Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-03-2024 13:09

General

  • Target

    25032024_2108_25032024_06836722_218 Aluplast.docx

  • Size

    407KB

  • MD5

    85b21eac5630ccb75418fbe56e48f98f

  • SHA1

    fd614c1c4cf1d32d38c3d9275b22d0ded67e02f8

  • SHA256

    a27c5de3b48b3de6f4aac09e1a73c5a4bf47be527f86d83636f0a47eadb12f1f

  • SHA512

    9c70c59908cf79549137476dba8361c39d5045f713195f1a0b288c9e0ae03b3f75a651ab731b655e51de687ea481bc9fe848db303c2b3d9d0b3432929b15251b

  • SSDEEP

    12288:wNlBLJuOt2+7GxmPZqTTATgkIhEtTB2gP:AlBLNt2gs/1Ej1P

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25032024_2108_25032024_06836722_218 Aluplast.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\734432F8.emf

    Filesize

    267KB

    MD5

    751f5a8e317f2f8dbf8d29e48eed4601

    SHA1

    f668631bbefe9a9d1befe9480394f03c147d60ce

    SHA256

    3de129e7507fb83fd4d460cade004019440af7008c2077d351e893ee82cc9359

    SHA512

    f1a4fdbb477580215f1a4f974e3fe2eceff33c7c5bfe526a6b971d7a24ba672b42de7003d1cfd794f37333216381ebd0da576d9a4a81a6d5de19b8a2ca34458b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FD6699.emf

    Filesize

    3KB

    MD5

    4a103fc1809c8ea381d2acb5380ef4f6

    SHA1

    6c81d37798c4d78c64e7d3ef7eb2acb317c9ff67

    SHA256

    1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c

    SHA512

    77da8ab022505d77f89749e97628caf4dd8414251cb673598acba8f7d30d1889037fab30094a6ce7dc47293697a6bef28b92364d00129b59d2fc3711c82650f5

  • memory/3156-13-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-104-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-0-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-4-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-6-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-7-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-8-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-9-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-10-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-14-0x00007FFD0AC40000-0x00007FFD0AC50000-memory.dmp

    Filesize

    64KB

  • memory/3156-5-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-2-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-11-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-15-0x00007FFD0AC40000-0x00007FFD0AC50000-memory.dmp

    Filesize

    64KB

  • memory/3156-3-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-1-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-70-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-100-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-101-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-102-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-103-0x00007FFD0CE70000-0x00007FFD0CE80000-memory.dmp

    Filesize

    64KB

  • memory/3156-105-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3156-12-0x00007FFD4CDF0000-0x00007FFD4CFE5000-memory.dmp

    Filesize

    2.0MB