Analysis
- user interaction
yes - max time kernel
132s - max time network
132s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/08/2026, 19:56
General
- Target XAVIER-SEXL5YXH3AG4RKVI-202608.docx
- Size 113KB
- Sample260824-yn49ksywdv
- SHA256 e3b5600977978f1e23e3f86b5af62225d7eff54e3b50dc8f1da7a0959299feae
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\XAVIER-SEXL5YXH3AG4RKVI-202608.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
gb.xsl
fb3b0dbfee58fac8.customDestinations-ms
memory/396-6-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-5-0x00007FFF5B030000-0x00007FFF5B040000-memory.dmp
memory/396-8-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-7-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-0-0x00007FFF5B030000-0x00007FFF5B040000-memory.dmp
memory/396-10-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-11-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-9-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-12-0x00007FFF589D0000-0x00007FFF589E0000-memory.dmp
memory/396-13-0x00007FFF589D0000-0x00007FFF589E0000-memory.dmp
memory/396-22-0x00007FFF9AFA0000-0x00007FFF9B1A9000-memory.dmp
memory/396-1-0x00007FFF5B030000-0x00007FFF5B040000-memory.dmp
memory/396-4-0x00007FFF5B030000-0x00007FFF5B040000-memory.dmp
memory/396-2-0x00007FFF5B030000-0x00007FFF5B040000-memory.dmp
memory/396-3-0x00007FFF9B044000-0x00007FFF9B045000-memory.dmp