c90df0d38a28a63ee427b88e998de97d9df4c2d3af30dc999e0c8303494d5515

Sharing

Copy URL Twitter E-mail

General

Target
24072026_0536_总统人格、情境条件与美国危机决策中的武力运用问题（稿件）.img.zip
Size 2.2MB
Sample260724-gadq2ashnc
SHA256 c90df0d38a28a63ee427b88e998de97d9df4c2d3af30dc999e0c8303494d5515
MD5 68124f029a5fafc3733fbc7c43db1e07
SHA1 a14016cae6b6b77aff713bc4fd19dc1e08aad4c0
SHA512 0dd1025b208491894757f6c88a0ef9306fddf14fc7df263761350f8b11844c7311ac3151ac159c46d0aaab917ca64c1553ed8fa908fc8a84e545d52bcc54e7e5
SSDEEP 49152:11CIBfPiLm+qyZLoA8iSyU3hHxch7kRiGZlRVBHZC7:188fqL9UA8iSyU9S9klRvHZS
TLSH
T115B5332881FD2674CBE51A6EDBF5F7A2DC29AA119E4BC641D7079A33CF80D9884343C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  0603《国际论坛》专家评审意见表.docx
- Size 65KB
- SHA256 85849ea47230a4a7c98db81ae7fcc5ef727375a9f31e560e98963246038919c5
- MD5 e09f36f3c8b88a49732e58e64be548fe
- SHA1 74bb2388744b608f3329d80da3990566262e3c8c
- SHA512 583b565237d59faff39f682d398f993b5f19e7ec0b294649c1af4aa60b8104e8f9e6982dcfcd79fb67de1185ceb3b13ba174a94886a8af7b661d2dd7aee7d06f
- SSDEEP 1536:joSreL1jtOlFsUQqv51DiP/n3Dier3bxj4QC2NPma/rh:ESreLptOTVBMH357l0D2b
- TLSH
  T10863025DF11CFE41E2933AF022570385FB5770C9770A28AB2D585FA58AF110B254A6EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  专家评审费用发放明细表.xlsx
- Size 19KB
- SHA256 7ccaaa49a0eb45afbbca746e877fd95a86e579b1381d749bce81464deb2fd7ce
- MD5 d13b06a2014abe4f93f9d98b62a20a20
- SHA1 498328fc837826c465e904c7886a35409764aef3
- SHA512 4fd9ed7f49688e34f60c83c065b715cc971f17ac875b44c39316f83917f740d5a41c970f7a1ca56f361ce97eb0a86b57e641bb018b842d4433329e34428c11ae
- SSDEEP 384:Bj68PMIs9utd7z5cAFMraYwBK3D5cq7BkOif/pbd/sc1KPMNZ4Zh:88PMIs9qd5vmrabBK3DaEkO0/J6BZZh
- TLSH
  T1D892A0B7D61818BBC21170F9835533474B6EF0A1E54BE98A5C26ACDC5D0B1FC2B4EA1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ·/HOmVe2f.vbs
- Size 1KB
- SHA256 89b748066454a9fc74fc113e1de2178f1120124f41c3d9640efa5ec74d27dfde
- MD5 1124092f3de057976a3ef62dbcb14f2e
- SHA1 5582e724f51beba494ce50432fbbc847a38d342b
- SHA512 27ff45dc93fbcde31a6ade384a800bd64d834e9032124e3c8cf5f53195937662b1f997f16fa96a5d8dd8c1043fe9768d10305785f400ebfee7b4d8e77cc841e4
- TLSH
  T18231D0029C36B670F440965600AA986E495226BE7B3016CA7A3C069D0F2D5FDD1BC7D7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  ·/LIBEAY32.dll
- Size 1.7MB
- SHA256 dfe8a0819c1daede4df410f2016d86fb074245794eec5f2e639fd754637bdff3
- MD5 dcb67dbef8532e87dccc78a06a27e72a
- SHA1 7cc7b25aec66c0e71cbcf2058e8f1049e2bd0c70
- SHA512 eec3f6dc94f7831561a5c784d0d95a9f589065a144185160b1e7919d21acf87eca80df8d8fb3ee5b4ff1a2a504a2bf92c8bb7e8e6238284a34bf40253f0988ae
- SSDEEP 49152:UkKXPXgoGxPMHBb4dDYiAtm+2M7R4zpe0QqQCP:KNmmma7jqQ
- TLSH
  T1CB855B22A75815E5DABBC278D5738A1BD3F1B41503B0EBDF4B6845B81F53BDA227A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ·/analyzer.exe
- Size 174KB
- SHA256 1eff7e3d88323554f73c73e6f4ced30457a5d11c8ed52dda0d923ea96e7368cd
- MD5 667b58c7555d699bb710b08364fb2edc
- SHA1 e282982d1646689cf8937a03d2dda6e48ff7f3b9
- SHA512 400a63b86032d4cc58a0319a6d5c67bc8ee7e79c6eaeb0ae0140fe74037267435630964c3b6aa01972f10c86a1a5821f3506d44cbd4e6edd924a1e14bba42d37
- SSDEEP 3072:YW4nzMmERHjn5tR8S9aEo/e3JzwaId5ZR8iTmR84K4GSjvaKTNYQRQOnD/:YWwEZTWS9aEoWWd5vzmR84u4RNg+/
- TLSH
  T153046A1B366920F9C1A7E13CD6825A03F7B27496032187DF43A086762F577E4BE3DA61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral10 behavioral9
- Target
  ·/mglobal.dll
- Size 1.0MB
- SHA256 ba91deb9568dcb11c2943a57ae596cebd4fbe3d5a1e1967aa4ffb52296b565ea
- MD5 c2d6795881b2444cc08e846e8fdb7d78
- SHA1 bcacb91ef6c89026fd8712bf46c0f2390c90cd08
- SHA512 fa6aaa33ab795133bbcb86b3e2e94d6d2d0849824827f48e3b7f5714f3d873de4d134c57d66db3930618a73456cb6d4310d1e049a6d402805e2500782307d649
- SSDEEP 24576:ZgBrfn7t3nuk7IKbXYogxSMtY9GwyzA2l:ZgBzn7t3FsuYogxSv9JyU
- TLSH
  T199352917E2A748ECC52BC47487679772B931B86942347E7F1A94D7322F20E60976EB30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application
  persistence
behavioral11 behavioral12
- Target
  ·/msvcp140.dll
- Size 552KB
- SHA256 d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
- MD5 cd0c37f1875b704f8eb08e397381ac16
- SHA1 249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
- SHA512 d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5
- SSDEEP 12288:C/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6z/yjQEKZm+jWodm:EN59IW6z/8QEKZm+jWodEEY
- TLSH
  T1CBC41923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ·/vcruntime140.dll
- Size 94KB
- SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
- MD5 11d9ac94e8cb17bd23dea89f8e757f18
- SHA1 d4fb80a512486821ad320c4fd67abcae63005158
- SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
- SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
- TLSH
  T14C936B4A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6866A5F67BE05E3D355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ·/vcruntime140_1.dll
- Size 36KB
- SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
- MD5 7667b0883de4667ec87c3b75bed84d84
- SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
- SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
- SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
- TLSH
  T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ·/稿件.docx
- Size 310KB
- SHA256 3cc737d1e512576962fe2ec96d1f37e27a4353f824521af33d758e9cca9cb5b6
- MD5 bc13dc870c3c3367c11bf3a4f0301869
- SHA1 66d3c5e9537d792bffb5be9d08b2f366a5ac66ea
- SHA512 72a645510f781b462fdb0b04e0c33d127d48cb0b986c1d1e5d1c8489cd121738e69c7c72e258b25e0ffc0849d29cdb23345dd76b61e7ad79849920c793b6d87a
- SSDEEP 6144:BA1j/0Wau5gyq6p1QedpTcfrUrJAHF4dCeFGv/TTzQ0J:Boj/0Wau5gQpygGfbF4MesHfzfJ
- TLSH
  T12B64F103DD04DA97E81953FCBC624DE82E2A273DE4427EFF053A8ECB5A515224D970AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  稿件.docx.lnk
- Size 462B
- SHA256 83cf79ebe693d78f122d64cf7f033e0704ad5fed24c12240a3dab455ed9be724
- MD5 f8202f44303c6bc9caaca932b1ab4208
- SHA1 22d63382f78229f78d5f028b40e5cca2a9b15e4c
- SHA512 4d650fd67a8f263568473793fb2fa03b255f9d7c75d9bf493a80de59305dfe16461ccd64f7db59cb3f92cf78eeeb2053cdc3e7fdb2b2d55100bbaec874969a5e
- TLSH
  T1AAF0223316F94A6CF3B3C93105724F00AD39B660EE1242CC08C9AC5E6960901CDB2E0A
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Executes a VBScript file via the Windows Script Host.

Adds Run key to start application

Badlisted process makes network request

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22