Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 12:52

General

  • Target

    06836722_218 Aluplast.docx

  • Size

    407KB

  • MD5

    85b21eac5630ccb75418fbe56e48f98f

  • SHA1

    fd614c1c4cf1d32d38c3d9275b22d0ded67e02f8

  • SHA256

    a27c5de3b48b3de6f4aac09e1a73c5a4bf47be527f86d83636f0a47eadb12f1f

  • SHA512

    9c70c59908cf79549137476dba8361c39d5045f713195f1a0b288c9e0ae03b3f75a651ab731b655e51de687ea481bc9fe848db303c2b3d9d0b3432929b15251b

  • SSDEEP

    12288:wNlBLJuOt2+7GxmPZqTTATgkIhEtTB2gP:AlBLNt2gs/1Ej1P

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\06836722_218 Aluplast.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CABAC2E5.emf

    Filesize

    3KB

    MD5

    4a103fc1809c8ea381d2acb5380ef4f6

    SHA1

    6c81d37798c4d78c64e7d3ef7eb2acb317c9ff67

    SHA256

    1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c

    SHA512

    77da8ab022505d77f89749e97628caf4dd8414251cb673598acba8f7d30d1889037fab30094a6ce7dc47293697a6bef28b92364d00129b59d2fc3711c82650f5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F4365974.emf

    Filesize

    1.4MB

    MD5

    bdb651a93e94a128e9fc7fb1b71ef63f

    SHA1

    aff0794615a836dec0b72d8f6947a4178d02f52d

    SHA256

    4b18541f2c8d6344b62dec12138458e1649fea21c672cfda37b27afe056b9caa

    SHA512

    ff3bfd7ecf0c4662f6749f1a51894130db5d0406d5870711a481463d64ed5f89ae8f81972c6838922e69f70ae2c4cabe0b59341c7edb84f4c1d48d9fef130a85

  • memory/4432-18-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-4-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-5-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-20-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-6-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-21-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-8-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-9-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-10-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-11-0x00007FF7ED800000-0x00007FF7ED810000-memory.dmp

    Filesize

    64KB

  • memory/4432-12-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-13-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-14-0x00007FF7ED800000-0x00007FF7ED810000-memory.dmp

    Filesize

    64KB

  • memory/4432-15-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-16-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-17-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-117-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-3-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-7-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-22-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-23-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-24-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-1-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-2-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-78-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-79-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-80-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-110-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-111-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-113-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-114-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-112-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-115-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB

  • memory/4432-0-0x00007FF7EF8B0000-0x00007FF7EF8C0000-memory.dmp

    Filesize

    64KB

  • memory/4432-116-0x00007FF82F830000-0x00007FF82FA25000-memory.dmp

    Filesize

    2.0MB