Extracted

Extracted

• • Target

    Inquiry Items.pdf.lnk

  • Size

    3KB

  • MD5

    f2bbeb375a6d74abd720c40702af7446

  • SHA1

    42956957fcf61560d4871f5d819d30de12663fb4

  • SHA256

    d5316a106da0577abdd0d1c901c0d26793bac9933eb6ca55a42e22c08ad29ad0

  • SHA512

    cddc5bf3a8df6844720bea808d9786b5d2fc0b15baf990ef48481e6ccf4a157000d4d437c7f1975ceb22e3c47850476ffdf319db7d7c10782c3f1336b1f8d8b6

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionspywarestealer

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2