Overview
overview
6Static
static
0AC0360234...7A.msg
windows7-x64
60AC0360234...7A.msg
windows10-2004-x64
3image002.png
windows7-x64
3image002.png
windows10-2004-x64
3image004.jpg
windows7-x64
3image004.jpg
windows10-2004-x64
3image005.png
windows7-x64
3image005.png
windows10-2004-x64
3image006.png
windows7-x64
3image006.png
windows10-2004-x64
3Analysis
-
max time kernel
107s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
image002.png
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
image002.png
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
image004.jpg
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
image004.jpg
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
image005.png
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
image005.png
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
image006.png
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
image006.png
Resource
win10v2004-20221111-en
General
-
Target
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
-
Size
200KB
-
MD5
78085a4926d118661d2d28eae0f024c8
-
SHA1
d1a86474c2ac9a9f2c34c54281618f15d7dfba5a
-
SHA256
0ac03602341f8ff2d62978ee40c0c1e4ab86ff695fc4b27c9a34f536c9d6017a
-
SHA512
e21626150e0758f9c9d2e78c01ef9c9a2154db1f897d62c3e8455ad2493daba7b9bc5fcec6834fe9dfc7b67fa59d60a791aecff119bd3f6afd4c7142c4d0ab3a
-
SSDEEP
6144:mLWEmlocjQXUiXUzh/2TmrE33z5sBvI6Btgj:83uBgWtu
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE -
Drops file in System32 directory 14 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE -
Drops file in Windows directory 3 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE -
Processes:
OUTLOOK.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 1204 OUTLOOK.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 1204 OUTLOOK.EXE -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg"1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-54-0x0000000072E71000-0x0000000072E73000-memory.dmpFilesize
8KB
-
memory/1204-55-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1204-56-0x0000000073E5D000-0x0000000073E68000-memory.dmpFilesize
44KB
-
memory/1204-57-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB