4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15

Analysis

max time kernel
149s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260727-159293-5babu2.docx
Size 104KB
Sample260727-bscnsstfpb
SHA256 4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15
MD5 aa15fcf0964e4515c4931b5bf81f5229
SHA1 9c8f674d95e1e518fbfe598dabd18a4bc0ca011b
SHA512 4695c5e40f81fc580535418dadc189699ca1fe1b5fb43dbcef7f193766bfae43b2c58b934ebf191169e7803c6fb582783f8aab35b4d41afdb85db9510143f877
SSDEEP 1536:JORhN+gPY3tH0bO6ZZAnXJzy3mCaIRgqzdS6JGQYwB1prxK:JOXNrbO6ZZchIPIS9B1pNK
TLSH
T192A395998D79600DD0773FB49BB5A494E771F6B23E4E4E2B02AC74742FAEC2997C1804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260727-159293-5babu2.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 1fedf58fbf62e52b9c50312f5eabbd7128baccadc356dbc1681563ed6e7f4725
MD5 2238de659eb9a0c431120f131f4fd100
SHA1 7d1b904f13b9c78c886a29bd2aa79a1376e37a50
SHA512 9b1cce984e3d32198f02f20a84558c05468491235bd687c78fa0002501723368b444c619d814ee6245d71f0ee971b5dff27dab099fac1f9993850036db28315a
TLSH
T1E2E017213AA90204E5730A3CB973B585AA36B62BAE01DADD07B5008D1C36FA19936B19
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 4bbf88447f845f852ae236822ff15d71224b2a6286265c902709d41d0d3904d7
MD5 f16878ae183d4dd36407eb618bfa6bf2
SHA1 d4f002193ff500e2c13c50bf7d2b260268b08edb
SHA512 9a0aa1111fd81e2e587e6897e3e05a751d9d990949a457525b270f3cf30c9d8e0ef7079ddd93260c6790d3f4ea1c051facc428070f2ba24fe8805ad9c97813d1
TLSH
T1CFE0C2113EBA0200F5330E3CBA3374455A36762BAD01DADE07B5008D0C3AFA1A837729
MD5 SHA1 SHA512 TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDC63E.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 58f052fd1b61bc8b6585b73bac3479fe5f408876e6cb2648a5d5700355661121
MD5 932abce223d989cdbcdcd2b3401b5008
SHA1 63c957d4d9d39bc3abf8aeb42a1818d0c7b7c6f6
SHA512 c59eeae0425209a329fa1d7afa21f60826196f9ac27cf5b22878405f8de8286ca9aee31aa4c7c72302e4fbc0dabb00c2ae604f7a060fe5094dcd033111b9bb91
SSDEEP 384:Jt+BNxt/ZtNN456H6hbn46KMoIFOJr0VnkYfEqE9rW0pqnCHxZxC:exllN466hE/II50VBEqGWCqixZxC
TLSH
T14882AF38F5556934DAF34A3C609C41F1F2282843F629F496245EEB9D4A99E434361FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/5460-8-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-5-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-7-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-6-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-10-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-9-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-12-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-11-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-13-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-0-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-24-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-4-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-3-0x00007FFAD735F000-0x00007FFAD7360000-memory.dmp

Download

memory/5460-2-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-1-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-528-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-530-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-529-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-531-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-532-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads