Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 18:19

General

  • Target
    cc-unit3.pptx
  • Size 23.5MB
  • Sample261029-wx9vbaca73
  • SHA256 6b4ba49a66ebfcde44ec2ba3da6a94c46216cf7a92e3e6c58238a616f2d4e839
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Documents\cc-unit3.pptx" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cab10F.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cab10F.tmp
        • Size 2.4MB
        • SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cab140.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cab140.tmp
        • Size 1.8MB
        • SHA256 8af4c7cac47d2b9c7adeadf276edae830b4cc5ffe7e765e3c3d7b3fadcb5f273
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cab1EE.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cab1EE.tmp
        • Size 2.6MB
        • SHA256 3779e325d94b6fa8023669da99cf47a3169e6648913018886647ecb9e6f735e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cab26D.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cab26D.tmp
        • Size 2.8MB
        • SHA256 a1acf9d982a2531697766e894faab8ad73690e87ec341097fb0f5682e1b76e21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cab8F7.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cab8F7.tmp
        • Size 2.5MB
        • SHA256 a44166f5c9f2553555a43586ba5db1c1de54d72d308a48268f27c6a00076b1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF40B.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF40B.tmp
        • Size 442KB
        • SHA256 1d9c6c49026503e16d584633211df49b82191f3988f466c7f12d29c8ae5e4e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF47A.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF47A.tmp
        • Size 484KB
        • SHA256 34a36ff02892fd8f89c77992ec7a7eb0fd1459483eccbbee139c38646e8685ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF52.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF52.tmp
        • Size 7.8MB
        • SHA256 8fba95d2c1904dfd921417ce8829fa9198cb650e7b1c0e7344743a7007bc22f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF612.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF612.tmp
        • Size 476KB
        • SHA256 4087d3c1e0d93567e67fc8f17cd3ad5587c2fc203b1bbeb8d7a01a750d54e924
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF8D3.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF8D3.tmp
        • Size 1.0MB
        • SHA256 4c3b008e0eb10a722d8fedb325bfb97edaa609b1e901295f224dd4cb4df5fc26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabF9CF.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabF9CF.tmp
        • Size 1.2MB
        • SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabFB77.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabFB77.tmp
        • Size 1.3MB
        • SHA256 9f4cd66a196d3874ba6bc74f9320f4eadde09586dcb0ae00adf0a56ec3eee5f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabFC54.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabFC54.tmp
        • Size 1.5MB
        • SHA256 80adc8c9ede235ad8cd45eeace2f40227aba01d9fef261756f4a4c44eafb146b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabFDAE.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabFDAE.tmp
        • Size 1.0MB
        • SHA256 30aec7f9ecdad690a2cb38ba6a2e07c8158175140b76f17aae7d828a42a727a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabFE8B.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabFE8B.tmp
        • Size 2.0MB
        • SHA256 ad50810112e08b981e967a5984dab3da6c4aaa890316ba38d44f39d80ccbb4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cabFF58.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\cabFF58.tmp
        • Size 2.0MB
        • SHA256 c8b322819a2f84bf80acd654aaaac3e08debb533b1086021078effba27968a37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.dat

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
        • Size 292B
        • SHA256 de2cffded229edee0217294d3cabeda6a94e457402c96fa7cd609f908a9616ca
        • MD5 SHA1 SHA512 TLSH

        7P1BL8DQI1XIYXTASPFF.temp

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7P1BL8DQI1XIYXTASPFF.temp
        • Size 24B
        • SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
        • MD5 SHA1 SHA512

        d00655d2aa12ff6d.customDestinations-ms

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms
        • Size 652B
        • SHA256 b5374955959e2e22b85c7ed3dd0a091869c9e8e9e0a3924314802cd6188f5d67
        • MD5 SHA1 SHA512 TLSH

        memory/3108-9-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-37-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-16-0x00007FFAE70E0000-0x00007FFAE70F0000-memory.dmp

        memory/3108-15-0x00007FFAE70E0000-0x00007FFAE70F0000-memory.dmp

        memory/3108-11-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-13-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-14-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-12-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-10-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-0-0x00007FFAE9A60000-0x00007FFAE9A70000-memory.dmp

        memory/3108-4-0x00007FFAE9A60000-0x00007FFAE9A70000-memory.dmp

        memory/3108-7-0x00007FFAE9A60000-0x00007FFAE9A70000-memory.dmp

        memory/3108-8-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-5-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-6-0x00007FFB29920000-0x00007FFB29B83000-memory.dmp

        memory/3108-2-0x00007FFAE9A60000-0x00007FFAE9A70000-memory.dmp

        memory/3108-3-0x00007FFB29A7F000-0x00007FFB29A80000-memory.dmp

        memory/3108-1-0x00007FFAE9A60000-0x00007FFAE9A70000-memory.dmp