Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08/07/2020, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation-BV-76435020.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Request for Quotation-BV-76435020.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Request for Quotation-BV-76435020.exe
-
Size
654KB
-
MD5
a2fe795e8b63eb414f66e09953a56a46
-
SHA1
ffd4c5641f9253d6004af10110ffcc630be27521
-
SHA256
b00ebd12d239ba9f75f11b3ad96b127730779e48f3e2fead50c9e5a7b7ca598a
-
SHA512
3a99dffb20ab52a9a771b495f9e7f7acbc72d319b265197cc8465211b44eea1fa9c1550581a083f176a97bfecab3f6c6d79033b3cc5a8fcfd75cb6ac27e9e65a
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3848 wrote to memory of 2036 3848 Request for Quotation-BV-76435020.exe 66 PID 3848 wrote to memory of 2036 3848 Request for Quotation-BV-76435020.exe 66 PID 3848 wrote to memory of 2036 3848 Request for Quotation-BV-76435020.exe 66 PID 2996 wrote to memory of 572 2996 Explorer.EXE 67 PID 2996 wrote to memory of 572 2996 Explorer.EXE 67 PID 2996 wrote to memory of 572 2996 Explorer.EXE 67 PID 572 wrote to memory of 1688 572 systray.exe 70 PID 572 wrote to memory of 1688 572 systray.exe 70 PID 572 wrote to memory of 1688 572 systray.exe 70 PID 572 wrote to memory of 3948 572 systray.exe 76 PID 572 wrote to memory of 3948 572 systray.exe 76 PID 572 wrote to memory of 3948 572 systray.exe 76 PID 572 wrote to memory of 3208 572 systray.exe 78 PID 572 wrote to memory of 3208 572 systray.exe 78 PID 572 wrote to memory of 3208 572 systray.exe 78 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Wjdltv4\7nzxobkdsdz.exe systray.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\7NDP6TOX = "C:\\Program Files (x86)\\Wjdltv4\\7nzxobkdsdz.exe" systray.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3848 Request for Quotation-BV-76435020.exe 3848 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 3848 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 2036 Request for Quotation-BV-76435020.exe 572 systray.exe 572 systray.exe 572 systray.exe 572 systray.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3848 set thread context of 2036 3848 Request for Quotation-BV-76435020.exe 66 PID 2036 set thread context of 2996 2036 Request for Quotation-BV-76435020.exe 56 PID 572 set thread context of 2996 572 systray.exe 56 -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2036 Request for Quotation-BV-76435020.exe Token: SeDebugPrivilege 572 systray.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer systray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\Request for Quotation-BV-76435020.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation-BV-76435020.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\Request for Quotation-BV-76435020.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation-BV-76435020.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:572 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Request for Quotation-BV-76435020.exe"3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3948
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3208
-
-