Analysis
-
max time kernel
183s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 20:14
Static task
static1
Behavioral task
behavioral1
Sample
5af9c6a0-f899-4124-de70-08dad23c8e67.gz
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5af9c6a0-f899-4124-de70-08dad23c8e67.gz
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
sample.eml
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
sample.eml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
attachment-1.tnef
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
attachment-1.tnef
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
Malware Alert Text.txt
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Malware Alert Text.txt
Resource
win10v2004-20221111-en
General
-
Target
sample.eml
-
Size
21KB
-
MD5
898c1dab10650d0a7c949fcc923739c0
-
SHA1
f73e18854bb6d57a0c4117acdbefb5c4bbbf030f
-
SHA256
f795677b051acc6fa00db8c0fb626794d503011cf20391e3cef3b2deb8784fb9
-
SHA512
413f5958801cb4c286dd2ce21e76799f5bff18bfebad6ae07236e33a502d551e786b2b3f33bf65caaa6191c912431c6010c6335148d8e645499e8092e80a6855
-
SSDEEP
384:3OsDoC2d0ZjY5nOu5taAYTxAEbKVPbt8Y74A6rcR5sjznUQ:3n+2BDu5taAqxA/hd756rcRajznx
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\sample.eml:OECustomProperty cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1008 OpenWith.exe