1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc

Analysis

max time kernel
149s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260730-1169-6v6smw.docx
Size 193KB
Sample260730-pea5psxbkh
SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
MD5 fa0428a0f8af7459d1af50635f7f7fc1
SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
TLSH
T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260730-1169-6v6smw.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 b1406d68097df9502aa45ef153950f06442554ad9314b2841ded8e51a476bb85
MD5 2416151a7b648248576b9d49fc1b3050
SHA1 b769ee88e781daebf866e8d489821209d4ec558b
SHA512 a6e04dc6d06ba22899ae82b88fa10da6aed55f569454091715d044eed3ac01a2d9b4c36a9e49c1f4277d61cba4c83b5293c49c77a8e6b907b593767503a3ef70
TLSH
T15AE02B113BE80200F5330A3C7933A4445937B3276D00CADD0734008C0C29F61CD33719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 54bb73b7368c29bab13dbc9cb689f42dcdcf38de2f6847d41db1c59cce917e4c
MD5 37ea9985f1e986549274bb95cd022057
SHA1 31030b647a0ac216c6d16f8e87a8c1450c9f2c6b
SHA512 ad67c8e249bc15ab335e77ff405f4a5e69a5187eccc800b8eca3f6e838d3a82886a45e56373533d34951cc4939db3e03e3eb288857a5bc5159453d960764542f
TLSH
T19BE0C2113BE80200E5730A3C7A73A545AA37B32BAD00CAED0775008C4C29FA1CA36719
MD5 SHA1 SHA512 TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDD258.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 3c8ec084f5a545e3145aa9577a1bdb988943069efd4647571a99e88bc9336fab
MD5 5e759fad2ea81caef7b2826d63dc76af
SHA1 06f4c8ada4a71208023b7257d59f92c8ba801dd1
SHA512 60ae073c59a09669c53713a0ce9218094fdf6b58795e7e8dbe887bb5b59db6b80937000fc62af960da2043e738f62987605a139cd175bc32baf175c35ad3ee0d
SSDEEP 384:Jt+BNxt/ZtNNtDOoIFOJi64PXpIZq539Bt70Q:exllNl7IIWXOZa3R0Q
TLSH
T18882AE38E1011974EBD3853D746C41F6F5191883FA2AD08F20A9F7AF8B95E475326E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/5460-35-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-12-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-9-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-11-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-10-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-8-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-6-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-13-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-0-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-5-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-7-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-34-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-1-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-36-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-38-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-4-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-37-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-2-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-3-0x00007FFAD735F000-0x00007FFAD7360000-memory.dmp

Download

memory/5460-522-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-521-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-520-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-519-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-523-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads