62c8eee8c6e82b7c9a4b903dde84087c8e433188d7e725f8ea6f8ebde9f977a2

Analysis

max time kernel
86s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 02:17

Target

attachment-3.eml
Size

23KB
MD5

b95bd6b3e11320aee2945144f73d5a70
SHA1

91710b838b0d7f46c7bf95ad80feaea1348ab32c
SHA256

9316b1014bf3192f8214861e8ab78517ae953c1b623a11bb06e932dd0e0021ba
SHA512

42111de827eb23e87e066cdc15801b277a53e5558979870a2963a1bf16f5ecb17768de5bd924ad23330dbfd22747fc0eef51b0329b24cfbead4418223330e329
SSDEEP

384:Cs2pGrOuL4sA+KRCtROvnUJoAaD/zuae/NghKaWd4vtL2pOPEgyi9gxgalsLeqMZ:upGrhL5Zvm5mrgYMvwpOPxSxg3e8l0KA

Score

5^/10

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1212	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	OUTLOOK.EXE

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
cdda32820d884126d6927f4659046651

SHA1
6c027911fe4f62aea7b523baf4db61b93fc0f955

SHA256
e78e28e146e06c6bcd0d1a9b41f5093f38f51687bbc941297d659a246c87538a

SHA512
5cbc6c5e90f2d3cc197a72f56939051d1058320cbe010e2347be812e9e37196c2557ce64d99cf2948e4d016a79d2fcb4231c583a27521caf3d63c56e1708d3c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/1212-1-0x0000000073F2D000-0x0000000073F38000-memory.dmp

Filesize
44KB

Download
memory/1212-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download