4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260730-750-ha4k96.docx
Size 104KB
Sample260730-npdsxazzgt
SHA256 4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15
MD5 aa15fcf0964e4515c4931b5bf81f5229
SHA1 9c8f674d95e1e518fbfe598dabd18a4bc0ca011b
SHA512 4695c5e40f81fc580535418dadc189699ca1fe1b5fb43dbcef7f193766bfae43b2c58b934ebf191169e7803c6fb582783f8aab35b4d41afdb85db9510143f877
SSDEEP 1536:JORhN+gPY3tH0bO6ZZAnXJzy3mCaIRgqzdS6JGQYwB1prxK:JOXNrbO6ZZchIPIS9B1pNK
TLSH
T192A395998D79600DD0773FB49BB5A494E771F6B23E4E4E2B02AC74742FAEC2997C1804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2884	WINWORD.EXE
2884	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE
2884	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260730-750-ha4k96.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 896cd05ad08a590c49b2577fbe28da41f4ac862330be465a08f5d676cd9a2663
MD5 e49e214caa4231f0e511ba112c5b523e
SHA1 a0cdd2b798a720704f571e98683704eb6bedcbdd
SHA512 b2fab2363e7432818df584aaff9d3ace95c6413bfcb1b8d928a769bdf4e70049dfa0de972d8bdbccb1b3dafe34117d5051cd72a9efbd09178d61246139aaa3b4
TLSH
T1AFE02B513BE80204F5330A3CA933A4445D37772BAE00CADD0B38008D1C29F91C832719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 f443f53b9b1e4a605b74d71663f2a8cfb4556f0ce7606989b0dc392d6a97bb03
MD5 4147a147972b8ddfab60263d604d1629
SHA1 095f3bf51602a597efba764024f3834692175dec
SHA512 1c69a7eb3a05830bc79ee97aeada5d489c1238d60f77185bf552f6a5618d38bde9eb1943c0f3cebf469b9dedf20ebb9c0a223a943efc227e068c0c276b33f0ae
TLSH
T181E0C2113AA80204E5330A3C6933B44459367227AE00CADD0A36008D0C28FA1883271A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 e57dc5e8f5eb3aaf4305fa9d477534994d4e8e884357cf972407641b637375d0
MD5 79c5194cbce14e1cc30fb8bf73c1f78c
SHA1 59981d5ae05aad90337893add9cead2488276278
SHA512 16e8fd548cdbe87dbff54d1a2fb84a3fb362b98e90f300ee3a8b5f6819378ccbf2c644fbd9d04fc9017d0e5b8005088ec7f335c9f72f21facc4b5eb74ab1546f
TLSH
T187E0C2113BA80200F5730A3C6933A4449D3777276D00CADD0634008C1C24F51C83A719
MD5 SHA1 SHA512 TLSH

Submit Download

gb.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD88A8.tmp\gb.xsl
Size 262KB
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
TLSH
T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 6b6d148dddf5b6c56ebfee099689f0f47bb5d0d7a7703df4f4e0754e165f1fc7
MD5 527c64a4506621d43250318298fb1249
SHA1 e80aae3b738fefcfaecb2de7d3b06fa6f74a7689
SHA512 32ce43770d4283be17ad455887f6d92e9d5fcbe8f496df75dbe79463386822688ab2ab91f0b02803b8c95207bae8b0a2781da7798dcd82f1d9984ed25e27b73d
SSDEEP 384:Jt+BNxt/ZtNN7psi1YZoIFOJQQRGi2iI/jEqE9rWhP26Rrp:exllN7CiCiIIgi2imEqGWzRrp
TLSH
T19B82AE7CE1115860DAB34A3C709E51F0E5080483F72AE58A305DFACFA6F9D974791E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2884-8-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-28-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-0-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-4-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-9-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-10-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-11-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/2884-12-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/2884-24-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-25-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-26-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-7-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-27-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-5-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-6-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/2884-1-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-2-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-3-0x00007FFAD735F000-0x00007FFAD7360000-memory.dmp

Download

memory/2884-539-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-541-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-540-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-538-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/2884-542-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads