1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260718-1052-3tokft.docx
Size 193KB
Sample260718-2xs5fsey3l
SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
MD5 fa0428a0f8af7459d1af50635f7f7fc1
SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
TLSH
T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3480	WINWORD.EXE
3480	WINWORD.EXE

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE
3480	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260718-1052-3tokft.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact