72cb4273057e82013ea44f140383fdce08f91df90beb1d83be3e4b2efa274041

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

phish_alert_sp2_2.0.0.0.eml
Size

110KB
MD5

a9f9be2001b50ea1295ae179d262506c
SHA1

f957ca02db1e18d1ffacb4fc8043aa0e02d263f1
SHA256

72cb4273057e82013ea44f140383fdce08f91df90beb1d83be3e4b2efa274041
SHA512

253da2c1d068ef7f8724165778c8390b7bd0e561053c34f13ce16679b0a42bb25e94bf22fd12ad23fad8c74a9fef68ca1adbe8591fa6bf8599b49745a4846443
SSDEEP

768:n5F0AN/zOPwKRAQPmGar22MXLMv8NCZ9vGIESSu0XoWbTxtPUTH:n5FZ/zOfJar9Tr+IEnjfU7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml
1⤵
- Modifies registry class
- NTFS ADS
PID:4000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...