c96b41fac848211321861fcf957e5f475a950c56f9024f792e5c9584f1fbd3ef

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/11/2024, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Junk)2345.eml.ViR.eml
Size 9KB
Sample241122-d54ddstney
SHA256 df8b9e5d4104604e0fa339e6ff704e2957e2dc20d90c111010e67586317337aa
MD5 d39269e7eb92b9de0fc78ba1363af37a
SHA1 6b2f6d755d577f4170c018879449d6a78885aa93
SHA512 e1c29e37b4fedd309eebd105967dc3f6249e31fe01d43bc349def02f52aa7d573ad98c30f4ce3ae2754e10d64f03607da90e388e7efefc66478c84408cb7b78b
SSDEEP 192:zBurpqEcJLiCa4Z5CNvTBtPHfkdOiyDma82AZJfN4rcc7POQuE:FclV4iZN+xyDma8BKo+POQuE
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2172	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\Junk)2345.eml.ViR.eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FRMCACHE.DAT

Path C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
Size 230KB
SHA256 042b58b047a8dc49d08592ed4418ebb9ec29a50c2a14655a9f2136b00d6899f4
MD5 77774735bb09b7af3b7e2792b84b969e
SHA1 e3f3939b94b6a33a8ae991ebb2cd14bc650cbcc4
SHA512 fc6fa5f01d89f94ab7a2ab9604b45c3292548d6a816d1780924dd60062edcb85e46e7127a54b4c5cd0b6506ef98676fdb3b09976aa1cf16a01344b425bf94bd2
SSDEEP 1536:53RuSudTYLWgsQSqCcgspNcAz79ysQqt2xqoQhrcm0FvMyMC0AymC:ZqUWgdCcgimiGu2xqoQhrt0FvHMzAyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

mapisvc.inf

Path C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf
Size 1KB
SHA256 7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
MD5 48dd6cae43ce26b992c35799fcd76898
SHA1 8e600544df0250da7d634599ce6ee50da11c0355
SHA512 c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
MD5 SHA1 SHA512

Submit Download

memory/2172-1-0x000000007347D000-0x0000000073488000-memory.dmp

Download

memory/2172-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2172-124-0x000000007347D000-0x0000000073488000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads