Overview

overview

8

Static

static

3

Quotation ...26.exe

windows10-2004-x64

8

Quotation ...26.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    22072026_1600_22072026_Quotation Request #Smrgrp#22072026.rar
  • Size 1.5MB
  • Sample260722-tfpfyagh72
  • SHA256 22da81340b891b033b8dee19a6a50bfcf953e1ac977781ad28c7e4ce3c27a52a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target
      Quotation Request #Smrgrp#22072026.exe
    • Size 1.6MB
    • SHA256 e2b0b83a1f598279fdb539ce86b2d95ca227676bb1ac711f9367dacd3773a2ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    collectiondiscoveryexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks