5290167dbe39a1427cc21451dde71c5b9104127defa23fc7388e10e98ca6b3e0

Sharing

Copy URL Twitter E-mail

General

Target
Message.eml
Size 5.3MB
Sample261026-ws12lsfx2y
SHA256 5290167dbe39a1427cc21451dde71c5b9104127defa23fc7388e10e98ca6b3e0
MD5 88d754ef0e26a5f8a447d52ca2056764
SHA1 e5bf35792a01003aedf39c13804cb562a7a5c0ab
SHA512 8e4fd38948e270bace6d5bb218dc03f7b3483bcf57d451d71da5c96082eeddb66ca26b181030ecf9b69626f05423b91aa1e1b8a0ef755dc3f1c66d00c70422bd
SSDEEP 49152:ALpRSNl7sJPbocmTra/+y0xKIfv/gDcYmEKTSFNrW2bw7Yoe0s9RYhQ9dhcP1Yh1:M
TLSH
T1934623399D5636DF4A11D4F6B21EBC807CE8178B09C1029A63ED866631E4471DBB2CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Message.eml
- Size 5.3MB
- SHA256 5290167dbe39a1427cc21451dde71c5b9104127defa23fc7388e10e98ca6b3e0
- MD5 88d754ef0e26a5f8a447d52ca2056764
- SHA1 e5bf35792a01003aedf39c13804cb562a7a5c0ab
- SHA512 8e4fd38948e270bace6d5bb218dc03f7b3483bcf57d451d71da5c96082eeddb66ca26b181030ecf9b69626f05423b91aa1e1b8a0ef755dc3f1c66d00c70422bd
- SSDEEP 49152:ALpRSNl7sJPbocmTra/+y0xKIfv/gDcYmEKTSFNrW2bw7Yoe0s9RYhQ9dhcP1Yh1:M
- TLSH
  T1934623399D5636DF4A11D4F6B21EBC807CE8178B09C1029A63ED866631E4471DBB2CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral1 behavioral2
- Target
  Presentation and Revised Contract Proposal_Crooked Can Brewing Co..pdf
- Size 2.1MB
- SHA256 52232e9f067736e05826f1da47841d82eaa848d4c82b146d0397749253bbd1be
- MD5 ddab6ff3f2d67459474a455794111797
- SHA1 5bcb156da7c406e2ac00da7ca474b5389b4e6c64
- SHA512 19a570ad7f9c5775916499c03189ced8807cbc80ef82e7fa7eb2aa404eb1141fe0e47b434397e49b2b9644da61680b0213eebc1c7635692b3c3fbc08500682be
- SSDEEP 49152:kCNX99jtQAN0fJ28zzbHzzbf7L7+fLQxZfLQx8nTRdHdQ:kC1SANGM8rD7L7YqBqW9y
- TLSH
  T115A523689134A899C8C2417189282EE5DFEF80D34D0644B5303EBA461E5AE7EF7717FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware microsoft discovery phishing spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 13KB
- SHA256 984ec752e68a3ea629e4b46117f2c30eafe3c33239db8c147eda5610e60909e0
- MD5 ec437c1716fcf63549b3146dc408325f
- SHA1 8df284d9751fdebb0f61c2bc0249c8f426896b23
- SHA512 b36bac7f1d18b3c87dee33138608605ce69319106ff56c5ae166d9a4fa1aa701a939eab12fe2384774bcf78ec7f0b6398d858fe0ae92f018b36d8e9487a79748
- SSDEEP 384:KR8KRARRr9BnVyN2SsksVaN8y+lkyqcm8kYukzARVt35Yw5dl67O8rTZTmTBTPTX:b/wCyFFewJ6q8r9SlTD
- TLSH
  T1B9521316E3D41C0384FF54F4E027737879A962CB83361AF1A19E7A3B66C9DA366C2345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 1KB
- SHA256 d4f6834669d20eac62868c630906886b8854bec2722ae381048bbae985e12379
- MD5 a37620441a629567b6d9843cb5af4989
- SHA1 3c5e5ab0472b8e4df620c425051507b5f6b8c5b7
- SHA512 5e0b798e384eea4a919e408fe9436a30306cef0a8d442358a80d21194e1f1914a54071938d4b9d4a5e58a876f54c935eb5af7532a16b7b17e74c96e8ac2cfcb9
- TLSH
  T19331C66ED153725287332011B90D2C92F67A303CDB0DD84078A8463F974096BB2BB7DC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  image.png
- Size 48KB
- SHA256 9f85e94b5e4aae94f03f7843175b5b231e0d9813ac9231cad7f9c08a87858f07
- MD5 963bb1dd00e168e9d46721ef41cd14c6
- SHA1 951491a009ff58466664d668aa52f08d79227856
- SHA512 b6a9d43eeaec8d664f9200788e721a7eb214cb50db7b1243371729dd72e3dfba65e47980e64b6dc4ce7b700dd84b8cf84bbd1db7770f064783468c728d36f695
- SSDEEP 1536:ulfXkD3UJ1kzsAJ8eOp+RVW0yXe4Xby5F:ulfWEaXVW0yXe4XbWF
- TLSH
  T1B9230256D29E747CB2848F0101DAC3317A7DE4759BD856401CF8CAAB10EFE4DE4BA6A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  image001.gif
- Size 12KB
- SHA256 dc1210064a70e87747b8fbe1d4d72150453be1458daff9c6687141c7bb9f8c3b
- MD5 40ac8a35eb22ff2a0e74c3da04ecb733
- SHA1 4c26eaa7ce7db7d52b89fd03a6cd081e35214499
- SHA512 faaab0477b520e7b22f9079f5b14348954b40ba4f3ac128b7cde261da865a425a0da065b9c956894f7dd4e51c23c9e7db563703a715284a90b050e68f1b0e79d
- SSDEEP 192:8ly8POD7YzMZAR2BdcZjekir0QZqWLS2pxQgV51gohdJ2:8PPOD7YsAR6yRNir0QZqW1pxQg1g6dQ
- TLSH
  T1E242D6DFDA1A613EDC2190743C190F9A4F4F83A32669D62748CD66A0396E1BC7C90B59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  image002.png
- Size 70KB
- SHA256 4f07020890f8433939ea7a4a60e4574d9085256dace0f6650472d491ee7fd909
- MD5 58d72b933ba48169b16adfa6cc20f6a0
- SHA1 6f452845dc4e0a7d851143b5ac57cd070fe89900
- SHA512 cf61ee92e97079e2d72df90b4a1a27a874fdc12a3b68ec6d02428faba40b6fb48c9518dc9ffdb92fafa8948255749e3348c78b3d549c97afb6ab5b5a7e601bf0
- SSDEEP 1536:KLLRj68qacwj4dd0OIzl6tG44xZ2O1o9EYPAPrR:KLx6N6IexzaGpZHrTR
- TLSH
  T1FD6312F586E289F9F753093E7C82043EB80BA6D3857325C7696B54EA5306F174E22607
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  image003.png
- Size 1.6MB
- SHA256 dcee89d988382bea9ca2cfcc95294f0c7e096eeb54290e2bb8529bc8c11635c6
- MD5 7a41f4e0b8af925dedd397e9921e4705
- SHA1 acee2b0a9db4281c0b9398c011f10f7cf75e59d4
- SHA512 4def90636e0c32130fa356266fea2aa1948b4f08c7262e7bbecad035d62d59b2162c11224b6573521eedad6b0dd7854b87cf7f83c7b50d12d15268b439007696
- SSDEEP 24576:oBsQihd8jMOvv9E/jcT68rDFS7TUrnWav+82mbGOcqhOnyoeermJKBaVyQye906Q:oOQH9CZ8rDK7mbPcqhd4mt4aqcY
- TLSH
  T14C75238899CD2D76C3CB14B997F9D00652E6272BA4E34C660177FBBCE07938C94DEA05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks up external IP address via web service

Detected potential entity reuse from brand MICROSOFT.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16