1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260804-1169-msn05l.docx
Size 193KB
Sample260804-e78xbsfq5t
SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
MD5 fa0428a0f8af7459d1af50635f7f7fc1
SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
TLSH
T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1400	WINWORD.EXE
1400	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE
1400	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260804-1169-msn05l.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d6ccff7766554fa31f18b7a3af95670b916d1e2318a98249610749a3946670c5
MD5 bbd8523c65120d36673a9a376c514753
SHA1 68e72fcc5f98a4139cf8fee19056709f7e311421
SHA512 db9d53f4079d95d68bb7a034e940bf13a062423a391030f162c02f88129ce517ddcf433c89765340ee7fcbbfc67506b434c6b152b02c775fb6d724561455e303
TLSH
T106E02B113BE80204F5330A3CB9736444593BB32B6E00CADD0735008C1C24FA1C833719
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 2fc446053e34df5ebdaf72a1f4a048ff9b0d5135d65dc054727fcff254bfe8d7
MD5 c559734926a31fb4c22500200363e441
SHA1 22b0fb84f6eca65e11060c6a90e78c98898b6778
SHA512 fc04fa074b09cf13be7062c755b477662675f4c750fc32d7fad14d3304d74052555d00f8f97e6fd5754677daa455dc8ecfe5e8428be94316bdaddddaa5190b35
TLSH
T1A9E0C2127AE80208E5330B3CBE7365445937772BAE01CADD1B35408C1D28FA1897232A
MD5 SHA1 SHA512 TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD87DD.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 56c7a9234e5c5037bba6cbab86cf72228efae3727295f55e53d26359fdbe617d
MD5 db3389d8ac4494cc5b5161c0314d11b3
SHA1 4713c116283d758cbccbeb77fcd82f5a995c5390
SHA512 33b5701d3c7c9bf8d278b44895d5c1f9ed18e15eccaa4521c77d8e3e09402453e5d58bcf2e96fa8db9f006348a0086d21c01773375fd83bb181995e61c643d04
SSDEEP 384:Jt+BNxt/ZtNN1PJ4sq5a+woIFOJNmD/JbS+bOGvfe:exllN1hpq5aSIIyJp7fe
TLSH
T137829F38F010E934CBB38A3D70AD41F1F5290442BA799449245EBBDE9F69D875722F8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1400-35-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/1400-5-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/1400-8-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/1400-9-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/1400-10-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/1400-11-0x00007FFA94610000-0x00007FFA94620000-memory.dmp

Download

memory/1400-0-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-2-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-1-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-7-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-6-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/1400-4-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-3-0x00007FFAD735F000-0x00007FFAD7360000-memory.dmp

Download

memory/1400-519-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-520-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-522-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-521-0x00007FFA97340000-0x00007FFA97350000-memory.dmp

Download

memory/1400-523-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads