Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260805-1169-hud8p5.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260805-1169-hud8p5.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target attachment20260805-1169-hud8p5.docx
- Size 193KB
- Sample260805-3r92fshr41
- SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
- MD5 fa0428a0f8af7459d1af50635f7f7fc1
- SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
- SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
- SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
- TLSH T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4532 WINWORD.EXE 4532 WINWORD.EXE - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE 4532 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260805-1169-hud8p5.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 ea80977c611b428b4a880205a4bee830f9ffdb79206dc9cda974d7507288d02a
- MD5 6285e47bf6a73f806a4cef22a008f1fc
- SHA1 2b11328e4f01f48e9fbe92348057c37a3ba1485e
- SHA512 c94f837b30b105fe71578451f350587b738aa410437017dfbe7dd47c8d829d24ab01d7166bb160943ae6ec6b2034c71961e23230867c7feed19e39af757b2a62
- TLSH T172E012513AE80214E5730A3C69736589997B77376E42CADD0775008D1C25F91CD7671D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDEE6D.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 9281486b649d51363436e9c6e1c6e1b005f06236602eadedb90c34f1eeadc98e
- MD5 dee8d9936952c841962cb275dbe4f34e
- SHA1 5ac1d769ccf39c30e50a102d51014b0574387c8b
- SHA512 7384110ad81448b84a3c2e261539f6bb146e6d6dfbe182d2f7508868aac67c3abb8c552c6568b114769221cd3960823050efa17eb86dfdb6f898184990fe5a54
- TLSH T12C41DD4262AF1EA3F09082B5423B5786DA707C03EA14950D3684A56B2EF2D005F4C77F
- MD5 SHA1 SHA512 TLSH