Overview
overview
5Static
static
4f402dbc7-1...94.eml
windows7-x64
5f402dbc7-1...94.eml
windows10-2004-x64
3JNFWVXPO.png
windows7-x64
3JNFWVXPO.png
windows10-2004-x64
3Sarah Clar...vp.pdf
windows7-x64
3Sarah Clar...vp.pdf
windows10-2004-x64
3email-html-2.html
windows7-x64
3email-html-2.html
windows10-2004-x64
3email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 12:41
Behavioral task
behavioral1
Sample
f402dbc7-1c2a-955d-795f-8d95be293b94.eml
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f402dbc7-1c2a-955d-795f-8d95be293b94.eml
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
JNFWVXPO.png
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
JNFWVXPO.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Sarah Clark Benefits Bonus and Payroll Upgrade Sign&Review ynvp.pdf
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Sarah Clark Benefits Bonus and Payroll Upgrade Sign&Review ynvp.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
email-html-2.html
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
email-html-2.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
email-plain-1.txt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
email-plain-1.txt
Resource
win10v2004-20241007-en
General
-
Target
f402dbc7-1c2a-955d-795f-8d95be293b94.eml
-
Size
76KB
-
MD5
a623db2cf3d0c80478f12dd80b18042f
-
SHA1
47e0479337efd79f97bf09b24d79999ba6df1b9a
-
SHA256
01e57da8442f011fbb240130c5c65c1ad1d1839b295225ed8b5416650a3b295d
-
SHA512
a3f48f712601a9d300fd065d9522438dcdeaffc657afb42189864bb9b66304eeb53e4005758f087c3c0cccb13e96ad7970d9890d95886a42f36e969fcb064bf3
-
SSDEEP
1536:+gCjtC2AgxiDTa01Boop9ZXwmqM/7a6QjZx4G2er0hkFarkwVg:5CpAfTaY/wmnLQH0hkFT
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1708 OUTLOOK.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1708 OUTLOOK.EXE
Processes
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXEC:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\f402dbc7-1c2a-955d-795f-8d95be293b94.eml"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235KB
MD5c80d767e39c27f4fc91f08ed24bc4bab
SHA1ab04ef98db2e1a84cdcb58e7fd24c32b2a555c64
SHA256ceddcf1340aec442b1ec16e81f25d21edeaf5ef522eb29ced28b87f246a1774d
SHA5120e3f391fbb98d738f48963fdde2e267a1b0ecc3d0d34ddf2c7ab720d064ee42ef09bb6c49b842c3e7a2d5616b26af0203e551552501929fa35bb50728d15b33e