7dc6e3106413ad883680745af653b737bc9ae0b2d2599eeb7ee45aeea3a4494f

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261002-278819-31caj3.xlsm
Size 555KB
Sample261002-mpj49ax18r
SHA256 7dc6e3106413ad883680745af653b737bc9ae0b2d2599eeb7ee45aeea3a4494f
MD5 39aa1923e02ff1b6ba0730167cc55165
SHA1 e78df3924af4b8006325a97a0be7722606c8c60f
SHA512 54a89b3528b9b09ad04c81bb31af3ce09b53a85f4009a38c5827b99c8ed8af84e0ffbbaae3ab02ae8d0a54b07df3f786ee5a92070c347bb2c5bee35367e84c08
SSDEEP 12288:stqRgLFbA4XUTzCpOrYUsEV3lol/AWkf/SaBQHD:s+gLNITztKExs//MSJ
TLSH
T1F5C42319E3489C28C25F84B8E1DC10E582AB2B51E522F60F3CACB95C5F9D5774ECE399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
256	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\8C0A5E00\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
256	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
256	EXCEL.EXE
256	EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE
256	EXCEL.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 4300	256	EXCEL.EXE	89

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\attachment20261002-278819-31caj3.xlsm"
1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C0A5E00

Path C:\Users\Admin\AppData\Local\Temp\8C0A5E00
Size 550KB
SHA256 e87ce2427a9254f78490eb8f1e0e1273f86b6e92905ddbe8b527312bf8594b91
MD5 2aa4107da3d426c19b4d6187ffc3906c
SHA1 43414b2cbf2779e58c91d3a8c21f9ced1e3a269e
SHA512 81ce172f19ce355b9d1b5b91d299b394c9575bf129664f27cf0224d10902bcf754b92abb7d88e71643c9c9874fd59b3ebea593eb57a96d1fe54131028f707eea
SSDEEP 12288:OYeJ04VK6trFlaX4pmUEo1V3rol/AWkKlyQHfn:4JRVz1PpmUEexe//jzn
TLSH
T1BBC4121ADD68CC38D2DA98B8D29E50F141675A459A37960F30DCE9444B836FB0ECF2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WXQTJ37RR7KI4UIINTKE.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WXQTJ37RR7KI4UIINTKE.temp
Size 2KB
SHA256 fc7933180e1d414fcf5e04456f0d7d4fbe29dc9c1c79668ddea217d91e9552fc
MD5 9a8513c3debf05eae8793c624e8df2f1
SHA1 7b763f7a2fb5350c8b8bccd0f3efbbb190e7bd77
SHA512 d97b883e7b2c3e9fba75a9e81b9eb78877b75d39ad2823feb1e8fb5a6f2a86470a3a5d1af0ec5afa2d802d292f255f4e88714613a8f36d186d32b46c6518b3f0
TLSH
T1AE51DE024F8B0F2AC26107773F279386E770BC156B35976EB584C22BBCB98408E4DE25
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-8-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-10-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-6-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-5-0x00007FFD024E0000-0x00007FFD024F0000-memory.dmp

Download

memory/256-4-0x00007FFD024E0000-0x00007FFD024F0000-memory.dmp

Download

memory/256-7-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-0-0x00007FFD024E0000-0x00007FFD024F0000-memory.dmp

Download

memory/256-3-0x00007FFD424FF000-0x00007FFD42500000-memory.dmp

Download

memory/256-11-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-9-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-12-0x00007FFCFFE80000-0x00007FFCFFE90000-memory.dmp

Download

memory/256-13-0x00007FFCFFE80000-0x00007FFCFFE90000-memory.dmp

Download

memory/256-2-0x00007FFD024E0000-0x00007FFD024F0000-memory.dmp

Download

memory/256-54-0x00007FFD423A0000-0x00007FFD42603000-memory.dmp

Download

memory/256-1-0x00007FFD024E0000-0x00007FFD024F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads