444486ada4a3d4ec1c24e5f9b7418046d4b6068055f2fa2c61ed3b5fd26c9264

Resubmissions

30-08-2023 19:37

230830-yb29fsac99 5

30-08-2023 18:48

230830-xf997ahh84 5

30-08-2023 18:47

230830-xfcnxshb61 3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30-08-2023 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

message (2).eml
Size

78KB
MD5

12798e804b919631ffa72b43eab3ccf6
SHA1

26614452321f4599c1529dfe934bdbc9051c8712
SHA256

444486ada4a3d4ec1c24e5f9b7418046d4b6068055f2fa2c61ed3b5fd26c9264
SHA512

91fa73fe94cde4ed2edc2b8baccdf8bc507692144b9ea2bd897995f1b015a975514d4147e531bd4650875188aecb91fb20c2272bcc0eb59eed032bfb1d0e8d88
SSDEEP

1536:inHOduS7+SkoG+tIJRF5Nc3yO8HyTiseA98/piPIj107V+AE/VO:inHO3VkoG+tIJRF5Nc3yO8HyTis79Wp2

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2220	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\message (2).eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
e95372b9129898db9cc0e7b6a5c89ac3

SHA1
e42113b4e3cdafaa8838b21fbf0cf33752f13949

SHA256
311bee5c49960e8007b58eaf988b7193b096806c654a5ce1b9fd844b1dd4c0a8

SHA512
3ff85a4759655e5ccd491d69246474695394dea1f9982aecef49873f1e0b2342f94ff29d5bc096f0e268b1b9474207056dc8380ffc754b72947601e576d74bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
9970500d97e2620844c9e5fc4d43600b

SHA1
04877f2104c6262a8d1f62dfda1e797e22da7cfd

SHA256
642046c504511b8814fc49d28f089096bcf7cd8fac6ad2dfa600f9e7f8b4747f

SHA512
738c7205acbf14f3b276ec2cdff88c5aeeb07b504a752399b921c71ceb1b4843ff7fbf9c45a15326fe504c50aaf6a361d21d1e175591e0b9662a1f23baacdcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
235KB

MD5
9970500d97e2620844c9e5fc4d43600b

SHA1
04877f2104c6262a8d1f62dfda1e797e22da7cfd

SHA256
642046c504511b8814fc49d28f089096bcf7cd8fac6ad2dfa600f9e7f8b4747f

SHA512
738c7205acbf14f3b276ec2cdff88c5aeeb07b504a752399b921c71ceb1b4843ff7fbf9c45a15326fe504c50aaf6a361d21d1e175591e0b9662a1f23baacdcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/2220-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2220-1-0x000000007367D000-0x0000000073688000-memory.dmp

Filesize
44KB

Download
memory/2220-124-0x000000007367D000-0x0000000073688000-memory.dmp

Filesize
44KB

Download