0d2550dd62ff770b199e1843e64d433c426fc7412c2602956b56567fd41806c4

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

安天/审核通过/人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw.docx
Size

9KB
MD5

cc8fc32fde64854516c96d15c208b36c
SHA1

9f92eda406c184eb8fd97e47ea4b5edacb174621
SHA256

2b7c2b82fd1a66e6fe34dc9c5cd234048bd4ddc7907871ad32f18f1db7cafac1
SHA512

17c227c0f4b058aa821a17eaa978c5ba4c1cfe4d62e1bed96dbb5b490c78a0a1e29fb8cbf6cb15fab9c9772ffc0d26127494a85774b91e3af03c581e9e91c3cb
SSDEEP

192:ERFh24tVMKnefmU1PVhsXuTeXzG80U2tv1nmUk86DUf7rxxSH5uDYzjjmXMAlRaB:ERFcsGu+vRDWCy/Z2V1nxk86DkJkZu4r

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4036	WINWORD.EXE
4036	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4036	WINWORD.EXE
4036	WINWORD.EXE
4036	WINWORD.EXE
4036	WINWORD.EXE
4036	WINWORD.EXE
4036	WINWORD.EXE
4036	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\安天\审核通过\人大信访系统绕过登录后台文件上传导致getshell漏洞_142937_L_72597_2Dw9vBqw.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
0ac2b61a7b80429cda819fe670d85358

SHA1
a64e5bf4ecfbebb4245f4822d294b0d566fbf948

SHA256
50b745676ae13c7a98b3009dc4e45b46f1b3ab5c4b721175737e81acbe21ee06

SHA512
b271870cd928e372d9becf4280e3a7b379a196ac9ef8eade986c0c6eb1768450ebe77c92afe3775fccc8dda34f04b7e8730302b36e19d8212be9e01a70706e91

Download Submit
memory/4036-11-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-5-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-9-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-7-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-1-0x00007FF9E61D0000-0x00007FF9E61E0000-memory.dmp

Filesize
64KB

Download
memory/4036-12-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-13-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-14-0x00007FF9E38A0000-0x00007FF9E38B0000-memory.dmp

Filesize
64KB

Download
memory/4036-10-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-4-0x00007FF9E61D0000-0x00007FF9E61E0000-memory.dmp

Filesize
64KB

Download
memory/4036-8-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-15-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-16-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-17-0x00007FF9E38A0000-0x00007FF9E38B0000-memory.dmp

Filesize
64KB

Download
memory/4036-2-0x00007FF9E61D0000-0x00007FF9E61E0000-memory.dmp

Filesize
64KB

Download
memory/4036-3-0x00007FF9E61D0000-0x00007FF9E61E0000-memory.dmp

Filesize
64KB

Download
memory/4036-6-0x00007FF9E61D0000-0x00007FF9E61E0000-memory.dmp

Filesize
64KB

Download
memory/4036-37-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-36-0x00007FFA261ED000-0x00007FFA261EE000-memory.dmp

Filesize
4KB

Download
memory/4036-38-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-44-0x00007FFA26150000-0x00007FFA26345000-memory.dmp

Filesize
2.0MB

Download
memory/4036-0-0x00007FFA261ED000-0x00007FFA261EE000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads