a1590985593285274a20f3a48c6cac3ba9ed95c9771792f891f5a5a9e370e783

Resubmissions

07-09-2023 19:52

230907-ylr68sdg9x 5

14-08-2023 03:55

230814-eg3bvsbc9t 5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2023 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RE URGENTYou are temporarily blocked from sending.msg
Size

101KB
MD5

c92b3dace8750b29b9a78dcb6155c56d
SHA1

d6e2823b03846de4a3bad6c9314273f74020f679
SHA256

a43088ca0f0d3c3e931e1e2f5dd3147e629aa185ec8f09fcaa5880087a125dfa
SHA512

bf5c11c4c3f7abb9493f4467f4d6f5f5f9b3b26f31837ecae5e5dd90ad54189af6020e95929fef7e24a594da2aec1b17651edee331a92dbe159a02242db29f40
SSDEEP

1536:iDbhDCmFkYvYyYNBY28TTDPmt0WXqMi51m:iDb9CmFkYvYyYNBY2iToiL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RE URGENTYou are temporarily blocked from sending.msg"
1⤵
- Modifies registry class
PID:2136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads