74fff6dd305ac87a046d5dcef0dbe0a028327d99e9e43053eea5d250974f75ed

General

Target

phish_alert_gcep_0.3.32-0.eml
Size

40KB
Sample

250218-kqnsqayqbz
MD5

8c219caa10e9725c91590521cd167d75
SHA1

8319acdf8ef8980e466d5329bca8c9ce80f30d21
SHA256

74fff6dd305ac87a046d5dcef0dbe0a028327d99e9e43053eea5d250974f75ed
SHA512

28aa113fef883475cdf06ae723dee2300ea9a2049c12b388edf325f43ffe6d09a6c8e0f04e7ef526c205105819e77d0297aa8f8da8cb3cb10133efb7162176f4
SSDEEP

192:p7w2108G5EcEQMoYbt2qmLWf99AxAIyFs2mVV64ImG3ZvPoeTANdOeevL2KElm4:p7H8SR2qmLWlqx3nf64NqZHogKOeeXK

Score

7^/10

Malware Config

Targets

- Target
  
  phish_alert_gcep_0.3.32-0.eml
- Size
  
  40KB
- MD5
  
  8c219caa10e9725c91590521cd167d75
- SHA1
  
  8319acdf8ef8980e466d5329bca8c9ce80f30d21
- SHA256
  
  74fff6dd305ac87a046d5dcef0dbe0a028327d99e9e43053eea5d250974f75ed
- SHA512
  
  28aa113fef883475cdf06ae723dee2300ea9a2049c12b388edf325f43ffe6d09a6c8e0f04e7ef526c205105819e77d0297aa8f8da8cb3cb10133efb7162176f4
- SSDEEP
  
  192:p7w2108G5EcEQMoYbt2qmLWf99AxAIyFs2mVV64ImG3ZvPoeTANdOeevL2KElm4:p7H8SR2qmLWlqx3nf64NqZHogKOeeXK
Score

5^/10

discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  email-html-1.txt
- Size
  
  36KB
- MD5
  
  94c43c5d7a5c140367658c07e6b47499
- SHA1
  
  77465ef8dd98f492b284f98234bcc23bb7a4c73d
- SHA256
  
  da75f89db3777fdfac4b64236ee14886a31bee45b0ab3440caf9bb964a1ff68f
- SHA512
  
  5fc12c84c8505c037c0a813ecbff1927861109f127584d41b86d534dbcb0bd4520bb9670034a032bb02d9fb519aaf9527c2008a9d0eaf2ca76578adad220fd67
- SSDEEP
  
  192:6bt2qmLWf99AxAIyFs2mVV64ImG3ZvPoeTANdOeevL2KElm4:6R2qmLWlqx3nf64NqZHogKOeeXK
Score

7^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral3 behavioral4