Analysis
- user interaction
yes - max time kernel
22s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
stub.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target stub.exe
- Size 36.8MB
- Sample260417-e7nw6aaw4z
- SHA256 770a1b5c559b00780cbf6ad83f539fe44f4841983d3f05f4db477720929a0c36
- MD5 a28acc3e425e33586ad4995e965b35bb
- SHA1 5ba1bd86899aa6e2d41954652836242547bed621
- SHA512 fe6d5d1043d4a68b1577049317fd07492a81ccc1d97ec3d56deacbfe39bc9c321770bdc7751f5286c4ef86d5e9c7a9f51f85880d77083620d48cd9547e95a84b
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfV:sMguj8Q4VfvMqFTrYStx5E5Iw
- TLSH T1C6878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2384 OfficeClickToRun.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz OfficeClickToRun.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5896 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5448 WMIC.exe Token: SeSecurityPrivilege 5448 WMIC.exe Token: SeTakeOwnershipPrivilege 5448 WMIC.exe Token: SeLoadDriverPrivilege 5448 WMIC.exe Token: SeSystemProfilePrivilege 5448 WMIC.exe Token: SeSystemtimePrivilege 5448 WMIC.exe Token: SeProfSingleProcessPrivilege 5448 WMIC.exe Token: SeIncBasePriorityPrivilege 5448 WMIC.exe Token: SeCreatePagefilePrivilege 5448 WMIC.exe Token: SeBackupPrivilege 5448 WMIC.exe Token: SeRestorePrivilege 5448 WMIC.exe Token: SeShutdownPrivilege 5448 WMIC.exe Token: SeDebugPrivilege 5448 WMIC.exe Token: SeSystemEnvironmentPrivilege 5448 WMIC.exe Token: SeRemoteShutdownPrivilege 5448 WMIC.exe Token: SeUndockPrivilege 5448 WMIC.exe Token: SeManageVolumePrivilege 5448 WMIC.exe Token: 33 5448 WMIC.exe Token: 34 5448 WMIC.exe Token: 35 5448 WMIC.exe Token: 36 5448 WMIC.exe Token: SeIncreaseQuotaPrivilege 5448 WMIC.exe Token: SeSecurityPrivilege 5448 WMIC.exe Token: SeTakeOwnershipPrivilege 5448 WMIC.exe Token: SeLoadDriverPrivilege 5448 WMIC.exe Token: SeSystemProfilePrivilege 5448 WMIC.exe Token: SeSystemtimePrivilege 5448 WMIC.exe Token: SeProfSingleProcessPrivilege 5448 WMIC.exe Token: SeIncBasePriorityPrivilege 5448 WMIC.exe Token: SeCreatePagefilePrivilege 5448 WMIC.exe Token: SeBackupPrivilege 5448 WMIC.exe Token: SeRestorePrivilege 5448 WMIC.exe Token: SeShutdownPrivilege 5448 WMIC.exe Token: SeDebugPrivilege 5448 WMIC.exe Token: SeSystemEnvironmentPrivilege 5448 WMIC.exe Token: SeRemoteShutdownPrivilege 5448 WMIC.exe Token: SeUndockPrivilege 5448 WMIC.exe Token: SeManageVolumePrivilege 5448 WMIC.exe Token: 33 5448 WMIC.exe Token: 34 5448 WMIC.exe Token: 35 5448 WMIC.exe Token: 36 5448 WMIC.exe Token: SeIncreaseQuotaPrivilege 1148 WMIC.exe Token: SeSecurityPrivilege 1148 WMIC.exe Token: SeTakeOwnershipPrivilege 1148 WMIC.exe Token: SeLoadDriverPrivilege 1148 WMIC.exe Token: SeSystemProfilePrivilege 1148 WMIC.exe Token: SeSystemtimePrivilege 1148 WMIC.exe Token: SeProfSingleProcessPrivilege 1148 WMIC.exe Token: SeIncBasePriorityPrivilege 1148 WMIC.exe Token: SeCreatePagefilePrivilege 1148 WMIC.exe Token: SeBackupPrivilege 1148 WMIC.exe Token: SeRestorePrivilege 1148 WMIC.exe Token: SeShutdownPrivilege 1148 WMIC.exe Token: SeDebugPrivilege 1148 WMIC.exe Token: SeSystemEnvironmentPrivilege 1148 WMIC.exe Token: SeRemoteShutdownPrivilege 1148 WMIC.exe Token: SeUndockPrivilege 1148 WMIC.exe Token: SeManageVolumePrivilege 1148 WMIC.exe Token: 33 1148 WMIC.exe Token: 34 1148 WMIC.exe Token: 35 1148 WMIC.exe Token: 36 1148 WMIC.exe Token: SeIncreaseQuotaPrivilege 1148 WMIC.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5004 wrote to memory of 2384 5004 stub.exe 79 PID 2384 wrote to memory of 3380 2384 OfficeClickToRun.exe 80 PID 3380 wrote to memory of 5448 3380 cmd.exe 82 PID 2384 wrote to memory of 4864 2384 OfficeClickToRun.exe 84 PID 4864 wrote to memory of 1148 4864 cmd.exe 86 PID 2384 wrote to memory of 4532 2384 OfficeClickToRun.exe 87 PID 4532 wrote to memory of 2256 4532 cmd.exe 89 PID 2384 wrote to memory of 2564 2384 OfficeClickToRun.exe 90 PID 2564 wrote to memory of 2144 2564 cmd.exe 92 PID 2384 wrote to memory of 4568 2384 OfficeClickToRun.exe 93 PID 4568 wrote to memory of 5896 4568 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OfficeClickToRun.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\OfficeClickToRun.exe C:\snapshot\app\backend\.pkg-tmp-0d001b9c54fb1e4f\main.js --bg --tmp2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get Manufacturer,Model,NumberOfLogicalProcessors,TotalPhysicalMemory /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer,Model,NumberOfLogicalProcessors,TotalPhysicalMemory /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get Manufacturer,SerialNumber,Version /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get Manufacturer,SerialNumber,Version /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer,Product /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Manufacturer,Product /format:list4⤵PID:2256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get Model,Manufacturer,Size /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model,Manufacturer,Size /format:list4⤵PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get name /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name /format:list4⤵
- Detects videocard installed
PID:5896
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OfficeClickToRun.exe
- Size 36.8MB
- SHA256 770a1b5c559b00780cbf6ad83f539fe44f4841983d3f05f4db477720929a0c36
- MD5 a28acc3e425e33586ad4995e965b35bb
- SHA1 5ba1bd86899aa6e2d41954652836242547bed621
- SHA512 fe6d5d1043d4a68b1577049317fd07492a81ccc1d97ec3d56deacbfe39bc9c321770bdc7751f5286c4ef86d5e9c7a9f51f85880d77083620d48cd9547e95a84b
- SSDEEP 393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfV:sMguj8Q4VfvMqFTrYStx5E5Iw
- TLSH T1C6878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH