Managed XDR

new-quotation-as-requested-.eml — malware analysis report

File info

Filename
new-quotation-as-requested-.eml
File type
HTML document, ASCII text, with CRLF line terminators
File size
97.7 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
9a4e23774af065e33518c38f7d017731b7032330
SHA256
7adbf454b56c5457b50f697e167c196e26e64827c73b7da31174d637f8e4c462
MD5
0fe04eb7a04b82eea5717ee5615bef55

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059 powershell_cmd_longcommandline: Suspiciously long commandline
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_batch: Suspicious batch

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1036 copies_utilities: Copies system utility with different name
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1027 many_env_vars: An extensive number of environment variables has been created (possible sign of obfuscation)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antivm_queries_computername: Retrieves the computer name

Exfiltration

T1022 encrypts_pc_info: Collects and encrypts information about the computer (possibly for exfiltration)

Other

creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
ps_ep_changed: Changes Powershell execution policy
no_graphical_activity: No graphic activity
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
yara_rules: Static rules