9cec0

SHA512
d838445154d568575765857e2a2f222d4734b0b2930e6b4bab575a34186a317800779e134539a750a1787242678094b3989971d2b1690dd6c3a92448ea3071fa

Download Submit
C:\Users\Public\live.exe

Filesize
340KB

MD5
4c2e417f278e73460b65feed1f3c2d58

SHA1
9bfcdb1534de42afc1e5e4fee3cdd354e641ef29

SHA256
ef71193071cc0022a0c504f898b6fd2f68ef55e8fc1d8cfdccf623c0060b8eda

SHA512
1ca161b1ebce480424c1f18daf7c4213270f89d8c5fb6788adaf306dfa547edb167fa815e07861eb7276dc26782b042a0a3c7e0ed6eedcae8222053324a4c96b

Download Submit
memory/2156-14-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-167-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-12-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-13-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-10-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-15-0x00007FF993BA0000-0x00007FF993BB0000-memory.dmp

Filesize
64KB

Download
memory/2156-16-0x00007FF993BA0000-0x00007FF993BB0000-memory.dmp

Filesize
64KB

Download
memory/2156-168-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-169-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-166-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2156-11-0x00007FF995C30000-0x00007FF995C40000-memory.dmp

Filesize
64KB

Download
memory/2580-9-0x0000000001210000-0x0000000001288000-memory.dmp

Filesize
480KB

Download
memory/2580-32-0x0000000001210000-0x0000000001288000-memory.dmp

Filesize
480KB

Download
memory/2580-31-0x0000000002FF0000-0x0000000003462000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads