Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
ccsjurxe.docx
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ccsjurxe.docx
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target ccsjurxe.docx
- Size 309KB
- Sample261001-pefp7awvbx
- SHA256 d2ca5d604a8536e51de6a1dbbedb79a5e6678b3dee7bad992db4b13c216fc188
- MD5 5c46866d265b7aa9ad606d5d608df3ad
- SHA1 f0eee3004e36c4019166a27eb1da637c7e964a28
- SHA512 4668a10510a53afa64ae9c07e72a27d548bb233ae9c1f5b3e43af5be380967bba333c4a1ae038616609f7f7dc7233310aad6e5d4cfaf09d4e6f68a372063218b
- SSDEEP 6144:85P0yhzb5gWdttrK4CrVM57GKAFx1zmzjivD3hfWU0dS6VfhvlX84t60Vd:8rhKeQM5N2bWAD3lWFtlsSDf
- TLSH T16A6423894867FE03C65607F022694486D97D4912FB7CCF9BE283972E8B01A5B037F55B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4432 WINWORD.EXE 4432 WINWORD.EXE - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE 4432 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ccsjurxe.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 253a76b1ffb7c8058f28047c1df5f7188cb23be772fac8fded67b9c15f3bccb7
- MD5 f28197c732fdc3f35c9de3de63dc08fd
- SHA1 11e6be457ed23acd1cd2122b8ed1e137362cebb9
- SHA512 24ef95755f1494b4322786453815058b4f70947bb4c48efac237e3fc5bddfc8585f00561b17898154acb6e73f23ba7c835692ed468ced7389f5cb86ed933cd35
- TLSH T13D51A80117DB2E5BE08183B2533A1754E770BD46E6049A4E9A88113A7D789809E5DE7F
- MD5 SHA1 SHA512 TLSH