Overview
overview
6Static
static
0AC0360234...7A.msg
windows7-x64
60AC0360234...7A.msg
windows10-2004-x64
3image002.png
windows7-x64
3image002.png
windows10-2004-x64
3image004.jpg
windows7-x64
3image004.jpg
windows10-2004-x64
3image005.png
windows7-x64
3image005.png
windows10-2004-x64
3image006.png
windows7-x64
3image006.png
windows10-2004-x64
3Analysis
-
max time kernel
112s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
image002.png
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
image002.png
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
image004.jpg
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
image004.jpg
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
image005.png
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
image005.png
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
image006.png
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
image006.png
Resource
win10v2004-20221111-en
General
-
Target
0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg
-
Size
200KB
-
MD5
78085a4926d118661d2d28eae0f024c8
-
SHA1
d1a86474c2ac9a9f2c34c54281618f15d7dfba5a
-
SHA256
0ac03602341f8ff2d62978ee40c0c1e4ab86ff695fc4b27c9a34f536c9d6017a
-
SHA512
e21626150e0758f9c9d2e78c01ef9c9a2154db1f897d62c3e8455ad2493daba7b9bc5fcec6834fe9dfc7b67fa59d60a791aecff119bd3f6afd4c7142c4d0ab3a
-
SSDEEP
6144:mLWEmlocjQXUiXUzh/2TmrE33z5sBvI6Btgj:83uBgWtu
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
OpenWith.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4752 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0AC03602341F8FF2D62978EE40C0C1E4AB86FF695FC4B27C9A34F536C9D6017A.msg1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx