4c1b5e471a686f4a5250310ff5a62f72f84697ce7dd198ed846599267b6e1969

Sharing

Copy URL Twitter E-mail

General

Target
Invitation to disciplinary hearing - Alleged Serious Misconduct (2) - Copy.eml
Size 9.0MB
Sample260731-aqrt9stsds
SHA256 4c1b5e471a686f4a5250310ff5a62f72f84697ce7dd198ed846599267b6e1969
MD5 ca480fba5487cec438c197ff4f9d004e
SHA1 e53d9fecc0eefe224f34e9956c6f794ec8078943
SHA512 6fe5f3f754b95fdf5417895ccf90b26ed12ebf3fe2c8a1abe97b71091d56b83ffdc020ad2225876e3d1c59a7675f8d8834f67bdd267f6a408151d2c92077ed40
SSDEEP 49152:fP6lGBpkWMyMT/SfATMkV9vsiwTeSS86V8tHx5tNnruW0lBTmiZufrDaZzLAyqCx:i
TLSH
T18F960110C6B78EAA098256FF141632D174BCF3E582EC81F7226AAEB3F0E5CB1C759551
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Invitation to disciplinary hearing - Alleged Serious Misconduct (2) - Copy.eml
- Size 9.0MB
- SHA256 4c1b5e471a686f4a5250310ff5a62f72f84697ce7dd198ed846599267b6e1969
- MD5 ca480fba5487cec438c197ff4f9d004e
- SHA1 e53d9fecc0eefe224f34e9956c6f794ec8078943
- SHA512 6fe5f3f754b95fdf5417895ccf90b26ed12ebf3fe2c8a1abe97b71091d56b83ffdc020ad2225876e3d1c59a7675f8d8834f67bdd267f6a408151d2c92077ed40
- SSDEEP 49152:fP6lGBpkWMyMT/SfATMkV9vsiwTeSS86V8tHx5tNnruW0lBTmiZufrDaZzLAyqCx:i
- TLSH
  T18F960110C6B78EAA098256FF141632D174BCF3E582EC81F7226AAEB3F0E5CB1C759551
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware spyware discovery
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9
- Target
  Evidence bundle.pdf
- Size 6.5MB
- SHA256 c46770a6e22f4e6a564d70ed2d7e75b64dea823511a0e389dc608ff05ff6f66e
- MD5 22f1f6f9ce040389996efa7bf51a64cc
- SHA1 e7db04fcfcff0d179070b8efb9d16319356f19b1
- SHA512 6d1f988111a665d7ccbebaa1d1a4dc2cc6ecdd4582159e8fd449d61f2f20f92a232f23ee149864236cea658a354389923faa3c253405672f135cae127724db25
- SSDEEP 196608:eiXmwbIv6ye34BzKR8VA0TvJCCtx9Q5IqoJLue++fYO:eOmwbIvve3JR8G0rJpeoJLkhO
- TLSH
  T15D66F2178D588B83A41883E8BE031E6D2F566B1CF99636FF11564ECF3F642521C9E12E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware credential_access
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral20
- Target
  email-html-2.txt
- Size 18KB
- SHA256 e4e7fdec969d0d37fe424447321fbfd0f08a4d46513b4cab5baebd60695ecdd6
- MD5 25e045b5f5826a545a5e350eb5c69533
- SHA1 104abdfa3f493035fbc9bf7a23002a7f5b67ce86
- SHA512 47bad31be11e08945b500307fc0d804d0262710830e5b9ba7be2e257753b208b388757ec8d99a2aa3674c300b94818efc9c42ee275a5496e1eadf1df2aaaf848
- SSDEEP 384:5RHNRHjRmRw7yo6DnzQS3Huz+DwH0g5sOWg6ZPtD6b0PGxpc4unaI:vLC/kKxg5sOWg6ZPtD6b0Spc4unaI
- TLSH
  T13382A333F7450267A0D313D922F82B817524C21CE313BC6AB576AFA933C59576B922D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22 behavioral23 behavioral24 behavioral25 behavioral26 behavioral27 behavioral28 behavioral29 behavioral30
- Target
  email-plain-1.txt
- Size 7KB
- SHA256 ea8dc86b51369bb86f429184338de9965eb5d99342259f5a2e3902473ab22194
- MD5 9c06cc5d5f9a02557386a1f94f726a28
- SHA1 1ea30a90bdb78dfec362eed5e8537f1bc345d48b
- SHA512 a5302d78a56fd22f0fb2bc9e7d7d49c5ce987aba08f221aa5d4f00811cfb3b97593f7bfb6d4d567d53f05affa210ebb2bbb8e785a5222cb7f699c35c4d6845f8
- SSDEEP 192:hC0o5z5qQCvxe6d1j5kUHOH5T01EazKKL0E2jW8DuiaJ:heQxe6d1tkAOHlhgKbPwJ
- TLSH
  T158F1A75FB387236517A24360279D36ABFB09D07CE3242571BC5DA20C2368669933F6DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

OS Credential Dumping

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32