Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 12:41

General

  • Target

    f402dbc7-1c2a-955d-795f-8d95be293b94.eml

  • Size

    76KB

  • MD5

    a623db2cf3d0c80478f12dd80b18042f

  • SHA1

    47e0479337efd79f97bf09b24d79999ba6df1b9a

  • SHA256

    01e57da8442f011fbb240130c5c65c1ad1d1839b295225ed8b5416650a3b295d

  • SHA512

    a3f48f712601a9d300fd065d9522438dcdeaffc657afb42189864bb9b66304eeb53e4005758f087c3c0cccb13e96ad7970d9890d95886a42f36e969fcb064bf3

  • SSDEEP

    1536:+gCjtC2AgxiDTa01Boop9ZXwmqM/7a6QjZx4G2er0hkFarkwVg:5CpAfTaY/wmnLQH0hkFT

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
    C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\f402dbc7-1c2a-955d-795f-8d95be293b94.eml"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    235KB

    MD5

    c80d767e39c27f4fc91f08ed24bc4bab

    SHA1

    ab04ef98db2e1a84cdcb58e7fd24c32b2a555c64

    SHA256

    ceddcf1340aec442b1ec16e81f25d21edeaf5ef522eb29ced28b87f246a1774d

    SHA512

    0e3f391fbb98d738f48963fdde2e267a1b0ecc3d0d34ddf2c7ab720d064ee42ef09bb6c49b842c3e7a2d5616b26af0203e551552501929fa35bb50728d15b33e

  • memory/1708-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1708-1-0x00000000732ED000-0x00000000732F8000-memory.dmp

    Filesize

    44KB

  • memory/1708-124-0x00000000732ED000-0x00000000732F8000-memory.dmp

    Filesize

    44KB