c399720ce7113b50eb1b003d1967f7a82cc7478c2c8da06f6fe1a8fc96f5ac71

Sharing

Copy URL Twitter E-mail

General

Target
WhiteheadGroup.co.nz - Re_ Disputes tribunal notice of hearing - CIV-2026-044-000531.eml
Size 4.3MB
Sample260803-ngjdesgf57
SHA256 c399720ce7113b50eb1b003d1967f7a82cc7478c2c8da06f6fe1a8fc96f5ac71
MD5 57e0d3c88070e4fdc0e6707ff7c30193
SHA1 eba5e2e4dbc63b172e47f2595f252a456e357f32
SHA512 4a7b6bbe9012e645b82f24cbb30675675f6a01eb45565b441c7ba02c15d3ebb212ecf7c99ae248cf13354c37dbad728eeb5efff3d363109001ac9181369dea92
SSDEEP 49152:qqIOqI8bK5dmhKbFkg/4w0rbK5dmhKbFkg/4wE:m
TLSH
T1B92622368E470ECA4F408A27A136BD527CFEA6C7549403F2035CDAE470F89799FA5C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Attachment 6- Letter of Dismissal-d56fb9f577b4c4aa (2).pdf
- Size 1.2MB
- SHA256 2f04e88cbf393514b252bcae46caf46043ac72ae23672b020d0db12f1ddbc91d
- MD5 a9eafa6256433213ce3f61ec78813c23
- SHA1 ca10c22245cbaf7a2aa114c21e38c94f059f09a4
- SHA512 c995fcaf97712a42cacdaaa0b5b65aaaae8adc507d55e8a99c5764606d02ba8991b1d992f64108cf172319a67c219d0f5a7be5d2b7002171dc84e7f4822313ed
- SSDEEP 24576:A8hDFU7whN6wH3iUHZq4s00Lh6hyqz2yk/fMvKYuCFTRprsEuWWpiIP0:AUO7wawXx5r6wzsYuCvprjutpiO0
- TLSH
  T182552342E224D51ECF8A0455FDD61A8D3784A9343DFF3A4E034BB9EC355D8092AE8BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c (1) (1).html
- Size 72KB
- SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
- MD5 a8f0bfb3885db441150395d294c64a4f
- SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
- SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
- SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
- TLSH
  T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Defamation and Privacy in Employm-22a6279f9385c4ef (1) (1).pdf
- Size 68KB
- SHA256 3433d776d2d89a4164a65da469b46624e41629b4c2dc38626570bc8d3f79c4c8
- MD5 b535c5ba82bc7b0d002ceff406e483a7
- SHA1 79a0fadbb7988553a1a1d1996be3931bcd64e42e
- SHA512 733b351b8d05f3a35dfc5229439de945e4ae0822e86232bae3d2907baaa426669c113e85d404a5a2cdda8e8af2054d9ea6e1c19902b63bfc7ff4d149672d8704
- SSDEEP 1536:OT8Y4LhAG/BBwX9y3gMGC1N5HGdjlHwhuom2oOfpMYhFcTjQhk4CNQ5X:3Yk2NywMzJmd9wcomVMMY7WQhkfoX
- TLSH
  T12763BE74F8DE4C9DF80AC608C2BE750A4F1EB52BB2CD348500AD0B15E0059E5EBA66DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Formal Disciplinary Hearing-59772d23ba1c0518 (1) (1).pdf
- Size 41KB
- SHA256 8afd05291314a82534132457cb22fecee40f7ae0706cf5c19e4ce97bc64a515b
- MD5 f401aff85a160f17b03a68186ef41f15
- SHA1 5b5fdf4bb6cc6aacb085784c9ec102f72ed7d467
- SHA512 29f296e54bd8203d061914f24dd68a5ae06a4ca77aa7dd18ef113ce3f88c0142ef1cb6364467f746985e65302caa802da6eb9aaa97fabcada725e8e86c67124e
- SSDEEP 768:aX0O5YLtijt+eoG/P1EZqZdSuSd3HnxcXruAwcJ843sL:q0NAt+eJPsJuSxHxcXrV3sL
- TLSH
  T1C413C066D9DA1CDCF8D7DB525234786D843E721357C87C82717C0B8AAC14A88AB718EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  Jason_s Accusations_ Negligence a-88710b2c965b4a0c (1) (1).pdf
- Size 41KB
- SHA256 afe3428e183223af83102db6425b5259ef6865f705971a53552b826762ac5423
- MD5 4cf62452ab63dbe9523761dad6237953
- SHA1 430c2e62ef4ad5a7cd6f4352795ef1d0e4e80508
- SHA512 2378d9e2d44bb266587f3b24784108588f674bae387839e1c5bdf07a271eaf596b8aab791fddf3e56eab56223127fb277285948352fcf6756373c513ea8e1678
- SSDEEP 768:PGfl/+epOMO5PTBOeZ6S6YRd6uH7nrfHgYPgPWxiSM1ixtgmA3n988ohhcBe1OaF:PGf1+epLOnIRqfwPk
- TLSH
  T1D013AE31F99E5D9CE94AC21AE27D3C1F4F6DBA6BA6CC35C1003D0B05F105A50AF626C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Letter of Dismissal without Notic-fdb8f8743badb107 (2).pdf
- Size 1.2MB
- SHA256 2f04e88cbf393514b252bcae46caf46043ac72ae23672b020d0db12f1ddbc91d
- MD5 a9eafa6256433213ce3f61ec78813c23
- SHA1 ca10c22245cbaf7a2aa114c21e38c94f059f09a4
- SHA512 c995fcaf97712a42cacdaaa0b5b65aaaae8adc507d55e8a99c5764606d02ba8991b1d992f64108cf172319a67c219d0f5a7be5d2b7002171dc84e7f4822313ed
- SSDEEP 24576:A8hDFU7whN6wH3iUHZq4s00Lh6hyqz2yk/fMvKYuCFTRprsEuWWpiIP0:AUO7wawXx5r6wzsYuCvprjutpiO0
- TLSH
  T182552342E224D51ECF8A0455FDD61A8D3784A9343DFF3A4E034BB9EC355D8092AE8BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  Sandbox- Letter in Response[.]pdf-6ee1f1cfbe95f98d (2).pdf
- Size 42KB
- SHA256 8d341b8284d02bf3aa47ec7f899e9e52b84803c8c07bcf1d3bbc54d16a9c4014
- MD5 1aaf3bc9c5579875e3896676ca966f01
- SHA1 c47eeb590c504a6e390cb0229df4fc6882dc44aa
- SHA512 9b0987b268727c7fd2f94eac55fb7f1486541e7a1b52c2137fa36ecb16a6d9b73c259f23164bf17ea61653279e70d22a2db3fcb4db4aa19787a9b15d811ea451
- SSDEEP 768:0OIFBLzdYXqENLK868+URF9qPtTMJWYSvfjA/6BLRnItpp+QaEG/+TtRvq3XiqfO:h2HMRFieK8/jpGk56mr3xBX0NeAsmyj
- TLSH
  T1DE137C78F98A989DFC82C605C63D390D4E8DF35B97CD3894013D0A6AF205A65A3663D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14