5ed61c572eeb887bc9dc6ba842610bee454947ab44ecd233260176bafdf6f6a8

Analysis

max time kernel
423s
max time network
425s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_HR Travsport Shared-a-file-with-you (1).eml
Size

29KB
MD5

fff66c65a8c23ee27f3529b74e870704
SHA1

6269bb4ff94967f575b60f10b2687698550f33d0
SHA256

5ed61c572eeb887bc9dc6ba842610bee454947ab44ecd233260176bafdf6f6a8
SHA512

d6b49d59c4ce8388c01f8d979f0d56c3d5ae5e5b5209a0286c6d8fb3eec84bbdf095668fde5c3b3ac8a037200513eae58a4d45bd64d5b95e8cb2aa4ff816ff19
SSDEEP

384:qBjovGWn7ZhXTqHBH01+h0kyqEDoMSx4yjAerOUvrnA2k+jauiBV:5Jn7cH8+2kLEUM64ZerpkcjAV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\_HR Travsport Shared-a-file-with-you (1).eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\_HR Travsport Shared-a-file-with-you (1).eml"
1⤵
- Modifies registry class
- NTFS ADS
PID:1152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...