Overview
overview
10Static
static
3Soboce.zip
windows7-x64
1Soboce.zip
windows10-2004-x64
1e6b82e1c-a...6d.eml
windows7-x64
5e6b82e1c-a...6d.eml
windows10-2004-x64
3Solicitud ...DF.rar
windows7-x64
3Solicitud ...DF.rar
windows10-2004-x64
3Formulario...DF.exe
windows7-x64
10Formulario...DF.exe
windows10-2004-x64
10email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1image001.png
windows7-x64
3image001.png
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Soboce.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Soboce.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
email-html-2.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
email-plain-1.txt
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
email-plain-1.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
image001.png
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
image001.png
Resource
win10v2004-20240709-en
General
-
Target
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
-
Size
1023KB
-
MD5
ac5c17e87832592ff53c4a53a169860f
-
SHA1
fe18b12abfc07caf7f782db3aeacd8037eed3642
-
SHA256
b112d3e0777a406d0703a4e0ad3c6028431a842adb50fe71fe94fa3ea0b61c29
-
SHA512
8827a63ed2d7d521974028e65b8885eb310a6071fb13e5c207b639b957ff02619051d8cc420035e4dbbd17ca862a042dd4cad357a3581ae577d939dc41b342a7
-
SSDEEP
12288:ExmZbBpsi8noZjbg9Hu8jwzLoDp3m6cSQ/Brkv+hruCJ4AQbSEbUlwVZKn3rYK9W:XbBK8jAJwzA3mBSQJrkwWcloK3G8Cc2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\e6b82e1c-ac44-4023-8042-08dca5e19c90\4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml:OECustomProperty cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4372 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\e6b82e1c-ac44-4023-8042-08dca5e19c90\4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml1⤵
- Modifies registry class
- NTFS ADS
PID:2440
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4372