3ac45c99657d96ba685538ba67c822d82f73659bab48ed36ec7d59b9d34dcb07

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a97465b-9aa6-2eac-ba6b-4e2996f279c6.eml
Size

371KB
MD5

21f6492110b7613935c4b177d847d5c6
SHA1

1ca075164c71fbf4c37f00cbf3346c9c7d1e6715
SHA256

3ac45c99657d96ba685538ba67c822d82f73659bab48ed36ec7d59b9d34dcb07
SHA512

ff71011360a1c6a8770d3e882ab0e38b2db92feda2dc203f27db1c2e283d23f7dc662597cfb7f493d07ad530a80bf7565bc50bc1c0f7281c53bc2dc659f6ef30
SSDEEP

6144:biJ83O1M2QwAI3aDvBpKDEeYUC1LsclDrdzOCV39wYL:biJX97aDvB0D6UIL1z59D

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\8a97465b-9aa6-2eac-ba6b-4e2996f279c6.eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8a97465b-9aa6-2eac-ba6b-4e2996f279c6.eml
1⤵
- Modifies registry class
- NTFS ADS
PID:2480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...