5a8599dec318a3c7e41f216c4a8564e0ede22a6c7295c36ef85bd317d8230d09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

no subject.eml
Size

16KB
MD5

1e17877b99a7390847ccf5ade4d14c95
SHA1

f8f5e1d89566715898d1acdbea7f7b2cfd4a1312
SHA256

5a8599dec318a3c7e41f216c4a8564e0ede22a6c7295c36ef85bd317d8230d09
SHA512

4441ef11eedefa5144f8d792b668a23fea8fd7c063124a95d64196206dbec7a85881a6e51fd5b31cfa073cac0466d0448335942a4fe595975862d8f1ce695c31
SSDEEP

192:pFRYzy9m22Vl1joqr7npkwwUWwSrRauPFxOwNfjiO/7F5jowU2s8c2FFn3yFrvUu:pFky9uz3+bwq3LNJ9tFF34rlj

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2056	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\no subject.eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
98b322e792ad5cb7d8d3a917567d88b7

SHA1
31485a62dbe707313c880bcdd2d217b35ff62e37

SHA256
8c43128966b141119718915beb5392eeea0769b562cb0b1f2a1b514807b83dfe

SHA512
2f033082cb2f0c94508136e297fd76c811e7c20fd563976e6d9599a6a7b78cef418f3662777f3a9fd658c8fde68e5a148f8b81cd17f56a68906f35029582130d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
61bce498b8a7008a5491934e417bca62

SHA1
3a345bcb940e786d836f366448de43cce3f5d166

SHA256
1d78f9c082b28850bc6fc25a51db586d1a8d1f65f0cc7adade9bdc504eb19b37

SHA512
2b57c77530d086330baa77b138a0ea42f87691f37198108a8cd30b2116b295b1ce568e972f00d356c141012872ab11dfe0511ac497b035da7a97ff5ef4d13d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/2056-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2056-1-0x000000007302D000-0x0000000073038000-memory.dmp

Filesize
44KB

Download