7fefafe2a1f01544d0959a234acbf5fc8233f0d42e89fec898047a4dc388f691

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eax_Set-main/VoicemeeterRemote.js
Size 4KB
Sample260825-sntvysvalh
SHA256 7fefafe2a1f01544d0959a234acbf5fc8233f0d42e89fec898047a4dc388f691
MD5 81cf0fa09900cd5f1eff9af91a58857a
SHA1 005f46c70d87339398bf05d9f99d0ed85da0a0b9
SHA512 59c1c5e435481bd8205ddff56da2a53c302f6fe885effeaac375d07e68f29498e86eb862361b66964d903c548621757a5940701aaf2b84b3812b1c34ac7ca428
SSDEEP 96:CjPNgM3CaB5a4pa4t8woqN/yiSC0XOfbF3dxeVce/aeVUE:dMyn4xyiSC0XOfbFtxeeeieiE
TLSH
T163912F0A68D386180F236235DFC74961FA36954713BDA910FF8D16026F8364EE9B46DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
208	WINWORD.EXE
208	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Eax_Set-main\VoicemeeterRemote.js
1⤵
PID:4148

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /vu "C:\Users\Admin\Desktop\EditRevoke.docx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD717B.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
TLSH
T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 386B
SHA256 0ad6b5c5b9ad31f283082476f7e92959dd164eb5d8647851cfec3742c432790c
MD5 503f82cea2483e46db4c84e9c72051a8
SHA1 3d37fabefc1a751fce7c5744fb36d36ed7d45315
SHA512 2a7267fe303698a32a182f066fb78205d4f009f2404451dd84a6958ad1eede3a9af21e7c7312db58ea4b160f8968b495176c7756cf3afbe010807548ac15ff6c
TLSH
T13EE01AABA366FBF093BC155A3C786CD09BF39C5CCB6D062618CC2CC20C617036297498
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 4KB
SHA256 6f89173085dd2ae2e9a6ad092a3ea62d836d648972ac627bbc6e7b8c235b087f
MD5 c018228dc356d25bc0ccc2fb74c5deae
SHA1 a7f38674c08b66bb34d03974768c549ecaaedf9d
SHA512 35e431ff673e3569d2dab54c7dbe5cad68eba7868149c1884a7a310ffaf36839288dd10f495acbebeeb8cff4989a7f29804502ea04d1a59243eaed46f0e8d71d
SSDEEP 96:UrRhZ4nhdft3ErJRjfS7sOyZZRM+girFs:UdhZihdlELjfS4OyNM+gi5s
TLSH
T19791044256AF2F9BE0A047720B2B4719D3307C43FD31961D6784A21F6DB0EE09E4DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 4KB
SHA256 0f780e5c3b2a051370f884b90f6fa4559700920dea259fd62e3e0fd944eb3f7b
MD5 44a40b3464f7e686e8c109452ce39662
SHA1 ff0a38d36a057b6437a12c7db629ca416a30c45e
SHA512 7755b754095a1bd18fcced44f8c6e75fe1f462eb69c4f09ebfdfcf8a4767665f8893aa19c2551db4c0bb57cca11b3444228f3db1faa28e8b3710aafffdc7f799
SSDEEP 96:UtyZMRhZ4nhdft3ErJRjfS7srRM+girFs:UtyihZihdlELjfS4dM+gi5s
TLSH
T16391044256AF2F9BE0A047720B2B4719D3307C43FD31961D6784A21F6DB0EE09E4DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-14-0x00007FFCFDAE0000-0x00007FFCFDAF0000-memory.dmp

Download

memory/208-8-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-6-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/208-9-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-11-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-13-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-0-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/208-12-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-10-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-7-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-5-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-15-0x00007FFCFDAE0000-0x00007FFCFDAF0000-memory.dmp

Download

memory/208-2-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/208-36-0x00007FFD403C0000-0x00007FFD40623000-memory.dmp

Download

memory/208-3-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

memory/208-4-0x00007FFD4051F000-0x00007FFD40520000-memory.dmp

Download

memory/208-1-0x00007FFD00500000-0x00007FFD00510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads