74556b8e0daa0b17fe1ac0495b3894130e440354ad0b1dad85543bad27059cba

Analysis

user interaction
yes
max time kernel
32s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
graphviz-14.1.5/doc/infosrc/round.dot
Size 209B
Sample260528-splwqscy6p
SHA256 74556b8e0daa0b17fe1ac0495b3894130e440354ad0b1dad85543bad27059cba
MD5 43b3b9dfab43f0366b3ad0d7041b4847
SHA1 f47f3e3fde6553da1b2842ab82e3955492a1261f
SHA512 efc9d814f82419858c67deead49f790b9d59a60585bc4265eff8e0eb8d0a1ceeddbc01cde0b74ee167bd063780aabb4af7070f89746484b86216e7b64e69353c
TLSH
T1C3D012C650220CCE721F483052566E432E6C1417574B497CD72B6ABD155996070AC5CE
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "190"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3960	WINWORD.EXE
3960	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3960	WINWORD.EXE
3960	WINWORD.EXE
3960	WINWORD.EXE
3960	WINWORD.EXE
3960	WINWORD.EXE
3960	WINWORD.EXE
3960	WINWORD.EXE
3104	LogonUI.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\graphviz-14.1.5\doc\infosrc\round.dot" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a14055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 e004664d8a78134688a514a0c0cc539300f632eb819715d045edaf4a5b0e8f95
MD5 e0d264328b0fefbdc2c417930900f315
SHA1 f38dc7bfb15998facc00770cd06d308e98b4dd1d
SHA512 8cb6345bf9ca7218d4797ffd1363bb7c24241544df7eb1f65c2b67e5bfed2e8be8832c9f2f3d5440690091262e6f229f1e0fbaa547bfe81e96751ecd0f00966e
TLSH
T18241CD02029FAB67F4614232533A4750DB707C43FB65F11EB244662D1CB0E045E5DE6E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3960-8-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

memory/3960-11-0x00007FFD22630000-0x00007FFD22640000-memory.dmp

Download

memory/3960-1-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-4-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-7-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-6-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

memory/3960-9-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

memory/3960-0-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-2-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-5-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

memory/3960-10-0x00007FFD22630000-0x00007FFD22640000-memory.dmp

Download

memory/3960-20-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

memory/3960-3-0x00007FFD64E44000-0x00007FFD64E45000-memory.dmp

Download

memory/3960-44-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-45-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-42-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-43-0x00007FFD24E30000-0x00007FFD24E40000-memory.dmp

Download

memory/3960-46-0x00007FFD64DA0000-0x00007FFD64FA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads