Overview

overview

1

Static

static

1

Notificati...l.docx

windows10-2004-x64

1

Notificati...l.docx

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Notification-of-birth-not-occurring-in-a-hospital.docx
  • Size 84KB
  • Sample261102-plwpzsb16j
  • SHA256 51b76bee902758a59ebaa1e6ac37891ab64f34a4652752ae0aadfdef4a9062c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Notification-of-birth-not-occurring-in-a-hospital.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cab6624.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6624.tmp
        • Size 28KB
        • SHA256 da2f261c3c82e229a097a9302c8580f014bb6442825db47c008da097cfce0ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6625.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6625.tmp
        • Size 30KB
        • SHA256 e0100320a4f63e07c77138a89ea24a1cbd69784a89fe3bf83e35576114b4ce02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6626.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6626.tmp
        • Size 30KB
        • SHA256 d250eb1f93b43efb7654b831b4183c9caec2d12d4efee8607fee70b9fab20730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6636.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6636.tmp
        • Size 21KB
        • SHA256 5c70dd1551eb8b9b13efafeeaf70f08b307e110caee75ad9908a6a42bbccb07e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6637.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6637.tmp
        • Size 30KB
        • SHA256 434576eb1a16c2d14d666a33edde76717c896d79f45df56742afd90acb9f21ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6638.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6638.tmp
        • Size 30KB
        • SHA256 cebe759bc4509700e3d23c6a5df8d889132a60ebc92260a74947eaa1089e2789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6639.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6639.tmp
        • Size 30KB
        • SHA256 8077c92c66d15d7e03fbff3a48bd9576b80f698a36a44316eaba81ee8043b673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6659.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6659.tmp
        • Size 34KB
        • SHA256 23ccfb7206a8f77a13080998ec6ef95b59b3c3e12b72b2d2ad4e53b0b26bb8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab665A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab665A.tmp
        • Size 32KB
        • SHA256 df3fff163924d08517b41455f2d06788ba4e49c68337d15ecf329be48cf7da2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab666B.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab666B.tmp
        • Size 34KB
        • SHA256 9e46b8ba0bad6e534af33015c86396c33c5088d3ae5389217a5e90ba68252374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab666C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab666C.tmp
        • Size 32KB
        • SHA256 3c6f66790c543d4e9d8e0e6f476b1acadf0a5fcdd561b8484d8dddadfdf8134b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab666D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab666D.tmp
        • Size 45KB
        • SHA256 40e9af9284ff07fdb75c33a11a794f5333712baa4a6cf82fa529fbaf5ad0fed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab666E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab666E.tmp
        • Size 31KB
        • SHA256 5d13f9907ac381d19f0a7552fd6d9fc07c9bd42c0f9ce017fff75587e1890375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab668F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab668F.tmp
        • Size 21KB
        • SHA256 e555a610a61db4f45a29a7fb196a9726c25772594252ad534453e69f05345283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6861.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6861.tmp
        • Size 225KB
        • SHA256 6a3801c1d4cf0c19a990282d93ac16007f6cacb645f0e0684ef2edac02647833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6AD4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6AD4.tmp
        • Size 681KB
        • SHA256 3732eb6166945db2bf792da04199b5c4a0fb3c96621ecbfdeaf2ea1699ba88ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6BE0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6BE0.tmp
        • Size 537KB
        • SHA256 4e2e93ebac4ad3f8690b020040d1ae3f8e7905ab7286fc25671e07aa0282cac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6C21.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6C21.tmp
        • Size 1.0MB
        • SHA256 4c3b008e0eb10a722d8fedb325bfb97edaa609b1e901295f224dd4cb4df5fc26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6D7A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6D7A.tmp
        • Size 1.0MB
        • SHA256 69b2675e47917a9469f771d0c634bd62b2dfa0f5d4af3fd7afe9196bf889c19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6ED4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6ED4.tmp
        • Size 1.2MB
        • SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6F63.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6F63.tmp
        • Size 1.8MB
        • SHA256 8af4c7cac47d2b9c7adeadf276edae830b4cc5ffe7e765e3c3d7b3fadcb5f273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab6FA3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab6FA3.tmp
        • Size 931KB
        • SHA256 8b0631da4dc79e036251379a0a68c3ba977f14bcc797ba0eb9692f8bb90ddb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab72A3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab72A3.tmp
        • Size 2.4MB
        • SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab745A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab745A.tmp
        • Size 2.5MB
        • SHA256 a44166f5c9f2553555a43586ba5db1c1de54d72d308a48268f27c6a00076b1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab7603.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab7603.tmp
        • Size 30KB
        • SHA256 7e1a90cdb2ba7f03abcb4687f0931858bf57e13552e0e4e54ec69a27325011ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab7682.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab7682.tmp
        • Size 3.3MB
        • SHA256 f2d2df37366f8e49106980377d2448080879027c380d90d5a25da3bdad771f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab7693.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab7693.tmp
        • Size 1.7MB
        • SHA256 640ad075b555d4a2143f909eafd91f54076f5dde42a2b11cd897bc564b5d7ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab76D4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cab76D4.tmp
        • Size 3.1MB
        • SHA256 42323dd1d3e88c3207e16e0c95ca1048f2e4cd66183ad23b90171da381d37b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TM02851218[[fn=gb]].xsl
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
        • Size 262KB
        • SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1FLI099EK1VQGQOL3XTG.temp
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1FLI099EK1VQGQOL3XTG.temp
        • Size 1KB
        • SHA256 f8d3b84baca9acd3953014b96559304708b142fc6fd3f295615a0254357b6f55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        32HVHHXET0CSL6BWBLKQ.temp
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\32HVHHXET0CSL6BWBLKQ.temp
        • Size 1KB
        • SHA256 f68afaefc8799246450c92b9ec78b77a11f209b716a5b83d92f6abca18051a5b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1928-13-0x00007FF8015B0000-0x00007FF8015C0000-memory.dmp
        Download

        memory/1928-12-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-7-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-6-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-5-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-2-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-3-0x00007FF8442FF000-0x00007FF844300000-memory.dmp
        Download

        memory/1928-4-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-1-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-10-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-11-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-8-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-9-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-0-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-14-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-15-0x00007FF8015B0000-0x00007FF8015C0000-memory.dmp
        Download

        memory/1928-16-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-17-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-46-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download

        memory/1928-321-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-322-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-323-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-324-0x00007FF8042E0000-0x00007FF8042F0000-memory.dmp
        Download

        memory/1928-325-0x00007FF8441A0000-0x00007FF844403000-memory.dmp
        Download