74861ba8153c69f20e686fdd63e897c6ff2fc836679a7ad5323158aefb097d1f

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2023 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FW_ Final Reminder_ Review and Release_ 8 pending mail on 12_22_2023.eml
Size

27KB
MD5

0de7a9ea48991bda3d79f7c38cf7e7ea
SHA1

9072b9d6813d7aba0be5edb2719a1ced1c25ab6e
SHA256

74861ba8153c69f20e686fdd63e897c6ff2fc836679a7ad5323158aefb097d1f
SHA512

df344c3fdffeff485cbe664ca43c8d4adc655054bd9dbf2088eb5a761b7050ce02bdd74a83c9ed0f3531d397a9cafcb2b2a943758f3f1b429e377e18c7f2e6d5
SSDEEP

384:6FANaorxHwnhQQdsNlUXLF2wG8jC7hFByUrZWvvoD5W2C0czvinov:6FA44HwnelKF2r8KyUrZW3OBzcDinY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\FW_ Final Reminder_ Review and Release_ 8 pending mail on 12_22_2023.eml:OECustomProperty	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4196	OpenWith.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe
4196	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FW_ Final Reminder_ Review and Release_ 8 pending mail on 12_22_2023.eml"
1⤵
- Modifies registry class
- NTFS ADS
PID:1440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads