Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260723-1093-alvsvt.xlsx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260723-1093-alvsvt.xlsx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target attachment20260723-1093-alvsvt.xlsx
- Size 114KB
- Sample260723-g2l7gseq2w
- SHA256 4fc50abe4214a380c881eb7b71ec71d2ee63a4ce87138e008dbe800a298df280
- MD5 bb6322859e1cc993ffe60eb2325d9495
- SHA1 7d6387b3c3748b33ea33d61963004fe4c601676a
- SHA512 72148e5dcc2d6a1d28e941a846cd9c700086bb8f3fe0f1460b88086eca7201982a0705db45d6667665ef6b643798bcf1b21223949a2d4f05052c03cdf08f79fb
- SSDEEP 1536:klYSVNHKTVOPDkU2EKA4HDSFHeEQHCr46pkwY9nA4USn9RcLHvs5dOF+RKwm+nuj:kxVNHKTVQYUkEQoYNJ90HvEkF+D/nH4n
- TLSH T17FB361988C7AA00DD0773FB49BB6A095E771F6A13F0E5E1B02AC74741EAEC39D781445
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2340 EXCEL.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE 2340 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\attachment20260723-1093-alvsvt.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 1KB
- SHA256 b21dd0105a97ef34fc169a103e0a1e97a95683c0f91b5853f0f003de7822a246
- MD5 932bee41450a451136d3d26273961df3
- SHA1 81929687ccbd0082a6b0a452acb8221e3870b42e
- SHA512 192dc09bed719883e51a98d58bee8e6a42f7c6430d8e696e505ba71bfae226967e891009a53c522ef6fbc7b66e948e7f1fdaf67e2f05b2322133e6ab3d8a5207
- TLSH T19241D0430FCB5E17D0784573952FB74ADB607C06D724E20E3685521A2EB2E04AA6DA1A
- MD5 SHA1 SHA512 TLSH