Analysis

  • max time kernel
    115s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 09:16

General

  • Target

    bcaa3be9-998c-1804-d50c-a213fe6a7553.eml

  • Size

    921KB

  • MD5

    5f47f600165ec0498a245787bb4efa29

  • SHA1

    7837c9e901f8a9f1b739f950823869725ef2f41c

  • SHA256

    e87810227505a9d7bdde7ba7d2015d48ef43c847dec950a1144f3b342686c048

  • SHA512

    28612a1cb7ee65345e880b52115130a56d96ada88b0ffae27815cad01ed6a1ff39e4fd5d16b702105edc313e211f5af5d543173b6f8969fdf8eceacbd768b9e4

  • SSDEEP

    6144:bTYWmQNyNnavU5wal+3SIZ5aWrfITY3TzHxgGb:bTBzytF5wQ+3KsfIT8T7vb

Score
6/10

Malware Config

Signatures

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
    C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\bcaa3be9-998c-1804-d50c-a213fe6a7553.eml"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • outlook_win_path
    PID:1996

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

          Filesize

          1KB

          MD5

          48dd6cae43ce26b992c35799fcd76898

          SHA1

          8e600544df0250da7d634599ce6ee50da11c0355

          SHA256

          7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

          SHA512

          c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

        • memory/1996-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB