Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/07/2026, 18:05
General
- Target agency_quarterly_reporting.xlsx
- Size 362KB
- Sample260716-wpf72aav4p
- SHA256 6a2661df701cd229776f3ca06694bc8465d50c063c11804293b6a70341109070
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\agency_quarterly_reporting.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
temp.User.zip
b8ab77100df80ab2.customDestinations-ms
memory/3924-0-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-3-0x00007FFC115ED000-0x00007FFC115EE000-memory.dmp
memory/3924-4-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-6-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-5-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-2-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-1-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-7-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-11-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-12-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-13-0x00007FFBCED10000-0x00007FFBCED20000-memory.dmp
memory/3924-9-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-8-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-14-0x00007FFBCED10000-0x00007FFBCED20000-memory.dmp
memory/3924-10-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-26-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-27-0x000001B041930000-0x000001B041AD2000-memory.dmp
memory/3924-28-0x000001B05C710000-0x000001B05F170000-memory.dmp
memory/3924-29-0x000001B059F50000-0x000001B05A1E4000-memory.dmp
memory/3924-30-0x000001B03E2C0000-0x000001B03E31C000-memory.dmp
memory/3924-32-0x000001B03E0A0000-0x000001B03E0C2000-memory.dmp
memory/3924-31-0x000001B041AE0000-0x000001B041CA2000-memory.dmp
memory/3924-33-0x000001B05AF80000-0x000001B05BD10000-memory.dmp
memory/3924-34-0x000001B03DFF0000-0x000001B03E000000-memory.dmp
memory/3924-35-0x000001B03E280000-0x000001B03E28A000-memory.dmp
memory/3924-36-0x000001B03E320000-0x000001B03E342000-memory.dmp
memory/3924-37-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-38-0x000001B063490000-0x000001B0677A6000-memory.dmp
memory/3924-39-0x000001B03E350000-0x000001B03E378000-memory.dmp
memory/3924-40-0x000001B041780000-0x000001B0417D0000-memory.dmp
memory/3924-41-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-42-0x000001B03E000000-0x000001B03E010000-memory.dmp
memory/3924-43-0x000001B03E260000-0x000001B03E278000-memory.dmp
memory/3924-44-0x000001B041830000-0x000001B04188A000-memory.dmp
memory/3924-46-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-45-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-47-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-48-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-49-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-50-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-51-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-52-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-63-0x000001B05BF20000-0x000001B05C448000-memory.dmp
memory/3924-64-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-65-0x00007FFC11550000-0x00007FFC11745000-memory.dmp
memory/3924-66-0x000001B05C550000-0x000001B05C64C000-memory.dmp
memory/3924-88-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-91-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-90-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-89-0x00007FFBD15D0000-0x00007FFBD15E0000-memory.dmp
memory/3924-92-0x00007FFC11550000-0x00007FFC11745000-memory.dmp