afab6887825694a322b3e20b260da1c08b2a700719b097bbb16326239b085840

Analysis

user interaction
yes
max time kernel
63s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crlite.filter
Size 6.8MB
Sample260724-2gebcsgl8w
SHA256 afab6887825694a322b3e20b260da1c08b2a700719b097bbb16326239b085840
MD5 07af8c858f779cb1f6076aa69707206b
SHA1 c47473e3eb7c1e7c19d357f3f8db2a324135ddf6
SHA512 ae0c5916e9469bee8f3cdb67666c90f91d86418318403b2692772bcca57c7ba3deb4c8deed9e3de58925fc25599c64f44ba3df7ef880f37fa37e1b563bfc638d
SSDEEP 196608:FRHI2kv5zXwXitVzQey5dgoS9hPi9U7vp:LoNVwXdeUdzi7B
TLSH
T1F3663346811ACA29DC940374584FF9F633FFF550563EE62AB84A1AB6B76FA4810C3F50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5336	Winword.exe
5336	Winword.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5988	OpenWith.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe
5336	Winword.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 5336	5988	OpenWith.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\crlite.filter
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\crlite.filter"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 a5befc0014c19095bd1621572b8851c4e9c472889a8078917a36be552d0d7ece
MD5 a7950205087261f9d805272d075d2ba2
SHA1 6383e603cc4150e82735fa8eb307e6677269e6b1
SHA512 be8ebd3c184076b72a6b4ec4f10327d2acd3e9fd261afede62e0c999934081eb94bec5de5e2efe4c1422e51e4d55a62a8bea427d79fa06cf801ae8cc631b736f
TLSH
T1F851F0015BDF2B56E0514276062E8B46EB703A03EB1477DFA592201B2E75D004FBFB6E
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads