Managed XDR

payment-advice-ref-hsb...r-ref-pi10771qt90-.msg — malware analysis report

File info

Filename
payment-advice-ref-hsbc1057029141-rfq-priority-payment-customer-ref-pi10771qt90-.msg
File type
CDFV2 Microsoft Outlook Message
File size
72.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
a60bab472b07a2137f4e0eb6042db572c949e809
SHA256
b34c4d5492606148ecf54944ebea06127527963152e499a21a9e6417aec8ee46
MD5
d100dac70b1284ac289d5f79ec51fb9d

Signatures

Execution

T1203 office_exploit_creates_cmd: The document exhibits suspicious behaviour (creates a cmd.exe process)
T1059 cmd_vbs: Uses cmd.exe to generate VBS
T1203 chm_run_process: Windows HtmlHelp file runs an application
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line
T1059.003 executes_dropped_cmd: Executes dropped batch files
T1059.005 obfuscated_vbs: Detected obfuscated VBS
T1047 has_wmi: Executes one or several WMI requests
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1070 cmd_vbs: Uses cmd.exe to generate VBS
T1218.001 chm_run_process: Windows HtmlHelp file runs an application
T1036 copies_utilities: Copies and runs system utility with different name
T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line
T1027 obfuscated_vbs: Detected obfuscated VBS
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552 cookie_files: Accesses cookie files
T1555.003 cookie_files: Accesses cookie files

Discovery

T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
T1083 crawls_directories: Opens a huge number of directories all over disk C: (possibly, searches for sensitive data)
T1082 uses_windows_utilities: Uses Windows utilities for basic Windows functionality
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1016.001 system_network_configuration_discovery: System network configuration discovery detected
T1082 reads_csrss: Attempts to read csrss.exe memory

Collection

T1560.001 archive_via_utility: Detected archiving data via utility

Command and Control

T1105 lolbin_extrac32: Download or Copy file with Extrac32
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

yara_rules: Static rules
executes_dropped_exe: Executes dropped exe files
creates_exe: Creates executable files in the file system
creates_in_windows: Creates files in the Windows directory
suspicious_pdf: PDF file with suspicious content
pdf_page: Contains only one page
unexpected_exception: Unexpected exception
suspicious_pdf_link: PDF file with suspicious hyperlink or content
create_rpc_bindings: Creates RPC connection
pdf_compressed_stream: Contains an object with compressed stream
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
office_links: Office file contains external links
checktokenmembership: Checks user token with CheckTokenMembership call