4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260801-750-arvb65.docx
Size 104KB
Sample260801-pc5ljavamd
SHA256 4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15
MD5 aa15fcf0964e4515c4931b5bf81f5229
SHA1 9c8f674d95e1e518fbfe598dabd18a4bc0ca011b
SHA512 4695c5e40f81fc580535418dadc189699ca1fe1b5fb43dbcef7f193766bfae43b2c58b934ebf191169e7803c6fb582783f8aab35b4d41afdb85db9510143f877
SSDEEP 1536:JORhN+gPY3tH0bO6ZZAnXJzy3mCaIRgqzdS6JGQYwB1prxK:JOXNrbO6ZZchIPIS9B1pNK
TLSH
T192A395998D79600DD0773FB49BB5A494E771F6B23E4E4E2B02AC74742FAEC2997C1804
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE
5460	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260801-750-arvb65.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 47409fafaf92d58ee2e4657d61fa4af8aeffab86b2cf08893bf9e0521d18486a
MD5 7814243213653ea4f8f26b58cb2934ba
SHA1 d3f56f470c3ace20052672cb9283a0032bf9d557
SHA512 97735cdc6980849aa077c0ebf29f0295ae5d7c2bb7f32ddc4e587a62ff28352fa1a468cd32a804156e86f245b5374bcc390881fcb048e8a3424550b0a46541e1
TLSH
T140E08C666AE80206E5330A3CA93365446D77772AAD10CA9E0B35448D2C25FA18932719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 011e21daba3a5a51d0e45e2a5a181fa7e300abec2ab4e77662b79565242f2619
MD5 9011ef01ef2ce7d03f716440d3113996
SHA1 8a6d2a2536d798b07dde89bcc5730c527cc8fcb7
SHA512 6fc5a58447f01ccd7850ca625922c2903274ecc221164db9e6215a23077a99943a2a936cf935d0a66fe35a3af376ff6f8ae8e68a4de90c6f084bd839047c198f
TLSH
T122E0C2513BA80201F5730A3C6933A444A93773276D10CADD0634008C0C25F91C936719
MD5 SHA1 SHA512 TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDA0DF.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 f6e10b14eb98668e7f583dc0dc1f92983a3c44bbeb0c999741168731ead0c75b
MD5 5530528dc265a8606b92a12d8fd87b9f
SHA1 433709333634c18e11174aed9f0e37980ef88cbc
SHA512 4f1a36b777a0cdcef32b3ac6fab5991c99b25cc2a30f45a65cd4b3477909966cd938d996b63339323fb4e8c5b43db6d3c46abf20a7b95c1a6ff8715c37448aad
SSDEEP 384:Jt+BNxt/ZtNNZgQlYt465SoIFOJD64PXpIZqfEqE9rWGqNIT7E:exllNZFxC3IIjXOZyEqGW8T7E
TLSH
T156829D38F1212A60DAE3447DB0BE11F1F11C0443B61AA49634A9F7CE57D9D874362E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5460-4-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-13-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-2-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-3-0x00007FFAD735F000-0x00007FFAD7360000-memory.dmp

Download

memory/5460-9-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-10-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-8-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-11-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-12-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/5460-5-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-24-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/5460-6-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-7-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-0-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-1-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-500-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-499-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-498-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-501-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/5460-502-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads