879361ce369ace56a83cd94c526a34fbf7e9a701a03dec8e57ada6164d538843

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/03/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe
Size 1.6MB
Sample260303-anyvssey8f
SHA256 879361ce369ace56a83cd94c526a34fbf7e9a701a03dec8e57ada6164d538843
MD5 2c8f6e06dc22f00abdee164581fa553d
SHA1 171fe7391d040bdff32133d3445954a35fe1168e
SHA512 7f7ef268a4fe02f05b3c5aaf5f10abd9d9f09b0f489d0858bd02d12a40ee4bb6d2acedc8f3cd9794a01ea3a57a9cba4f752cb1bde3b4f56d57c22a0da601da2e
SSDEEP 24576:LLILY8Xu/3y8UsG2BgYLicwnkNCHdebUKyZURQ1TgjTH:8YrC8UsGuTw0CHdeQKyZURQ1EjTH
TLSH
T16B755AD2F181C4B6E81301B18D3E9F20255ABE79576465DB628E772E4AB32C32477E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\mls = "\"C:\\Users\\Admin\\AppData\\Roaming\\RAC\\mls.exe\" -s"	17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
444	WINWORD.EXE
444	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
444	WINWORD.EXE
444	WINWORD.EXE
444	WINWORD.EXE
444	WINWORD.EXE
444	WINWORD.EXE
444	WINWORD.EXE
444	WINWORD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 444	2628	17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe	82

C:\Users\Admin\AppData\Local\Temp\17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe
"C:\Users\Admin\AppData\Local\Temp\17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.doc

Path C:\Users\Admin\AppData\Local\Temp\17.%20%C3%90%CB%9C%C3%90%C2%B3%C3%91%E2%82%AC%C3%91%E2%80%B9%20%C3%90%C2%B4%C3%90%C2%BB%C3%91%EF%BF%.doc
Size 19KB
SHA256 204b53afcb72c24522c0d1b2183b0d9f8c91f186e112006ea9530664fa8633a7
MD5 06d5ab8e2cd2153671680a62ac06a6e8
SHA1 997ab1a060c41592cc94bcc46afb9fab0998762a
SHA512 4bbf42d0a8a6d432002f87f1735e508fd742a888a78b88b0b5ef49151de89c53215e6157782fb19cc39ba993d8c7ec3198fcafb0518d93da99441ee905201a44
SSDEEP 192:9vaNNrTBYb+XLPYDrNowYtiaon54083Qvw99ESaBi1QD:9xgwDrItihv83SUK
TLSH
T18792DD4FF67DDA64F464D3701A9386DA10B67F106B25968AA28F7E38703CB313325287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

685625989.tmp

Path C:\Users\Admin\AppData\Local\Temp\685625989.tmp
Size 1.6MB
SHA256 879361ce369ace56a83cd94c526a34fbf7e9a701a03dec8e57ada6164d538843
MD5 2c8f6e06dc22f00abdee164581fa553d
SHA1 171fe7391d040bdff32133d3445954a35fe1168e
SHA512 7f7ef268a4fe02f05b3c5aaf5f10abd9d9f09b0f489d0858bd02d12a40ee4bb6d2acedc8f3cd9794a01ea3a57a9cba4f752cb1bde3b4f56d57c22a0da601da2e
SSDEEP 24576:LLILY8Xu/3y8UsG2BgYLicwnkNCHdebUKyZURQ1TgjTH:8YrC8UsGuTw0CHdeQKyZURQ1EjTH
TLSH
T16B755AD2F181C4B6E81301B18D3E9F20255ABE79576465DB628E772E4AB32C32477E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD5993.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/444-33-0x00007FFF50350000-0x00007FFF50360000-memory.dmp

Download

memory/444-28-0x00007FFF50350000-0x00007FFF50360000-memory.dmp

Download

memory/444-37-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-35-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-40-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-39-0x00007FFF4DBD0000-0x00007FFF4DBE0000-memory.dmp

Download

memory/444-36-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-30-0x00007FFF50350000-0x00007FFF50360000-memory.dmp

Download

memory/444-29-0x00007FFF50350000-0x00007FFF50360000-memory.dmp

Download

memory/444-38-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-31-0x00007FFF90364000-0x00007FFF90365000-memory.dmp

Download

memory/444-41-0x00007FFF4DBD0000-0x00007FFF4DBE0000-memory.dmp

Download

memory/444-34-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-60-0x00007FFF902C0000-0x00007FFF904C9000-memory.dmp

Download

memory/444-32-0x00007FFF50350000-0x00007FFF50360000-memory.dmp

Download

memory/2628-61-0x0000000002AC0000-0x0000000002C0D000-memory.dmp

Download

memory/2628-484-0x0000000002AC0000-0x0000000002C0D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads