Analysis
- user interaction
yes - max time kernel
57s - max time network
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
Hoja_De_Vida_Certificaciones_Mariana_Alejandra.docx
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hoja_De_Vida_Certificaciones_Mariana_Alejandra.docx
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target Hoja_De_Vida_Certificaciones_Mariana_Alejandra.docx
- Size 21KB
- Sample260727-laa3cscl4w
- SHA256 026488009347bbc1828e092429c0dd88ce522247cb89fcf8dd4090c117f51d9a
- MD5 8781f39f0235b821bc58cebd464ca15d
- SHA1 e919a26b655affd8635e80fc77df03e7b82839c2
- SHA512 b962f200e97e9e0536c9aac139122590da0a664fbdf8a41445453ffe5cd62f811be7ff8fdc029e0380d60a1382990e7f7bc71eb3b272d71acaddac5a4ff34f68
- SSDEEP 384:Pm04sHK2yA0tX45Psp0b2uYbAIWesox8gXie7K9fU/8gjYQiGwH42pobnN7QVWwz:P/4sHKRtX45Pe03AWesoxFXF7K9UHtBm
- TLSH T19BA2D151FDC74D14C7122A34A5D2809F3116A0C353F7E3CF5A06B76EE69352B1B253A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4716 WINWORD.EXE 4716 WINWORD.EXE - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE 4716 WINWORD.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4516 4716 WINWORD.EXE 90
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Hoja_De_Vida_Certificaciones_Mariana_Alejandra.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4516
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\634ADA14.wmf
- Size 822B
- SHA256 af7ceaea8ea2904a1269181f4e0e1129742676d62e507d63d49f93dda9cd68e9
- MD5 1b684682663f3e543a74d44f1a223af1
- SHA1 661f5f7c71ec7dacafbf262fbeebac076c8a53ea
- SHA512 d19c04f9967a4cea6d2090d25e173245e8267853abf7b84fe402949c11ae4b8f1220a03b5df5b1089c4154a1c50f2452469657dcc2b04e5042e2355e726368be
- TLSH T17901E446A9308A36E54D76394C23374573F1B0849A667F07A14826305EF66A33DAEA5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\ABFA2C48.wmf
- Size 642B
- SHA256 83f4ea26254d69825486bffd1d400217aac7245c5c48fe5acc3ccdea173c4851
- MD5 4f03b86e4d6631c26ff5fffc7332be1d
- SHA1 14952a78ea51df67d5b5b6c6b4de3d96ba7935bd
- SHA512 4bed29b66444d826e89589b55dd786758ff68fcd2daf8296703d4443edb991fffce563e20db22bfb34fdb488638bbb43252392b6c105d12e721329adc2774632
- TLSH T197F0B441BEAAC157F43192300C71908067A9E0C9B9084F03789DFF3D992F9951E3FC98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD9646.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512