Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
EverydayCybersecurityThreats_en_637819906177830921.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
EverydayCybersecurityThreats_en_637819906177830921.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target EverydayCybersecurityThreats_en_637819906177830921.docx
- Size 17KB
- Sample260812-plkygstyaz
- SHA256 86c10d4a9edd33f3cbcc872825f6b2adadd66d22aa3516b65fa0e2393d6f50f7
- MD5 a02d74467cd089f00661018d4ac12a9a
- SHA1 1d0371cb6786d4dad1ea982c3036f3e2f15284ab
- SHA512 66252c152165b5189764395570fa489504510da2878879022637805f420240603d7005adc91801bc0b5853902140707ca7e0191cbdd23eefc9450017b38e51ff
- SSDEEP 384:FyTDbMr0FeoBS/eNxt/ZtNNl1mZpXOlGUAauCWV+wHJ:CDgXcxllN2FOlG1aHIhJ
- TLSH T18772AE27E608BD69C49784FA500E01F4F100E453D7A1668B3A67AB5F2290E9F470F9C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2760 WINWORD.EXE 2760 WINWORD.EXE - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE 2760 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EverydayCybersecurityThreats_en_637819906177830921.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 7730107ee298e75f838db886545039e1e5699ce9828e5f3d6fafbbd991aff3cd
- MD5 2fb6738c3b96b7ae1f30981476653835
- SHA1 67c1a925631488883b93c437a57e9dc99f3273f4
- SHA512 8a63a8b9c9d166c965859d5ff7e0ed5fdb2e4d0bb5970f6b2e66fe893890259033f90c729bbdf25c514c2c4b02be8f6352879203b05862c328f057310f814dce
- TLSH T10B21D0034BAF5A5BE05442B7773D839AD6313C01E650976D8290E12BBDB5E10EB9CE45
- MD5 SHA1 SHA512 TLSH