Overview
overview
4Static
static
1PHP搜索�...��.rtf
windows7-x64
4PHP搜索�...��.rtf
windows10-2004-x64
1PHP搜索�...t.html
windows7-x64
3PHP搜索�...t.html
windows10-2004-x64
3PHP搜索�...o.html
windows7-x64
3PHP搜索�...o.html
windows10-2004-x64
1PHP搜索�...n.html
windows7-x64
3PHP搜索�...n.html
windows10-2004-x64
3PHP搜索�...x.html
windows7-x64
3PHP搜索�...x.html
windows10-2004-x64
3PHP搜索�...ze.htm
windows7-x64
3PHP搜索�...ze.htm
windows10-2004-x64
3PHP搜索�...e.html
windows7-x64
3PHP搜索�...e.html
windows10-2004-x64
3PHP搜索�...h.html
windows7-x64
3PHP搜索�...h.html
windows10-2004-x64
3PHP搜索�...e.html
windows7-x64
3PHP搜索�...e.html
windows10-2004-x64
3PHP搜索�...t.html
windows7-x64
3PHP搜索�...t.html
windows10-2004-x64
3PHP搜索�...0.html
windows7-x64
3PHP搜索�...0.html
windows10-2004-x64
3PHP搜索�...g.html
windows7-x64
3PHP搜索�...g.html
windows10-2004-x64
3PHP搜索�...o.html
windows7-x64
3PHP搜索�...o.html
windows10-2004-x64
3PHP搜索�...p.html
windows7-x64
3PHP搜索�...p.html
windows10-2004-x64
3PHP搜索�...o.html
windows7-x64
3PHP搜索�...o.html
windows10-2004-x64
3PHP搜索�...eDb.js
windows7-x64
3PHP搜索�...eDb.js
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
PHP搜索引擎20110614bate版/PHP搜索引擎正式版_系统解决方案应用说明.rtf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PHP搜索引擎20110614bate版/PHP搜索引擎正式版_系统解决方案应用说明.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PHP搜索引擎20110614bate版/a/about.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PHP搜索引擎20110614bate版/a/about.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
PHP搜索引擎20110614bate版/a/baocuo.html
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PHP搜索引擎20110614bate版/a/baocuo.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
PHP搜索引擎20110614bate版/a/down.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
PHP搜索引擎20110614bate版/a/down.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
PHP搜索引擎20110614bate版/a/index.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
PHP搜索引擎20110614bate版/a/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
PHP搜索引擎20110614bate版/a/mianze.htm
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
PHP搜索引擎20110614bate版/a/mianze.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
PHP搜索引擎20110614bate版/a/mianze.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
PHP搜索引擎20110614bate版/a/mianze.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
PHP搜索引擎20110614bate版/a/search.html
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
PHP搜索引擎20110614bate版/a/search.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
PHP搜索引擎20110614bate版/a/site.html
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
PHP搜索引擎20110614bate版/a/site.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
PHP搜索引擎20110614bate版/a/soupet.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
PHP搜索引擎20110614bate版/a/soupet.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
PHP搜索引擎20110614bate版/a/soupet_net_phpv1.0.html
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
PHP搜索引擎20110614bate版/a/soupet_net_phpv1.0.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
PHP搜索引擎20110614bate版/a/tg.html
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
PHP搜索引擎20110614bate版/a/tg.html
Resource
win10v2004-20240910-en
Behavioral task
behavioral25
Sample
PHP搜索引擎20110614bate版/a/tijao.html
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
PHP搜索引擎20110614bate版/a/tijao.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
PHP搜索引擎20110614bate版/a/wap.html
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
PHP搜索引擎20110614bate版/a/wap.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
PHP搜索引擎20110614bate版/a/youdao.html
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
PHP搜索引擎20110614bate版/a/youdao.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
PHP搜索引擎20110614bate版/admin/ChangeDb.js
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
PHP搜索引擎20110614bate版/admin/ChangeDb.js
Resource
win10v2004-20240802-en
General
-
Target
PHP搜索引擎20110614bate版/PHP搜索引擎正式版_系统解决方案应用说明.rtf
-
Size
3KB
-
MD5
5f88c994a1217e889429e4be5669bfc6
-
SHA1
e1406cda52f03f3490bd42a696da7c52106078fb
-
SHA256
e8c198aa1aecc13e41e5e8a40582b5ee0abc5a3a24775cea1dd5369baa454383
-
SHA512
e7387794997070759a308077b6df3e3c9c744c6b57777e7fddb856785b3987e66a61f8cade5ab8c0e941aadf62be82016e3cc14d65b699d686f03cbe6c46b0fc
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2424 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 WINWORD.EXE 2424 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2540 2424 WINWORD.EXE 30 PID 2424 wrote to memory of 2540 2424 WINWORD.EXE 30 PID 2424 wrote to memory of 2540 2424 WINWORD.EXE 30 PID 2424 wrote to memory of 2540 2424 WINWORD.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PHP搜索引擎20110614bate版\PHP搜索引擎正式版_系统解决方案应用说明.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD59ac745ba51271b195672d461849da970
SHA145e29e734f5f1ff53f9e3d8d289d8f4d3e367e00
SHA2561055381d7ef6faa64da7efae117f77a4b5f1ea7ee9813dfba4ef27842b00ba68
SHA512403ad8e62a3a8662a43dd8bf77791e21af72ca829b9d03516fd96ed8e673a5dbb0633603b1f4b6a932f7ae9b30d6a1a279a9fc574b6e3a5982fb6bbe26aad2b2