Extracted

• • Target
    RFQ-INQUIRY.zip
  • Size 1KB
  • SHA256 307a17b1eee3a2a968802eb90d5f5eba54a4b93f74f128763956d5b5dc2e2404
  • MD5 047bb0cce1313ae0de87fd7a3bcd8ac0
  • SHA1 3e7b02a6fcc64e758b5d8c0aedb3779e4993b7ed
  • SHA512 b2fefbec15b2c18a4d1503de6c9ba51984e438b48cddc9a5340dbc329e6c45f2ae682559db2307dff8c630923dd4bb8a2f200cd764f837afd47f4eef4a918c8c
  • TLSH
    T11831EA0E457E950AC5A253BD14687C2193B9D8710CD199436686916819454C92875ADF
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    RFQ.hta
  • Size 3KB
  • SHA256 3c83d5fe149fb9a736071dc527656cbc6b57dcbc76e3391a759ef8cab3546f7f
  • MD5 115d93dd0451c77cd0540444213721da
  • SHA1 3b7ea7c8e522a46ce3a5a1d835933dae8a38370a
  • SHA512 3c770f97c4459f33a8502530d6fd98dd0d4dd927726a42f6a7048df5c5b9f52a6456c48d60730142dacb751e9291307f235c7956cf399581470922c15e844fbf
  • TLSH
    T1227165D7684C5665B6B12366A7DF8414FAB7D5620700EAF0F0C8EB805E2993142BBDFC
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral3behavioral4