3af37283ec9f9aa34d3dc202e5e21e57e44dcf5cd76d17da0238d23c31a3c29c

Analysis

max time kernel
205s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

phish_alert_sp2_2.0.0.0.eml
Size

17KB
MD5

469c6b98ec729223748113a6387cdfc1
SHA1

fd7c68a0b5b998cd997c82af446f1fd40d988363
SHA256

3af37283ec9f9aa34d3dc202e5e21e57e44dcf5cd76d17da0238d23c31a3c29c
SHA512

3aa9cae41b051fb8d51c37e6de7649e038df7c9c934737a7de3437258594971a424a2680d18bf9f838d0a83c911b62cbade9a296f84a4971b9cfd6823f7e2557
SSDEEP

192:C1sfTiq/1TXEjHRRS1j+z4aQfTSKeqG3BtaFPeBJEEbUFwaKRD/dsWsdsSIXILgN:3EjxW9fXyBYkEmUFwzvXegFs/+Czi5z

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml:OECustomProperty cmd.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4628 OpenWith.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml:OECustomProperty	cmd.exe

pid	process
4628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml
1⤵
- Modifies registry class
- NTFS ADS
PID:3192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads