Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241007-es -
resource tags
arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows -
submitted
14-12-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
1_email.zip
Resource
win11-20241007-es
Behavioral task
behavioral2
Sample
32b4f238-3516-b261-c3ae-0c570d22ee18.eml
Resource
win11-20241007-es
Behavioral task
behavioral3
Sample
email-html-2.html
Resource
win11-20241023-es
Behavioral task
behavioral4
Sample
email-plain-1.txt
Resource
win11-20241007-es
Behavioral task
behavioral5
Sample
image006.jpg
Resource
win11-20241007-es
Behavioral task
behavioral6
Sample
pago 4094.rar
Resource
win11-20241007-es
Behavioral task
behavioral7
Sample
pago 4094.exe
Resource
win11-20241007-es
General
-
Target
32b4f238-3516-b261-c3ae-0c570d22ee18.eml
-
Size
688KB
-
MD5
60d00c17d3ea15910893eef868de7a65
-
SHA1
1d17dd1688a903cbe423d8de58f8a7ab7ece1ea5
-
SHA256
d13a7eaaf07c924159ea7bb8f297dab1d8da0f9af46e82e24052d6a9bf5e4087
-
SHA512
c589a12dbbd2598eeb74564ae11142a2d1a17beb6fafcdb8211ff72d33dbe58ae7d17d03e5521819cd788a0c3158fe60738e15ef4a6285c1221d32f979c13813
-
SSDEEP
12288:vZ1Tzm0D2acQLqgVIjejueFyhaCV2JKKS7hoxSSqkljhEi9lV7j:z7K8FuuzCV2JKkxPOQ3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\32b4f238-3516-b261-c3ae-0c570d22ee18.eml:OECustomProperty cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 404 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\32b4f238-3516-b261-c3ae-0c570d22ee18.eml1⤵
- Modifies registry class
- NTFS ADS
PID:2760
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:404