53d056661093a1e9c94852549fcb6ba5fcd82c19bc694aa5dd528aab4cf09d25 | Triage

Sharing

General

Target

REQUEST FOR QUOTE OFFICE STATIONARY SUPPLIE CONTRACT TENDER.pdf.exe
Size

949KB
Sample

250328-m8l3ysvwbx
MD5

f11e6dd721c1b3be096fc3576f47ca46
SHA1

ed456c6e866851c1d3210eba46a4537c598cbe88
SHA256

53d056661093a1e9c94852549fcb6ba5fcd82c19bc694aa5dd528aab4cf09d25
SHA512

ad9bb0ea88b24e9090456ab1c45194861445b360b2a39488648a87af9393546a531d105358613c00634130bde503f1b6931d0fbb29649b5849f1220ae45d0543
SSDEEP

24576:Ru6J33O0c+JY5UZ+XC0kGso6FaAGuL+pwWY:Du0c++OCvkGs9FaAiY

Score

10^/10

collection defense_evasion discovery evasion trojan

Malware Config

Targets

- Target
  
  REQUEST FOR QUOTE OFFICE STATIONARY SUPPLIE CONTRACT TENDER.pdf.exe
- Size
  
  949KB
- MD5
  
  f11e6dd721c1b3be096fc3576f47ca46
- SHA1
  
  ed456c6e866851c1d3210eba46a4537c598cbe88
- SHA256
  
  53d056661093a1e9c94852549fcb6ba5fcd82c19bc694aa5dd528aab4cf09d25
- SHA512
  
  ad9bb0ea88b24e9090456ab1c45194861445b360b2a39488648a87af9393546a531d105358613c00634130bde503f1b6931d0fbb29649b5849f1220ae45d0543
- SSDEEP
  
  24576:Ru6J33O0c+JY5UZ+XC0kGso6FaAGuL+pwWY:Du0c++OCvkGs9FaAiY
Score

10^/10

collection defense_evasion discovery evasion trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Disables Task Manager via registry modification
  defense_evasion
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondefense_evasiondiscoveryevasiontrojan

behavioral2

collectiondefense_evasiondiscoveryevasiontrojan