Resubmissions

03-12-2024 17:14

241203-vr8jmavmew 5

03-12-2024 15:36

241203-s1396a1mev 5

03-12-2024 15:34

241203-szv76a1max 3

Analysis

  • max time kernel
    91s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-12-2024 17:14

General

  • Target

    email-plain-1.txt

  • Size

    10KB

  • MD5

    7f52eda9c53210c91f748406657907f4

  • SHA1

    e5ee58c1c6ffd6107df96da6f7f86dc0924e1aa8

  • SHA256

    37782a63b9e62dcc0dc3e33121a4f49a9a3e22a5e8c2dd800591f158488c7e06

  • SHA512

    cc1c708fbd16abfdd4b31a2f7cb656843426dea771a5b5fbd30e24e518bf744be60ef8f54e13dff844a0a8529af1d5dbcc387aa0d745203e2070da3856874d7a

  • SSDEEP

    192:tIUUIxeAim4exPDecUWZeXHXexHmelr/eXRReChntehHOea3iTex0/epBmqm:+UFr9M29U/nI2iVem

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\email-plain-1.txt
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\email-plain-1.txt
      2⤵
        PID:1964

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads