Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260810-1169-mvjy3l.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260810-1169-mvjy3l.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target attachment20260810-1169-mvjy3l.docx
- Size 193KB
- Sample260810-blm6yssvew
- SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
- MD5 fa0428a0f8af7459d1af50635f7f7fc1
- SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
- SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
- SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
- TLSH T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4620 WINWORD.EXE 4620 WINWORD.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE 4620 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260810-1169-mvjy3l.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 33940b491544b048b3e1097aacc8ef1719b45ac1f6911976bfb12e91e8964e3e
- MD5 6c486a4f52d2f9b9378adf621c29988a
- SHA1 03b15d35c9eb2815d73304f78baa215ce26a4bd9
- SHA512 e6f5ab6b5f4b0d3e3547c252edfefe395dadf76a321e6f37c162e3c7bb3478a9914b5af435619d0d3c55883244536538b2f88fb9b2aa1b782fe740c69937d087
- TLSH T1B651CC13CB9F1F4BE0904376637A8349D6713C12EA699B1E8398D13B7CA1950CF9CA4A
- MD5 SHA1 SHA512 TLSH