Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260804-1169-f3b2oe.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260804-1169-f3b2oe.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target attachment20260804-1169-f3b2oe.docx
- Size 104KB
- Sample260804-l43pgahc75
- SHA256 4c5898e2bc707b9a6a067468a2c6f395f17e9fe3d4acf7379cf32551ecc45b15
- MD5 aa15fcf0964e4515c4931b5bf81f5229
- SHA1 9c8f674d95e1e518fbfe598dabd18a4bc0ca011b
- SHA512 4695c5e40f81fc580535418dadc189699ca1fe1b5fb43dbcef7f193766bfae43b2c58b934ebf191169e7803c6fb582783f8aab35b4d41afdb85db9510143f877
- SSDEEP 1536:JORhN+gPY3tH0bO6ZZAnXJzy3mCaIRgqzdS6JGQYwB1prxK:JOXNrbO6ZZchIPIS9B1pNK
- TLSH T192A395998D79600DD0773FB49BB5A494E771F6B23E4E4E2B02AC74742FAEC2997C1804
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2100 WINWORD.EXE 2100 WINWORD.EXE - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE 2100 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260804-1169-f3b2oe.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD811B.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 c4eed3f1ed8e7d82a60289dfe04df1116e2814faf0a12dc417d45a578e7cb092
- MD5 1a463110d81c4ebe6d4634695828924f
- SHA1 bec5aac14f0b63292b9a5acde3e99ef963a771eb
- SHA512 98a7b4929c8055cfcff38ab05bbff4920af0c1c0d46a6b5522ccadf9e2b23fae1b55417808ec900b118a6b779a0431056648d3c7c5bb6c8c0b3219aa7ebb6d6a
- TLSH T1B941ED02AA9F1F77D08003B6532E4B05FB703E02EF14BB5E6A4550272E71E004FE8B5A
- MD5 SHA1 SHA512 TLSH