Overview

overview

3

Static

static

1

Reminder P...ou.msg

windows10-2004-x64

3

Analysis

  • max time kernel
    66s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2023, 17:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Reminder Philip Trew shared Jefferson Energy Co Project Status Report.pdf with you.msg

  • Size

    91KB

  • MD5

    b95f6d90477e1a464b75f8a7c909a372

  • SHA1

    36c4eff486c1cb9511b1b003423c9724a1ca8731

  • SHA256

    26e1315bf9e9c2c52958ee3613984ad54c835eb5677f9b04e54d9584229e5af0

  • SHA512

    23a0866886bc330b1c406eefe420a1eee6fa40bbd8c98faa895fb8bcb0e7b30ad22f51e911f1e7bf33b92661af210083eafd3fd88c26de5dc9051c351e563ed0

  • SSDEEP

    768:3OAcGuP8Ll1mDnPVISAPFr/0M+WsKFWsKWy5f519KbliyufcHAkNvDXmyJIrAE44:31Ux1xWNW+q0blfEcHNLWyJ9yiXEi

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 53 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Reminder Philip Trew shared Jefferson Energy Co Project Status Report.pdf with you.msg"
    1⤵
    • Modifies registry class
    PID:1828
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads