Analysis
- max time kernel
149s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 18:12
General
- Target 88cfb2d4-6341-4b58-9278-a94b015ba4c0.docx
- Size 591B
- Sample260605-wtaaaadt5n
- SHA256 433bc254d1d3dcb3a205f51e2f5bd86ac13e7f33ef834a962e0a3bbc1c57852a
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\88cfb2d4-6341-4b58-9278-a94b015ba4c0.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
memory/3224-8-0x00007FFADDC20000-0x00007FFADDE29000-memory.dmp
memory/3224-4-0x00007FFA9DCB0000-0x00007FFA9DCC0000-memory.dmp
memory/3224-6-0x00007FFADDC20000-0x00007FFADDE29000-memory.dmp
memory/3224-7-0x00007FFA9DCB0000-0x00007FFA9DCC0000-memory.dmp
memory/3224-5-0x00007FFADDC20000-0x00007FFADDE29000-memory.dmp
memory/3224-0-0x00007FFA9DCB0000-0x00007FFA9DCC0000-memory.dmp
memory/3224-2-0x00007FFA9DCB0000-0x00007FFA9DCC0000-memory.dmp
memory/3224-1-0x00007FFA9DCB0000-0x00007FFA9DCC0000-memory.dmp
memory/3224-9-0x00007FFA9B110000-0x00007FFA9B120000-memory.dmp
memory/3224-10-0x00007FFA9B110000-0x00007FFA9B120000-memory.dmp
memory/3224-18-0x00007FFADDC20000-0x00007FFADDE29000-memory.dmp
memory/3224-3-0x00007FFADDCC4000-0x00007FFADDCC5000-memory.dmp