Analysis
-
max time kernel
62s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
03/11/2022, 08:55
General
-
Target
5376ac6cd62f1046d6f9532d75a9824e7acc6211d43f429b2b187a101fec8e35.eml
-
Size
351KB
-
MD5
d51b2f4ab95eb855cac759bd913320ce
-
SHA1
bcd1eed6644e7e948131de0344772dfdd553ee71
-
SHA256
5376ac6cd62f1046d6f9532d75a9824e7acc6211d43f429b2b187a101fec8e35
-
SHA512
ef5db35c976ab61edfcafb7ba654f659d2409f4da3bd6c5d4ff31c4a75d30fab092f903773e7e79ff3b95e292efdba3b9243f139a19030dbb94913ed39d217ca
-
SSDEEP
3072:+sxYZRIAb2B4NRSTNYDKsSSEk1UOzef2mXoOOKcXhEwZXXOzOZBX:+sxYZRmB4/5sSEkWOzef2msnXTBX
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\5376ac6cd62f1046d6f9532d75a9824e7acc6211d43f429b2b187a101fec8e35.eml1⤵
- Modifies registry class
- NTFS ADS
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx