Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260724-1074-jgyfn4.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260724-1074-jgyfn4.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target attachment20260724-1074-jgyfn4.docx
- Size 193KB
- Sample260724-v91azatvbw
- SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
- MD5 fa0428a0f8af7459d1af50635f7f7fc1
- SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
- SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
- SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
- TLSH T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4540 WINWORD.EXE 4540 WINWORD.EXE - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260724-1074-jgyfn4.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 180f0af5874602e904b4d9eb543e2bbcdd6c733be74ebc047843c9021b82b017
- MD5 19b17239e49a28bd84c82efba4017a6c
- SHA1 4b7a976e67b7fc98b5613f4027fd1686b4cd485c
- SHA512 ee58f1d06cb91ad4858829670ab11c8d8a89fbb404fe1d3c1743f0233c1dce3e1a2ec812c683e628105660e3d5a059e19bd2dda7e4be29e6ad69f5f1cb5bd10d
- TLSH T17D41EB0556DB2B77F060477A0B2F8315E730FE03E268720D8A4C142AAD75EA05A9CF7A
- MD5 SHA1 SHA512 TLSH