Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260810-1169-k759kl.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260810-1169-k759kl.docx
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
General
- Target attachment20260810-1169-k759kl.docx
- Size 193KB
- Sample260810-vgtbysdm3v
- SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
- MD5 fa0428a0f8af7459d1af50635f7f7fc1
- SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
- SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
- SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
- TLSH T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2852 WINWORD.EXE 2852 WINWORD.EXE - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE 2852 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260810-1169-k759kl.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD6B89.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 677B
- SHA256 2f43578dee7a29d4acbb75bc1ec7e1ff8c688ea005a016ecb333f99403b4ac01
- MD5 266dbd6c7fc37901ba555eeb2dfc2869
- SHA1 b9a69d3a6c2dd66a47e5c86aef85e934664a41d1
- SHA512 1406d4def5eba47d0a3450d83fe650940b28011a68f26fd4b5788cbe77bb3364771c063632ba9da251d866473aa8344a1b0b3172ada58e6a9730ffa13782c355
- TLSH T1EF01EB4019DF3A9EE000067252368B01DAB0BC529B18118FA6D4266B1FB4F505ECC3AA
- MD5 SHA1 SHA512 TLSH