babe907ed88983013e4909c3720eab25ba5c5999043b1257798481e102047c02

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
badgetemplate/WordMaster/Master1.docx
Size 23KB
Sample260508-pkg57scv3p
SHA256 babe907ed88983013e4909c3720eab25ba5c5999043b1257798481e102047c02
MD5 75ff20222ceaf1864abb13d46599b1a3
SHA1 211ab9761a4d0e864b23e27271303284826dfd1e
SHA512 b830a5c44cc98472988d6dcdf8c40f466fbd716f765792878da7ca3e0314155896fbb4eafcdb12aa6bb69a8cf749af6805bb58bc761c7471d2fc90c501c0d49c
SSDEEP 384:3/3XbN9VoVNSLQQzDvUhG6Le8I1MlruCb9c/1hp1YYjjn/:3vhKNeQSUs6y8I1M9uCpc/1CYjL/
TLSH
T1D2B2C07BD10A3594C0F8D939F07123AADB8B4CD3774093FC54557BD982A098B0BBE9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Documents\My Data Sources\DESKTOP.INI	WINWORD.EXE
File opened for modification	C:\Users\Admin\Documents\My Data Sources\DESKTOP.INI	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 40 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 8400310000000000a85c83681100444f43554d457e3100006c0009000400efbe3e5c4402a85c83682e0000005ee10100000001000000000000000000420000000000cb41c60044006f00630075006d0065006e0074007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370037003000000018000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000003e5c44021100557365727300640009000400efbe874f7748a85c7c682e000000c70500000000010000000000000000003a0000000000c8f9490055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 6800310000000000a85c836814004d59444154417e310000500009000400efbea85c8368a85c83682e0000000c460200000007000000000000000000000000000000cb41c6004d00790020004400610074006100200053006f0075007200630065007300000018000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000003e5cdd0c100041646d696e003c0009000400efbe3e5c4402a85c7c682e00000055e10100000001000000000000000000000000000000a3cbdc00410064006d0069006e00000014000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4360	WINWORD.EXE
4360	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4360	WINWORD.EXE
4360	WINWORD.EXE
4360	WINWORD.EXE
4360	WINWORD.EXE
4360	WINWORD.EXE
4360	WINWORD.EXE
4360	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\badgetemplate\WordMaster\Master1.docx" /o ""
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

+Connect to New Data Source.odc

Path C:\Users\Admin\Documents\My Data Sources\+Connect to New Data Source.odc
Size 190B
SHA256 3a13080059292811e5ac3f9e8b04b2c8eea95d6a5538116ad751d11c834e6056
MD5 16a8a9a2b0a8b65faf28e1007db6733f
SHA1 6f3f3fa4219fccee5abafeb4ca0f61dbd2b8e8b8
SHA512 e0e5ec737cbafa7ae51c6e24dacd8c961de4ad2becff4d189ef11f763af872063d0f2e80b96db3da02f94a37cb59653ccb5f66713b6d00734c958b7cd451eac9
TLSH
T170C012B721420C0F6370B5715882B1C843567910A1085C84C0AAB4BF6DE5B85CE93356
MD5 SHA1 SHA512 TLSH

Submit Download

+NewSQLServerConnection.odc

Path C:\Users\Admin\Documents\My Data Sources\+NewSQLServerConnection.odc
Size 196B
SHA256 43b12e68fb3b5bcc4099d796fa670a62b116a894437454a20050661def9d8816
MD5 149e8c684b9ea9887dd2e7e596e7187c
SHA1 99029c30bafea463b991acef6a7eeedb12f84d8d
SHA512 ee738b6663c81d5872765fe03aba7b49240026951c9dabd72e08848a0d5c86bbb44bc8a246032edc494ca207adfa042b41fcbdb83a63c4e1f09bccb1a0f3b180
TLSH
T12BD012B721421C0E6370B5719893B1C403567910A2185C44D0A674AF6DD5B85CB93355
MD5 SHA1 SHA512 TLSH

Submit Download

FOLDER.ICO

Path C:\Users\Admin\Documents\My Data Sources\FOLDER.ICO
Size 4KB
SHA256 3114451f95c7fb8d7d884a19c724f6c7ff906b6d9bec1bf7c6300d2cca4f43a6
MD5 a6ddccfdad18d5ca7aaeb168b6d02253
SHA1 36e666090d5a0bded46937566f397bff4d8b13e8
SHA512 55ecdc79a64ac40329c7742a26bb043d8f5735d631fd9cf5e78620d647641b9cc1aedd97209b7590fe2fdd157e79672fb15148d4b4f0ab4c6f6a51343222bbd8
SSDEEP 48:rFry58nP0pB/ewjcYzrd67pn8MZEXry58nP0pB/ewjcYzrd67sEo4fvL4FVLbIy+:rFOQGJ6V8MZKOQGJ6k4/IpI
TLSH
T143A17D42623C84C2EAA694329907CBB85A847D0F6FD518B375A13E1BFD313B871356E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4360-8-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-10-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-5-0x00007FFCBDA30000-0x00007FFCBDA40000-memory.dmp

Download

memory/4360-6-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-9-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-0-0x00007FFCBDA30000-0x00007FFCBDA40000-memory.dmp

Download

memory/4360-11-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-1-0x00007FFCBDA30000-0x00007FFCBDA40000-memory.dmp

Download

memory/4360-7-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-12-0x00007FFCBB260000-0x00007FFCBB270000-memory.dmp

Download

memory/4360-13-0x00007FFCBB260000-0x00007FFCBB270000-memory.dmp

Download

memory/4360-31-0x00007FFCFD9B0000-0x00007FFCFDBA5000-memory.dmp

Download

memory/4360-4-0x00007FFCBDA30000-0x00007FFCBDA40000-memory.dmp

Download

memory/4360-3-0x00007FFCFDA4D000-0x00007FFCFDA4E000-memory.dmp

Download

memory/4360-2-0x00007FFCBDA30000-0x00007FFCBDA40000-memory.dmp

Download

memory/4360-43-0x000001372FAC0000-0x000001372FB39000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads