Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 20:06
General
- Target design.docm
- Size 41KB
- Sample261020-yvcsxaev21
- SHA256 a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\design.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer C:\Users\Admin\7245f9e9-e16f-4a9b-8bbc-5e7f7b92df9c.vbs2⤵
- Process spawned unexpected child process
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\7245f9e9-e16f-4a9b-8bbc-5e7f7b92df9c.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\91072f31-eda0-4ab5-91f0-5336538e2a56.cmd" "3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /xml "C:\Users\Admin\91072f31-eda0-4ab5-91f0-5336538e2a56.xml" /tn 91072f31-eda0-4ab5-91f0-5336538e2a56 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\91072f31-eda0-4ab5-91f0-5336538e2a56.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7245f9e9-e16f-4a9b-8bbc-5e7f7b92df9c.vbs
91072f31-eda0-4ab5-91f0-5336538e2a56.cmd
91072f31-eda0-4ab5-91f0-5336538e2a56.vbs
91072f31-eda0-4ab5-91f0-5336538e2a56.xml
iso690.xsl
cabEC7A.tmp
cabEC8B.tmp
cabEC8C.tmp
cabEC9C.tmp
cabEC9D.tmp
cabEC9E.tmp
cabECAF.tmp
cabECC0.tmp
cabECD6.tmp
cabECD8.tmp
cabECD9.tmp
cabECDA.tmp
cabECDB.tmp
cabECDC.tmp
cabF09C.tmp
cabF198.tmp
cabF266.tmp
cabF2B6.tmp
cabF2F6.tmp
cabF421.tmp
cabF684.tmp
cabF7AF.tmp
cabF7E0.tmp
cabF830.tmp
cabF95B.tmp
cabFB23.tmp
cabFBE1.tmp
index.dat
CUSTOM.DIC
3MSQLSKXMRD7WYIKFTIQ.temp
TXRHWZJ5Z3V81HB7LFJ2.temp
memory/4896-0-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-86-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-87-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-85-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-64-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-58-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-57-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-48-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-47-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-46-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-45-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-17-0x00007FFA17C70000-0x00007FFA17C80000-memory.dmp
memory/4896-2-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-1-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-3-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-7-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-10-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-13-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-16-0x00007FFA17C70000-0x00007FFA17C80000-memory.dmp
memory/4896-14-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-15-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-12-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-11-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-9-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-8-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-6-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp
memory/4896-5-0x00007FFA59F7F000-0x00007FFA59F80000-memory.dmp
memory/4896-4-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-336-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-335-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-333-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-334-0x00007FFA19F60000-0x00007FFA19F70000-memory.dmp
memory/4896-337-0x00007FFA59E20000-0x00007FFA5A083000-memory.dmp