Overview

overview

3

Static

static

1

RV_ Financ...23.msg

windows10-2004-x64

3

keeppass.png

windows10-2004-x64

3

Analysis

  • max time kernel
    66s
  • max time network
    81s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2023, 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RV_ Financial Report_ Review Saval Statements_ Tuesday_ March 7_ 2023.msg

  • Size

    79KB

  • MD5

    4f5b2d180bd66247a4c4626790f9598d

  • SHA1

    a774b34528587dbcd3030d6f781f171a2d517497

  • SHA256

    8c5e043f573d9e5080a7aca6ad44e5c254782e5915e70c7445f97d18129baefb

  • SHA512

    07e05a31e4469f30a3964e0f49fbd1c1020887110d46953a8d1f5f0782bfa9bcf00086e80f13a9b53af828510e367d88dabf0c966169eb89dd49350561521985

  • SSDEEP

    1536:61WqPWKWgWcKKQl0P0Wwug7PW/WGmyChWW18EeyVlP:61L4BGyVl

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\RV_ Financial Report_ Review Saval Statements_ Tuesday_ March 7_ 2023.msg"
    1⤵
      PID:5012
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        "C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" "C:\Users\Admin\AppData\Local\Temp\RV_ Financial Report_ Review Saval Statements_ Tuesday_ March 7_ 2023.msg"
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
          OfficeClickToRun.exe platform=
          3⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of SetWindowsHookEx
          PID:3212

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
      Filesize

      28KB

      MD5

      c8642ccaf883bec3e2a03ea13db06def

      SHA1

      37a70a2dffc8b63e58f815429c901dde8f6d5b84

      SHA256

      433771bf48ccb7d130e5846b864d015bc4f6e4c7c29e3a0af4073fd54842c757

      SHA512

      ef56327cc046b9a778768323c85bf246e33ae6dc48fe5832b8c3e262611a49a24ea407b78457b1067bbf85df74861ef2128c7f4281fe91cb3fd367b2caee803e

      Download Submit