761d4d011e6049ad703348cbbe39ad0660d6c30675c31df6e588da0b449ff25d

Resubmissions

03/07/2026, 04:03

260703-emtxnsbs8z1

02/07/2026, 03:41

02/07/2026, 03:37

02/07/2026, 03:36

02/07/2026, 03:32

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INRI INTERNATIONAL Pte Ltd JET A-1 FUEL (002).docx
Size 2.0MB
Sample260703-emtxnsbs8z
SHA256 761d4d011e6049ad703348cbbe39ad0660d6c30675c31df6e588da0b449ff25d
MD5 1b12dede83a019b35975b7a44e1490df
SHA1 fdeb2c31aa1e0015c7f133dc1b8c69ac352abf69
SHA512 18492db5009e780954b7e21d90d6fd71a67d4791797bda9b976332b2b547b3a4b228a1cd47eb0ea3389678c5dc74133f46b803af44ff4a68137debc20870bfba
SSDEEP 49152:ct4bVne3loI7Wya6xKKGhRBPYugvut01RnKIhRBPYc:ctKEB7fnNMnZt7CR
TLSH
T1599523BCE303AA2AC303553E511D3D33F6665AC732EADC1DD932A1815AE8F79614361E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2676	WINWORD.EXE
2676	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE
2676	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INRI INTERNATIONAL Pte Ltd JET A-1 FUEL (002).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD5DB8.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 6ab957b2e514516291d6dfefa61ed9f6d1b464aef0ba82d7fe99bf9c78049550
MD5 13b6c60e9cc3e39c94b9d9924eff9977
SHA1 dad5d9fe6cf01e66891075f4ac369462228b4430
SHA512 0b595cdbf79cbccaa4a16dc4e73a40bb66683d6369941ca2ee8606908cab2b6269d108888038681534926ad1c6c84e39a9c88ac89bffe007d588ba610c5c8a00
TLSH
T1E521EE160ACB5BA6F0A9C336927E4355EBB07C4AE344A65E7248213A6C74D000A6D7FF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2676-8-0x00007FFD50110000-0x00007FFD50305000-memory.dmp

Download

memory/2676-2-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/2676-5-0x00007FFD50110000-0x00007FFD50305000-memory.dmp

Download

memory/2676-0-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/2676-7-0x00007FFD50110000-0x00007FFD50305000-memory.dmp

Download

memory/2676-6-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/2676-9-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp

Download

memory/2676-10-0x00007FFD0E0A0000-0x00007FFD0E0B0000-memory.dmp

Download

memory/2676-3-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

memory/2676-32-0x00007FFD50110000-0x00007FFD50305000-memory.dmp

Download

memory/2676-4-0x00007FFD501AD000-0x00007FFD501AE000-memory.dmp

Download

memory/2676-1-0x00007FFD10190000-0x00007FFD101A0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads