6e7ac4fdaa9cd0891015ef8c40c54084cb7b11e4ca136c00dda081c88e36bdc5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Incident 118899.eml
Size

12KB
MD5

a1456901641502c3dfc40c0c933615d9
SHA1

0aa340f5a66e20f390609d01a67decf69551edaf
SHA256

6e7ac4fdaa9cd0891015ef8c40c54084cb7b11e4ca136c00dda081c88e36bdc5
SHA512

af83315c418941e72d6622bef243443a99447131702bb5c7fec6940ef67a936f6cd60076f599acc99a4dcad06bf93d972055beed2576baa968284d7ed1a1c398
SSDEEP

384:4a1AWrlRJPb0/2azIn6UZ25kZwSRUYzd2GwnrH:pTlbCzIwuZwSyYEGEH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3028	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\Incident 118899.eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
152bc08db2a5142e72577422000ffac6

SHA1
850db6180443f267f1da4117759b9dbf8a509a75

SHA256
c6ef639a3c817ce9b1531f5b7f79ccaaad7d86f40df96246eac01df63aff9f1c

SHA512
e60e6c764fb5617000ab69e9a0dcc59d32a09b9a40f95d00d7b19b26e10487ad4bc48ed8fd62ac06899878878f876bffef8e82fc5e5f54671c0fc43d08dcdf3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
35b111dd4546336d1c38eaa02dab8fcf

SHA1
4cb2f5c5f5765238e70a81873894e2b279cf6645

SHA256
76456df119d667455629abaf786b52f25ffb0ddc5d6932673c388e6743b18c50

SHA512
79a046c48b760d4746b1f005316c797c42c44e27dcd6a2b1dc007762ae450547c23eaff74c1ad6ae4f86b24f8013a6fa6f767df24f6f7b2dda6d6392ef7bb39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
35b111dd4546336d1c38eaa02dab8fcf

SHA1
4cb2f5c5f5765238e70a81873894e2b279cf6645

SHA256
76456df119d667455629abaf786b52f25ffb0ddc5d6932673c388e6743b18c50

SHA512
79a046c48b760d4746b1f005316c797c42c44e27dcd6a2b1dc007762ae450547c23eaff74c1ad6ae4f86b24f8013a6fa6f767df24f6f7b2dda6d6392ef7bb39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/3028-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3028-1-0x0000000073B8D000-0x0000000073B98000-memory.dmp

Filesize
44KB

Download
memory/3028-124-0x0000000073B8D000-0x0000000073B98000-memory.dmp

Filesize
44KB

Download