Analysis
-
max time kernel
174s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 11:59
Behavioral task
behavioral1
Sample
Payment Receipt from ENK General Trading LLC.eml
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment Receipt from ENK General Trading LLC.eml
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Receipt_33523367_from_ENK_General_Trading_LLC.pdf
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Receipt_33523367_from_ENK_General_Trading_LLC.pdf
Resource
win10v2004-20220812-en
General
-
Target
Payment Receipt from ENK General Trading LLC.eml
-
Size
76KB
-
MD5
55fe0926c8a542e68466dae4082e27fa
-
SHA1
e17d842a7ef9126936279002f0316a3982aa7754
-
SHA256
593e29f008abba930b284b916c7a424e045868f8a7f7a7037082253cf0b24248
-
SHA512
11aaf029f6493f9a7296dcb9410c0c19ad29ceb53bd6faa94b8caf95254086b29fd7a4d510c8b1ba3a85b0fadc99dfbc8d8b3abd2a27b5fa44258a1d54333d1a
-
SSDEEP
1536:bV3YQmr7ELOwn+dE48M191eZ13CQbfS9WEkTAWUfavwuLw:bgr7UnsD8M1rgImSsAw8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\Payment Receipt from ENK General Trading LLC.eml:OECustomProperty cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3064 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Payment Receipt from ENK General Trading LLC.eml"1⤵
- Modifies registry class
- NTFS ADS
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx