Analysis
- max time kernel
1s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
attachment20260813-1169-vl2paq.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
attachment20260813-1169-vl2paq.docx
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target attachment20260813-1169-vl2paq.docx
- Size 193KB
- Sample260813-bex3kshj7x
- SHA256 1b6774b78b67aa3dcf1d078dc00b8a4439ef41a1eae6cbd8de6e03416e5070cc
- MD5 fa0428a0f8af7459d1af50635f7f7fc1
- SHA1 b4590c2beda63cce3c7b7cbd28ba6858e0e5c275
- SHA512 060814dcd76bd85705c7a68b608be567d8e1e61dec8e9c0f4c0050d05f2f1efe0c3e4fba5fc70023485f00d3455b0d824e5db1ccea4e76d4a74ed1d43df19ace
- SSDEEP 3072:JB0/001IDdKPD/7Fvap07CFeLNYteTC8FCPexji2I0PnzLzJGFYCSletzCgs0p+h:e1IZKPDRWWNYy3ZGKP7JG6WV3sd
- TLSH T18C1401ADC442E878C843C67C487D06F4771B047AC706AFDAE498E375A60558BDB3BAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4368 WINWORD.EXE 4368 WINWORD.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4368 WINWORD.EXE 4368 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\attachment20260813-1169-vl2paq.docx" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4368
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 672B
- SHA256 4121d410befc7acfb6d9eee88b87837e741385f45a449341638704d0246f6864
- MD5 55ca622533f6819afc602f9c26044020
- SHA1 cebd6da1e83aad158f217afdb046c0e811513207
- SHA512 8692e1f9f2105b5d5519cae27850fa020624119bac6f8e691d1b596930b9dc47f3e4f60168493aa227ca6de4ef8c21c02d193146f3683b1612a119b0724983cf
- TLSH T1FA01E10116EF6F57D18003360B351715DB307D63B704A75DD644212F5DB5D80DE9DE19
- MD5 SHA1 SHA512 TLSH