Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
412KB.pdf
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
412KB.pdf
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Free_Test_Data_100KB_XLSX.xlsx
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Free_Test_Data_100KB_XLSX.xlsx
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Free_Test_Data_500KB_ODT.odt
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Free_Test_Data_500KB_ODT.odt
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target Free_Test_Data_100KB_XLSX.xlsx
- Size 100KB
- Sample261002-ed8pgasv2k
- SHA256 b22dd5d3aebe209c92d10af0e4994c312e645c02c5d184a12b03c856d71cea90
- MD5 b9688527426a0c9499ed5ad94e114c2e
- SHA1 421a08a25fb22b9ccb885fbb5f6fcca6b918b080
- SHA512 5088e53e4af19aec717c8c3b8dc1d2d45d864b64b499bfea1e8bfdd5aa10f0945c72eefb66d06ea9b4c8eeb1fc00e5954bb740d699820173671e8fcc91405e7c
- SSDEEP 3072:5iweuEK2W7PbokdOlE8r2AwjgPPKeyyicgQfxduFV:529W7P0oOp2AoGD7QQfxdaV
- TLSH T1E8A3F1EEF2010236CBB2E8BFE86C42975F194FD097AFAD0A47996E84C05C5105F572B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3360 EXCEL.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE 3360 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Free_Test_Data_100KB_XLSX.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3ZFYQMTUHATQ32F5OIYR.temp
- Size 1KB
- SHA256 2641de6be8455a89d1875acbb22930a4571e9c948c814adc47f4e42970781858
- MD5 1f353d32e286959ac74cf5c71482da59
- SHA1 ad94c07a08408ac2ba7b628bea65a51a983d934f
- SHA512 937de3615898287eaf50c6408d913a02b88b7741a1f12dbf74d97aab8cde9e494f8b9e6e19a8c7f8a81a5f47c7b261ae304b483f773ceb9dc301ef4f4fb85554
- TLSH T15D412611096B4F27E0B003332B3E430ADFA07D16AB15561E3548B61B2FB3540C96EB5A
- MD5 SHA1 SHA512 TLSH