Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-06-2024 11:31

General

  • Target

    External A New Audio VN available from Matthew _2112779118.eml

  • Size

    324KB

  • MD5

    df26c174356428202b60d48a909c7bac

  • SHA1

    d99b4c4f0571468a8c47465db2cbf27d349a8639

  • SHA256

    b88505b4e2fe71b841b722d32fd939c54bc89e0acad6d9837110d85a109e1363

  • SHA512

    479b576d58bb3328ea0377484105cdf15bfeed952f0dd0cccfa6fd7df06f3c46267af4d934068678d80df23455ad6733532b65b467909af85284475028931c90

  • SSDEEP

    6144:4jxrCWpqy+Ipj9OGTupc+pz87Mrl/DbtZf1Fw6s1hEvUpQ:4lCfMfTupcoA7M/xLwlhu

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\External A New Audio VN available from Matthew _2112779118.eml"
    1⤵
    • Modifies registry class
    • NTFS ADS
    PID:792
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads