e41cb029f5777e2712890f4b9f07394fb1edc62cfa791759ba5e7c172388a250

General

Target

JUZGADO 001 LABORAL DEL CIRCUITO - NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO..msg
Size

202KB
MD5

65851a031fcc50691890182b0f2dfc44
SHA1

936a192f67fe48f7018948111dd6bd760b46a52a
SHA256

e41cb029f5777e2712890f4b9f07394fb1edc62cfa791759ba5e7c172388a250
SHA512

bf1a75c106e42c3b6c366efec666cd7b4acee23c97c9c7c2f89d4bf04c1c182aeb40f741172d7f68f6bf83cb38d2ee5fd4c601d93f058bae84f8c535c701182e
SSDEEP

3072:gKtiAmU4Kk/vqOOf0QquNrTH1H0quNw8WhT+1Y1:gKtiAmUTquNr7V0quNw8WhTM

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2552	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	OUTLOOK.EXE

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\JUZGADO 001 LABORAL DEL CIRCUITO - NOTIFICACIÓN DENUNCIA LABORAL ADMINISTRATIVO POR INCUMPLIMIENTO..msg"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
b70e88ffe5bbfca07790987f903ca344

SHA1
bd7f50c6c83ec2888c29ffc461e061018cd107eb

SHA256
b168e6d8ee14fdcbe484b685f4743652d23eb201bb742208a815ba75b2107b22

SHA512
7b85bb7b365382dce649c49c6b5e874dea9e1cf69eebcf03249aae13300f0fa9ba0c22dfee4929e09f08fd1a69f403b78157ab00fb7b82c2c1232c42e459c07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
b70e88ffe5bbfca07790987f903ca344

SHA1
bd7f50c6c83ec2888c29ffc461e061018cd107eb

SHA256
b168e6d8ee14fdcbe484b685f4743652d23eb201bb742208a815ba75b2107b22

SHA512
7b85bb7b365382dce649c49c6b5e874dea9e1cf69eebcf03249aae13300f0fa9ba0c22dfee4929e09f08fd1a69f403b78157ab00fb7b82c2c1232c42e459c07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
b70e88ffe5bbfca07790987f903ca344

SHA1
bd7f50c6c83ec2888c29ffc461e061018cd107eb

SHA256
b168e6d8ee14fdcbe484b685f4743652d23eb201bb742208a815ba75b2107b22

SHA512
7b85bb7b365382dce649c49c6b5e874dea9e1cf69eebcf03249aae13300f0fa9ba0c22dfee4929e09f08fd1a69f403b78157ab00fb7b82c2c1232c42e459c07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
7d321d2c26f34a6bac234168615341dd

SHA1
132ebf1f9c5c683942be1a6145a31e3e9c88e576

SHA256
a2ef46b6bdbbdaf9b1341dbb4242b8559ce6e7f65ccb0e73675bdaae513d87a5

SHA512
1cb8b5747b759724b65f2e43a9dccda478c57c733d1b039d82e2923cf24664efa8bf742196b444f87060f01f9c140b1f9c78f8c9ea98cda10006702fe34cab35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/2552-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2552-1-0x0000000073A4D000-0x0000000073A58000-memory.dmp

Filesize
44KB

Download
memory/2552-124-0x0000000073A4D000-0x0000000073A58000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing