Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
TENDER Waldmann Verpackungsmaterial 13.07.2026.xlsx
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
TENDER Waldmann Verpackungsmaterial 13.07.2026.xlsx
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
General
- Target TENDER Waldmann Verpackungsmaterial 13.07.2026.xlsx
- Size 108KB
- Sample260714-pdndmsbz4p
- SHA256 710f79a06753bf41cbfeb0b27a71623d111f19188cb17ac6f5cd63cb67e5d283
- MD5 04d2b2b931992d84e80feda8a9da409e
- SHA1 6997c6b199019d9300d1f22bef8dcc32f36fb12e
- SHA512 ef572c8cb7d7d303e3fba54fc3f5a5d688f83cff10810439a544eae1ebf7390564afea8a255682fc675ceee5028d9c4fa2f44168dab0414d068c4cd6c3161d4d
- SSDEEP 1536:WTFq+RfwvNJqdtBEo714LtHpAa3sOSLEbNWxMAmvrMfqet4Gsm4sE9N+q:WJq+oviyo7OtHpAac1LEbzA0Ne6z9N1
- TLSH T1FEB3F01AEF20E743C2698BFC7A4B1CB4910F6795692513D11C752DAF4E404B3AECB25E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4876 EXCEL.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4876 EXCEL.EXE 4876 EXCEL.EXE - Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE 4876 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TENDER Waldmann Verpackungsmaterial 13.07.2026.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 2KB
- SHA256 4a99bab6b7f44e4888d712724d7b5896b80250d6ee0ff35e2bd5c615c3751a55
- MD5 0e5934d8d180dedd3351c36800fb196f
- SHA1 598ed01c2c7e4631bcb625c86457d4d888116a1b
- SHA512 730a3ae19e16824c88ca6cb4746350500f9f906a1e618e59c457dd1601ae95e1ed90a73d6079b73f55ddef7889e89a6d70a84c2854534da329518cf44b739057
- TLSH T1A651D0920AD76A0FD12043B35A3AC79ED7307E53E710D31D9282515EBD6E8408AAEF1E
- MD5 SHA1 SHA512 TLSH