aa223638cd0363efd4195a0081ff36b953c45b36b2bc1dca0aba27ded47259bd

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
word.exe
Size 733KB
Sample260730-ryjbjaba32
SHA256 aa223638cd0363efd4195a0081ff36b953c45b36b2bc1dca0aba27ded47259bd
MD5 2cfe98bab49dca2acdbef9ef5dfe6521
SHA1 334250dac756bfa665aeea509b0660f8b7945733
SHA512 ff5f903da123cde0ae430b59fe2f5c7734e8f806d4def44247cd4fc66d80b321afd0859d8efd9cfcddd5f527183c2e64b8f7ede6d583fc3c5af90c95ab3b1e62
SSDEEP 12288:KrZRD+8idy7j40JXwTWaA7V7Z3a13zdVlAptU+vR17F+ZoXfAHu7Cm5:K7D+Po4CwT/+Vlad/sVnFcnHuGm5
TLSH
T1C7F40224BA272CC8E436F8B44FB7D07FD7A57C285D14926B3664F67F2E30261C826A14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3404	word.exe
3404	word.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
48	drive.google.com
8	drive.google.com
14	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3404	word.exe
4976	word.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\trfsikkerhed\Woning.htm	word.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3404	word.exe
3404	word.exe
4976	word.exe
4976	word.exe
4976	word.exe
4976	word.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3404	word.exe
3404	word.exe
3404	word.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3404	word.exe
3404	word.exe
4976	word.exe
4976	word.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3404	word.exe
3404	word.exe
4976	word.exe
4976	word.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4976	3404	word.exe	87
PID 3404 wrote to memory of 4976	3404	word.exe	87

C:\Users\Admin\AppData\Local\Temp\word.exe
"C:\Users\Admin\AppData\Local\Temp\word.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\word.exe
  "C:\Users\Admin\AppData\Local\Temp\word.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv52B0.tmp\System.dll
Size 25KB
SHA256 33b570d86c4aac8c6785944f9b2992dc3eccc99e35c20ab79d81917bbef35622
MD5 7f6837692e4c3ee810fe8302b7e0db99
SHA1 2dff99100da9588dd828fc4436a82d0b1a9f1354
SHA512 923d20a4396a788f2073ee9a1f34c7a74013e4a424a39a1b0bc14c1533c0c496e06e3ab702debfa193c84adf909203db8bb9ad52cad436c4d7a3b5cde6776678
SSDEEP 384:WZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHb1Q:Wr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T120B24C07F38398BFC50BC1B186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

populus.ini

Path C:\Users\Admin\AppData\Local\Temp\populus.ini
Size 62B
SHA256 26480dac856373656e05508f9ac45645ad0841587ea90fff26d802406d164432
MD5 cc7c592b494e5bf9512f57afc12eed9f
SHA1 7367a5f5bbd7bc44fae9563e29aeea85573ea678
SHA512 0afeab2bb3f92c71a05e527cc8e32353279fc8ce082e2e3f2a14745bf27b036bd4a4c7072be24520aa6f2707a78dbc5734eb7ec661c5000137a605279715f0b0
TLSH
T157A0022459712F1150C28E5F1594953B369E501589028E06F8DC16944B91155990A3A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3404-16-0x00007FFAAF750000-0x00007FFAAF75F000-memory.dmp

Download

memory/3404-15-0x00007FFAAF759000-0x00007FFAAF75A000-memory.dmp

Download

memory/3404-40-0x0000000002E10000-0x0000000006C42000-memory.dmp

Download

memory/3404-42-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4976-41-0x0000000000080000-0x0000000000116000-memory.dmp

Download

memory/4976-44-0x0000000140000000-0x0000000141677000-memory.dmp

Download

memory/4976-46-0x00007FFAB5089000-0x00007FFAB508B000-memory.dmp

Download

memory/4976-56-0x0000000140000000-0x0000000141677000-memory.dmp

Download

memory/4976-57-0x0000000140000000-0x0000000141677000-memory.dmp

Download