Analysis
- max time kernel
153s - max time network
51s - platform
windows7_x64 - resource
win7v200430 - submitted
24/06/2020, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe
- Size 303KB
- Sample200624-bsm8fzc86a
- SHA256 9362e0d04c5ae6249cf30df1fa0e969425ef058bfd39d8742014a035cf213541
- MD5 0a182475466bc3051fad4fadcb4f2243
- SHA1 cd3ae1867c0d37915fa9fa264d73f3fef698fb25
- SHA512 a2d223a166b79151b77a87f2c8d8b4cef45f04210f57a387bdfe252fd8944296269c946fc5cfdf3a6e66b5bd52d82a7fa6cb9a83b4b5d2a61b372af9da37d24b
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1764 cmd.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1800 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 26 PID 1500 wrote to memory of 1800 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 26 PID 1500 wrote to memory of 1800 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 26 PID 1500 wrote to memory of 1800 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 26 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1500 wrote to memory of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1828 wrote to memory of 1772 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 29 PID 1772 wrote to memory of 1764 1772 cmstp.exe 30 PID 1772 wrote to memory of 1764 1772 cmstp.exe 30 PID 1772 wrote to memory of 1764 1772 cmstp.exe 30 PID 1772 wrote to memory of 1764 1772 cmstp.exe 30 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe Token: SeDebugPrivilege 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe Token: SeDebugPrivilege 1772 cmstp.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe 1772 cmstp.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1500 set thread context of 1828 1500 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 27 PID 1828 set thread context of 1296 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 20 PID 1828 set thread context of 1296 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 20 PID 1772 set thread context of 1296 1772 cmstp.exe 20 - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1828 REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe 1772 cmstp.exe 1772 cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"{path}"3⤵PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"{path}"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1828 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1772 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"5⤵
- Deletes itself
PID:1764
-
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1840
-