74fff6dd305ac87a046d5dcef0dbe0a028327d99e9e43053eea5d250974f75ed

Analysis

max time kernel
93s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-02-2025 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

phish_alert_gcep_0.3.32-0.eml
Size

40KB
MD5

8c219caa10e9725c91590521cd167d75
SHA1

8319acdf8ef8980e466d5329bca8c9ce80f30d21
SHA256

74fff6dd305ac87a046d5dcef0dbe0a028327d99e9e43053eea5d250974f75ed
SHA512

28aa113fef883475cdf06ae723dee2300ea9a2049c12b388edf325f43ffe6d09a6c8e0f04e7ef526c205105819e77d0297aa8f8da8cb3cb10133efb7162176f4
SSDEEP

192:p7w2108G5EcEQMoYbt2qmLWf99AxAIyFs2mVV64ImG3ZvPoeTANdOeevL2KElm4:p7H8SR2qmLWlqx3nf64NqZHogKOeeXK

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2604	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	OUTLOOK.EXE

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_gcep_0.3.32-0.eml"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
ee3ee68765b7d2a691d96f2700b0f671

SHA1
6a709d28346f7ccfaef491868d1ca92976a6e1be

SHA256
30d63a924f0bba7e4877799bea7d85269e51cc68bbce13c0d32e9d0d2d767ef2

SHA512
cdc4ed4372d048fe9a06665dfcafcdb1adfbdbe251809a65cedc0246cd65f999a0bf0ab355ee1256598a65bb15d35a04fe938a77b3fa49539af1cc038aa4ecd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
419223e8e81e2f318b0211e48889698e

SHA1
b4a055cd79e116d2aa88e6ac2d1581bb069f2c9f

SHA256
e0b2d0db44f5c93e906bc387907fae7a63d11067cef13ce17f4f558dbb043bf5

SHA512
d40ec20e96fe160a6caf9a33918af1cd530cf14148641e37b68f2b62bd6c4d8913d6ba3c622f92c68da8b7fc172d4f0f866c2cd20b9be5347632289ac8ac966e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
memory/2604-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2604-1-0x000000007401D000-0x0000000074028000-memory.dmp

Filesize
44KB

Download
memory/2604-124-0x000000007401D000-0x0000000074028000-memory.dmp

Filesize
44KB

Download