2fbb076f6cfabeebd2cece11061bf3c8d5da35fc820ddb620dce39ca22c1d0ab

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 15:20

Target

phish_alert_sp2_2.0.0.0.eml
Size

41KB
MD5

e89b7b36f23dbf65388a334706c7aad2
SHA1

d3ce878338fd330e00a8ba9a2a6560dd84f390b3
SHA256

2fbb076f6cfabeebd2cece11061bf3c8d5da35fc820ddb620dce39ca22c1d0ab
SHA512

a22d13ace4895f82721ed7881489bd185c2b0dd9c8fdd5550d1fda44e553211af3f14ba391a6f00f2a867baa75cbac7a2d318df5ffc84437e4681a3f90f13dcd
SSDEEP

192:sEG11oINarDvOT+QcjRoX5f48oBOoXak5OtdzGbPDcPX4uiI8fg7IWU5gEHUa8PS:sEePOWaQU2XC8ozX/GI7oH6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1684	OpenWith.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact