Overview
overview
8Static
static
6WhiteheadG... 1.eml
windows10-2004-x64
1WhiteheadG... 1.eml
windows11-ltsc_2024-x64
8=?utf-8?B?...?=.pdf
windows10-2004-x64
3=?utf-8?B?...?=.pdf
windows11-ltsc_2024-x64
3Invoice IN...26.pdf
windows10-2004-x64
3Invoice IN...26.pdf
windows11-ltsc_2024-x64
3Invoice di...JC.pdf
windows10-2004-x64
3Invoice di...JC.pdf
windows11-ltsc_2024-x64
8General
- Target WhiteheadGroup.co.nz - Release of Information 1.eml
- Size 1.3MB
- Sample260803-p32mkazvay
- SHA256 71b3dccbe2137081de0cf51d506012cb58922f9471eae8dae983e13ac821f5bb
- MD5 bcb1ac21c41644de3c98eb0ec9daa31e
- SHA1 9135aa2aaaa44444915fda90f8a27b6591eba825
- SHA512 66255917a4a6c0508657f5784af44cd61abc1fb2793c3eb43f5b1578d16f2b57c3dd54b77508f34d45987b9a25a44a99e6a7322b343a6ace2d25e7692a95706b
- SSDEEP 12288:cZolmqFPxLGIIjxl8JeyLUy9LZ+ij9+y8QFDNCYzet/ZTtTInpA5/oIygNQZlKvP:czadGPL809ytZ++RBetRdIsagNgu+Tzk
- TLSH T18355DF706CDA2AE3DFA10E7159CD7DCB2D2C7B4F3492488B556C8B8AD169EB105C60EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
WhiteheadGroup.co.nz - Release of Information 1.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
WhiteheadGroup.co.nz - Release of Information 1.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
=?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
=?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=.pdf
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Invoice INV-97919 150226.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Invoice INV-97919 150226.pdf
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Invoice disputed by JC.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Invoice disputed by JC.pdf
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target WhiteheadGroup.co.nz - Release of Information 1.eml
- Size 1.3MB
- SHA256 71b3dccbe2137081de0cf51d506012cb58922f9471eae8dae983e13ac821f5bb
- MD5 bcb1ac21c41644de3c98eb0ec9daa31e
- SHA1 9135aa2aaaa44444915fda90f8a27b6591eba825
- SHA512 66255917a4a6c0508657f5784af44cd61abc1fb2793c3eb43f5b1578d16f2b57c3dd54b77508f34d45987b9a25a44a99e6a7322b343a6ace2d25e7692a95706b
- SSDEEP 12288:cZolmqFPxLGIIjxl8JeyLUy9LZ+ij9+y8QFDNCYzet/ZTtTInpA5/oIygNQZlKvP:czadGPL809ytZ++RBetRdIsagNgu+Tzk
- TLSH T18355DF706CDA2AE3DFA10E7159CD7DCB2D2C7B4F3492488B556C8B8AD169EB105C60EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target =?utf-8?B?UHJpdmFjeSBBY3QgUmVxdWVzdCDigJMgQ29zdHMgb2YgU3VwcGx5LnBkZg==?=
- Size 228KB
- SHA256 8314480c15fa11e93cb3f96e63359538c6d4a82bfd173e10851ca03e24cc4c7d
- MD5 67f98437439558bf510e3304ec310c90
- SHA1 d6cf299bcc45d9ea46ef2ed19db1a1b4468cbd74
- SHA512 512bd7468e80db98f34db0dc63cfde01e77c23aa3081d08ae7fa1c44da412040f0732beae5a9fe7e62e0cc72a0a1cde32971413beb6d6de6221d800480e9d3cc
- SSDEEP 6144:8GkxvRs9TxZUwSLOeMYueNkByqrDTaoxP:89xvRs7mLOmZNLqrDT9Z
- TLSH T1113412487756F0683C822C7EAB4892D14416F109ABC5596A3B8EC8E72F41DF59CBCB23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
- Target Invoice INV-97919 150226.pdf
- Size 57KB
- SHA256 7da6094b930827b3e513275511073b65b36dbcfadba7d17f528eba3d52e24ef2
- MD5 7858260e552b093a857d69b51193016f
- SHA1 b2e143aed2437e05d9e8bd3334233692547b2574
- SHA512 f4aa6aa06519a02306c4a1bc4452bcbdd5e9f84c0a518f1c51a641dacc94a9ba5974478e621bb36592db8de6046a96c68461e3739048959ebb056024c1ef7069
- SSDEEP 1536:m5JSyaWG4gMzErYBO00O8kiHH5QkF0JeosOQJf:mPwFMzErYgo8kpkye7n
- TLSH T1AA43CFC8E265DA1CDD11DE7974063B4890BDF0838BCA56B376E8498A44C0EBCBDD46E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
- Target Invoice disputed by JC.pdf
- Size 302KB
- SHA256 1f941b5becb60cc53921f8e969313ee2213569b26bd1aa1182f760d4e492548b
- MD5 fd6db6fda96c23510a942166bfb71870
- SHA1 bf78121f008f1d5df384852264347f40dd76665d
- SHA512 b83afc2465cc044f42413392e1ed7e494bcc1f8eefb9b1fe980040f5d059cd9b9d331f762c835ca5bfb1dfc5873ce6351153e308bf987cdfff8a59199fa68212
- SSDEEP 6144:R+NODnGAdwJp6QqqPp3gPmV3lZOXXCALiGstLTSZLIIjOpo7FYSp:R+EDnGn3qqPlcu1ZiCfGst3SZDOCN
- TLSH T1966412F59729489200C3D73693B902DE80D7D2AD82BC6B79757D8D821B80CC31DE5AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.