11b1c80cbbb23cc96b6920ca64cb5fbd366c7da7729a798445bfa9dcfee1296f

Analysis

max time kernel
315s
max time network
1611s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
03/08/2023, 19:19

Target

O_XnFf15S9yiPDuZO3WVug.eml
Size

289KB
MD5

a0dcdeaf8c864f717630819b4bc1a2cc
SHA1

e0b353712e7368a59e168de15c1d69e4bde4c56d
SHA256

11b1c80cbbb23cc96b6920ca64cb5fbd366c7da7729a798445bfa9dcfee1296f
SHA512

2526ce9c4aca9205c460671aa34f795b87c784ac6bcdebb72db1cb2a04366957950179d0a093b544da43ea7999d94b7cf6f506ab311ee364984e32ae2a6c5a89
SSDEEP

6144:LknzGWS7f95HLwEc52eXmlgVe/DC4Z4p0DDnc7j7kP/HxdxsD8OTV:LknzGWSz95LwEc5qlgYZ4p0DDnc7j7k2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\O_XnFf15S9yiPDuZO3WVug.eml
1⤵
- Modifies registry class
PID:4292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact