31cae2819ad3ab05c35b85d4d3c7c2ffd11473e28a45ae05eb28a5d18a5652b1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wsgidav-master/docs/source/client_status.odt
Size 64KB
Sample260604-phl2daet5z
SHA256 31cae2819ad3ab05c35b85d4d3c7c2ffd11473e28a45ae05eb28a5d18a5652b1
MD5 7ba62e738502e3a39a5fcc20ebb857c5
SHA1 6d2bd68889ddc7463f94d67ea2307ce0a2489608
SHA512 b3bf2951f3547896bab5f5b7f2ed3048f0efdd7fbf54ddec4d2e04a14bbd08d119a5da0e441210021ded38ae903f5e4d28785f2be138354295921fd0a66e0a10
SSDEEP 1536:7/K/1G1XR5SSPcY1mDdD38+XxrtXhxWWkXqZ9nEw:7/8wb5PcUwhXxrVKfw
TLSH
T1525302614E9C0F9ED5D3A2B26E951F82D46CB177133AB80FF0B432C9A40C1899F67969
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1196	WINWORD.EXE
1196	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE
1196	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\wsgidav-master\docs\source\client_status.odt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 722ee10c3c2984a0db3e6c4814e12cd6f882785ede65e445c6e6448abc95e479
MD5 e2329e3d9443669e0124bf9f2674d80e
SHA1 c26b1a6cf819086022b5ef477ead01ef4d5ddf6a
SHA512 c90fa9c052969d628c8914dc7be4454c2204e0d6b570f6cca96ee038e46e2266bfb7738164d5790f7afcf4412765f13364fcbf9162a1d695c20fc1f8ee9c7ed8
TLSH
T1F6E05E116FE84204F5770A3CA973A5459E7BB76B6A51CADD0275008D1C21F61C937719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 2262da5008a7773c9e46fbb72667272890648549207444544b156b078c904520
MD5 be00afb261a9ee8c922b160d1481ac89
SHA1 2c092556429a4441a9e1ffa376ef6c422ebde6a2
SHA512 6c0147825fe957797c4bfeaa72de1dc4546fa5feb386724298d295fe7de137b7445678e3a8981ac8f62012ee83df14b55504d2b9dff59e7c327e514398130d5b
TLSH
T140E05E116FE84214F5770A3CA97365459D77B76B6A51CADD0275008D1C22F61C932719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 995f09d6b994483eb0ced4e31bce9bda2ff03bf97b5b1659ce7d38819c51fb09
MD5 afd7f5240e6fb67c60e045043ad07738
SHA1 18cda139c083d38a85229289b1cf3586802f622a
SHA512 243ef7399dc48a05ddc6dbd4019d27178c3ca3206f93b7b83da95b82fd5998e5ac7eca188ca0242126bbf07d33d444089b315e42f5545df4e84239fe70a687f0
TLSH
T17FE05E116FE84204F9770A3CA97365459D77B76B6A51CADD0275008D2C25F61CD3271A
MD5 SHA1 SHA512 TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD81B2.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 683B
SHA256 9d46d1ed483c2a9bfea5f512437d663191ad8904f5338f0e7869b74290e3bd40
MD5 2acde721075ee427bbb77e8836197494
SHA1 22519fd2386443a03f6bd924441fbeabf4f567cd
SHA512 5db157001c4f149b2f55159d070abc9b09fed2867ea99bde5253fc707a34af0a5d2c730280fb1ffcda901d7939bf3c7d55d3c99cb7045a7fd95ba2c34e5fda2a
TLSH
T1BA01E141229A2307E8A0423498794B66FF31B955D308764ED548334BADB1E405F8E6BF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-8-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-21-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-4-0x00007FFE592F0000-0x00007FFE59300000-memory.dmp

Download

memory/1196-1-0x00007FFE592F0000-0x00007FFE59300000-memory.dmp

Download

memory/1196-11-0x00007FFE56F10000-0x00007FFE56F20000-memory.dmp

Download

memory/1196-12-0x00007FFE56F10000-0x00007FFE56F20000-memory.dmp

Download

memory/1196-6-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-5-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-7-0x00007FFE592F0000-0x00007FFE59300000-memory.dmp

Download

memory/1196-0-0x00007FFE592F0000-0x00007FFE59300000-memory.dmp

Download

memory/1196-10-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-9-0x00007FFE99260000-0x00007FFE99469000-memory.dmp

Download

memory/1196-2-0x00007FFE592F0000-0x00007FFE59300000-memory.dmp

Download

memory/1196-3-0x00007FFE99304000-0x00007FFE99305000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads