Analysis
-
max time kernel
154s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11/05/2023, 16:18
General
-
Target
You now have Audio Conferencing for Microsoft Teams – Here is your dial-in information and PIN.eml
-
Size
24KB
-
MD5
8c71374eead4fbd088ba215d814c3a5d
-
SHA1
6f601996eac3f05a6c62a33b09650c383ab9a4ef
-
SHA256
104c113b70d2790e330809570f8f16cbec21b515ad5fe6ffbb493a959529f466
-
SHA512
a02ada39db5346f3bc92b1b274b7cd85bce314ef50628b3c937906c9ebb2cf6e49b3385fca9c863a8b6223ce94c9653a70fbc7b09bf9f215c1d30ac0c3d8a4de
-
SSDEEP
768:JH0zHkrBjxEA/T5qvyJ3H5o65SPbGH5Ex5s45jHKX5xdX+HbXyHnX6x5rH5sH5nS:JHOHkrBjGA/VqvyhH5o65SPbGH5Ex5sE
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\You now have Audio Conferencing for Microsoft Teams – Here is your dial-in information and PIN.eml"1⤵
- Modifies registry class
- NTFS ADS
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx