a5d180d842683fe1ec28f21b5bc674e26911b2bdb101463bcd821d2f2c9935c3

Resubmissions

01/09/2023, 05:51

230901-gkbdnacg6t 5

01/09/2023, 05:47

230901-ghbawacg5y 5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

POTENTIALLY SUSPICIOUS SHIP DATE Aug 29 2023.msg
Size

204KB
MD5

379270fb269df472c2cf4a7f4e120244
SHA1

0c87dd774f82e4f52a5c80b565ee2f0e97e109c6
SHA256

1f47739cb2c5fab701bd783346bc0a1b9d9f862dd9bb5ed170df95296ede1d4f
SHA512

87ce1904b6274822f181e49279d835da4ea684d250a0e7e978a5acf63880dffb9965cc135dd19a1cfbfe5e2e32137e9c8e0fc345c8836dc4a1132b7fe8b1981a
SSDEEP

6144:ZtaTQWF2ok3u9mnPXHAriJdTf7l5iH2Kt4dl2x/E:ZgTQWF2ok3u9mnPXHoiJdTf7l5iHL

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2872	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	OUTLOOK.EXE

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\POTENTIALLY SUSPICIOUS SHIP DATE Aug 29 2023.msg"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
19abece0d28700c0eb9a5421f958baf1

SHA1
fd22c1f3292305f8e1066dce41ee11411fd9fb3b

SHA256
efdcb0b90f61c992f3c82b970ec10b29e0c5c5f73bf2e08f4d41eb2f91dd3744

SHA512
b3567ee2cb760b63cfb5987059b39777a6a2308b07b27424c80c48c24ec8135a0fcd8cd28b657e3543774cfe42c905c3602da4993466ac663969017553f24731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
5f30a0f33bed55ebec83693778ff3bb0

SHA1
0967b07d698b995c0550845a7570b380e5ad9644

SHA256
99a520ac052deffaef65c9118e546f18ad016ccbec4d32053996205d1db8450d

SHA512
ba0dc594acbac76ee8a8d74908f08602eaa1495ad045081ec49f59499a5e3bb163682259224047139dc2001281d6747450c68b2395e73d0b62a4616e33892330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
5f30a0f33bed55ebec83693778ff3bb0

SHA1
0967b07d698b995c0550845a7570b380e5ad9644

SHA256
99a520ac052deffaef65c9118e546f18ad016ccbec4d32053996205d1db8450d

SHA512
ba0dc594acbac76ee8a8d74908f08602eaa1495ad045081ec49f59499a5e3bb163682259224047139dc2001281d6747450c68b2395e73d0b62a4616e33892330

Download Submit
memory/2872-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2872-1-0x00000000731FD000-0x0000000073208000-memory.dmp

Filesize
44KB

Download
memory/2872-124-0x00000000731FD000-0x0000000073208000-memory.dmp

Filesize
44KB

Download