08bd9dba7006f4fca3f3730add06026358401cbd68da150e7b209f587eaf0c8b

Analysis

max time kernel
101s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2023, 07:26

Target

cf9d53f3-13f4-14d9-f549-cbdabb2c030a.eml
Size

50KB
MD5

c7f34efd260789ae1ad62bc32d9fed6c
SHA1

47b256ea4cb35269bd50655ffc7bb858bb37bf03
SHA256

08bd9dba7006f4fca3f3730add06026358401cbd68da150e7b209f587eaf0c8b
SHA512

af9cb0b9c720bbed3771af3bb66b6bff6beec571346063d79c9f0795657dc788cbc44b659fcdf3c6bfe8e4d37fcab5a560d00aa2baeadc70e4278acff8ec34f3
SSDEEP

1536:wlT0t6rckl1Bfr0FMczea7nwz7cCJM74OMvK2kKJ7gxqE:wiODpEMSea7nwbgxqE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\cf9d53f3-13f4-14d9-f549-cbdabb2c030a.eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	OpenWith.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact