fc46b3b310ce8be50cc216f4d2fdabf02bc29a31bcb46019f9dd19cf3264571b

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 15:25

Target

FW Signature Required Agreement From at 5_3_2023 7 16 23 PM.eml
Size

32KB
MD5

c65d8fa26c1e2b51632facad779e417a
SHA1

920354ed5ec69cfd89d8e405810285d0d3a5b0f8
SHA256

fc46b3b310ce8be50cc216f4d2fdabf02bc29a31bcb46019f9dd19cf3264571b
SHA512

dec810995c236e63230a8e0d61185b63e76019f4a0c5e6676ddb681198e61fdc655d8f005796457752a38d2d79437169e640820e028b66b9d8c31911e011fc43
SSDEEP

768:7d+tMKt00RkiIBfXwwt+LDQrK9NLtvmqk:8awIZXwwt+7N/k

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\FW Signature Required Agreement From at 5_3_2023 7 16 23 PM.eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	OpenWith.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact