88b2db403559d1a60ba3fa4ed9d0f4e9eaed2bf4d9eb3a8230951dd5e225c7bd

Analysis

max time kernel
23s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Contract&Invoice.eml
Size

206KB
MD5

5b296e4f35be8b0d37d20a9a0c53d800
SHA1

2bad9d6857f34f375d3598dd6a5ac21b038f8a6a
SHA256

88b2db403559d1a60ba3fa4ed9d0f4e9eaed2bf4d9eb3a8230951dd5e225c7bd
SHA512

d3e48ddb699c2595afebd146040f61093dddeef37b83160d96322704a6f430c311cdf55fb3f0e18e0e118e21f1137641812a0d0012e749d65d9953e7769b2021
SSDEEP

3072:oIogMs1bLXYGYHwT+VS9YZpKUFMqtP0Uc7JTChrAMvfgX86ERpWQkliME6kKdj:oVgTXYGJ+QIJMvUC80FX86eScMDkmj

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1972	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\Contract&Invoice.eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
fd9dfd400408f0be704f417c13f0ad0a

SHA1
86bd24b7111a9b597a9f9c04825366b6d455b7f9

SHA256
9d2a5caec8629b830a86104c76873908b264c3c7a33fa90bf9c3a6287c279b08

SHA512
3991311c25630cfbe337a312ecab7c4f8fc0b753763d61125ec3eb0f2eeb7e258db8f8b69b98df2cccd2de324675472e1236f5cac29f294557ed0449321c5aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
19a70b9d74e578228188b41f799cf515

SHA1
169959fd12d39fe55210b2ad4486378199bb2ba7

SHA256
8ab87180f3c15fd51943ee704c05029c587cae3cfe04ec0e4e39b6bac65d0d12

SHA512
1a56cf0d945879585b2087e9a6552706474c045a21650339f206995f74337ed07f5ba58ea5b3392124d75c575c5d306b5295647322243e9fafd6bfd6435182fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/1972-1-0x00000000738ED000-0x00000000738F8000-memory.dmp

Filesize
44KB

Download
memory/1972-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1972-128-0x00000000738ED000-0x00000000738F8000-memory.dmp

Filesize
44KB

Download
memory/1972-133-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1972-135-0x00000000738ED000-0x00000000738F8000-memory.dmp

Filesize
44KB

Download