Analysis
-
max time kernel
149s -
max time network
64s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 06:38
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Needed pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation Needed pdf.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Quotation Needed pdf.exe
-
Size
461KB
-
MD5
cc3ab2b9346d2a7bb4ce7b1dfaae02d1
-
SHA1
39454936e7f7945afd9b8cefe3ee87e4a0dcc97d
-
SHA256
b5cc8b2d62e6c2d6a9bf080c4c41e19295af7dae7230a63b7f6ad8def08e7ea2
-
SHA512
ac9117afad150ab5dc4b23e6e6716617c0510cf188f7958aaad570768d24473c6b545fbada835fa9cbbf2607a7ab8ac946691d1c9e3c4beca7c7cfc160e542e4
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 896 set thread context of 1636 896 Quotation Needed pdf.exe 24 PID 1636 set thread context of 1276 1636 RegSvcs.exe 20 PID 1516 set thread context of 1276 1516 wininit.exe 20 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1636 RegSvcs.exe 1636 RegSvcs.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe 1516 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1636 RegSvcs.exe Token: SeDebugPrivilege 1516 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1636 RegSvcs.exe 1636 RegSvcs.exe 1636 RegSvcs.exe 1516 wininit.exe 1516 wininit.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 896 wrote to memory of 1636 896 Quotation Needed pdf.exe 24 PID 1276 wrote to memory of 1516 1276 Explorer.EXE 25 PID 1276 wrote to memory of 1516 1276 Explorer.EXE 25 PID 1276 wrote to memory of 1516 1276 Explorer.EXE 25 PID 1276 wrote to memory of 1516 1276 Explorer.EXE 25 PID 1516 wrote to memory of 1684 1516 wininit.exe 26 PID 1516 wrote to memory of 1684 1516 wininit.exe 26 PID 1516 wrote to memory of 1684 1516 wininit.exe 26 PID 1516 wrote to memory of 1684 1516 wininit.exe 26
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\Quotation Needed pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Needed pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1636
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1684
-
-