Analysis
-
max time kernel
147s -
max time network
54s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 08:50
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Quotation.exe
-
Size
456KB
-
MD5
35890d210ae3539ce3cf24f730d186d5
-
SHA1
73e5145cef8463d9d1f9ea556cd3cee069370402
-
SHA256
c2221b7f65afde44bb459fec37286e4ad1f032d30be34d04527497c4b6acfdbd
-
SHA512
acd15ba2923e2d6fc3c43759b08247078ba0241e929664abe0d99d44e979068437c2c82f61717e4b7efd8e181f08a15fcc003380de62eed89604d41ffaee6c6a
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeQuotation.exemsdt.exedescription pid process target process PID 1156 set thread context of 1336 1156 Quotation.exe Quotation.exe PID 1336 set thread context of 1248 1336 Quotation.exe Explorer.EXE PID 316 set thread context of 1248 316 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Quotation.exemsdt.exepid process 1336 Quotation.exe 1336 Quotation.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe 316 msdt.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Quotation.exeExplorer.EXEmsdt.exedescription pid process target process PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1156 wrote to memory of 1336 1156 Quotation.exe Quotation.exe PID 1248 wrote to memory of 316 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 316 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 316 1248 Explorer.EXE msdt.exe PID 1248 wrote to memory of 316 1248 Explorer.EXE msdt.exe PID 316 wrote to memory of 1532 316 msdt.exe cmd.exe PID 316 wrote to memory of 1532 316 msdt.exe cmd.exe PID 316 wrote to memory of 1532 316 msdt.exe cmd.exe PID 316 wrote to memory of 1532 316 msdt.exe cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Quotation.exemsdt.exedescription pid process Token: SeDebugPrivilege 1336 Quotation.exe Token: SeDebugPrivilege 316 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Quotation.exemsdt.exepid process 1336 Quotation.exe 1336 Quotation.exe 1336 Quotation.exe 316 msdt.exe 316 msdt.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1532 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1336 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:316 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Deletes itself
PID:1532