Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
25/06/2026, 12:17
General
- Target TP%2005-filtre-ADSL-TSENA-2012.doc
- Size 706KB
- Sample260625-pf2daabx6j
- SHA256 4b3df0595ae97a84c9ec94eb7f2e9be45b8d85cc7624d2a1492f54f548fa7238
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TP%2005-filtre-ADSL-TSENA-2012.doc" /o ""1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7854656D.emf
824F2C1C.emf
A457948A.emf
DFB638C7.emf
EBFDC05E.emf
TM02851218[[fn=gb]].xsl
CUSTOM.DIC
ExcludeDictionaryFR040c.lex
memory/3408-7-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-6-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-10-0x00007FFCD5F40000-0x00007FFCD5F50000-memory.dmp
memory/3408-11-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-12-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-13-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-15-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-16-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-14-0x00007FFCD5F40000-0x00007FFCD5F50000-memory.dmp
memory/3408-8-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-0-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-9-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-5-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-3-0x00007FFD1839F000-0x00007FFD183A0000-memory.dmp
memory/3408-1-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-2-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-87-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp
memory/3408-4-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-519-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-520-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-521-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-522-0x00007FFCD8380000-0x00007FFCD8390000-memory.dmp
memory/3408-523-0x00007FFD18240000-0x00007FFD184A3000-memory.dmp