4e8b5000922b9a1d60e53801489cdb3265aed9eef23a221738239996a70f7edf | Triage

Sharing

General

Target

Urgent Request For Quote-INV837981374.exe
Size

830KB
Sample

250328-m48q6avvhy
MD5

7ec24d8ba9dc376595cdeeaa3e8942b2
SHA1

05e5fae8e217a769706d5fc4f79a4e19b54051c7
SHA256

4e8b5000922b9a1d60e53801489cdb3265aed9eef23a221738239996a70f7edf
SHA512

aa70dc2ef35b2f39256aec32dd4ba3865aff80b017be85cab0269d10b42db9d36d7b584798c007ffdf34a67557a1b2ca66c9bff6ae47f82b1c8699af9dff2fce
SSDEEP

12288:RSQiKaxPrhQ1f1PfAqk3s2NoL3iqOGncg6+WDFDoWbqgJ59wmUbupsHK3YUOhlp7:IQiJN4fXcCurmcb+WDlyeZABXL

Score

8^/10

collection discovery execution

Malware Config

Targets

- Target
  
  Urgent Request For Quote-INV837981374.exe
- Size
  
  830KB
- MD5
  
  7ec24d8ba9dc376595cdeeaa3e8942b2
- SHA1
  
  05e5fae8e217a769706d5fc4f79a4e19b54051c7
- SHA256
  
  4e8b5000922b9a1d60e53801489cdb3265aed9eef23a221738239996a70f7edf
- SHA512
  
  aa70dc2ef35b2f39256aec32dd4ba3865aff80b017be85cab0269d10b42db9d36d7b584798c007ffdf34a67557a1b2ca66c9bff6ae47f82b1c8699af9dff2fce
- SSDEEP
  
  12288:RSQiKaxPrhQ1f1PfAqk3s2NoL3iqOGncg6+WDFDoWbqgJ59wmUbupsHK3YUOhlp7:IQiJN4fXcCurmcb+WDlyeZABXL
Score

8^/10

collection discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoveryexecution

behavioral2

collectiondiscoveryexecution