Overview
overview
6Static
static
8896324872...16.eml
windows7-x64
68896324872...16.eml
windows10-2004-x64
3attachment-19.js
windows7-x64
1attachment-19.js
windows10-2004-x64
1attachment-23.js
windows7-x64
1attachment-23.js
windows10-2004-x64
1attachment-26.js
windows7-x64
1attachment-26.js
windows10-2004-x64
1attachment-27.js
windows7-x64
1attachment-27.js
windows10-2004-x64
1attachment-7.js
windows7-x64
1attachment-7.js
windows10-2004-x64
1Analysis
-
max time kernel
165s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16.eml
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16.eml
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
attachment-19.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
attachment-19.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
attachment-23.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
attachment-23.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
attachment-26.js
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
attachment-26.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
attachment-27.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
attachment-27.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
attachment-7.js
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
attachment-7.js
Resource
win10v2004-20220812-en
General
-
Target
88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16.eml
-
Size
353KB
-
MD5
9225bb368038608345dbb5a76b84691d
-
SHA1
87c2c6633b6b329440864dc6e22aa7e53b816c15
-
SHA256
88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16
-
SHA512
226c7c1f306a1256f300647fcfc9a14371e6e5e1915a0c550a28182147a82428a9548eadb7a633df60e0ba7610b56da61cf3bb9ff8cc21e3652c14a818563679
-
SSDEEP
6144:nVPhbZkKEtH+ysIMuSEq3lLZ0lnhWc0tOMq0XnwIHHzi5YGjp8JMZEj2aPjEWujb:zbZ0YJcSEqWncxt5nwIGYGjp8jj2aPjO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16.eml:OECustomProperty cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 32 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\88963248720da6ddedcd98711d15c9cd75e15c46ec47dfcd328b57896b2fef16.eml1⤵
- Modifies registry class
- NTFS ADS
PID:980
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:32