Overview

overview

9

Static

static

MATWORLD_QUOTE221.exe

windows7_x64

9

MATWORLD_QUOTE221.exe

windows10_x64

9

Analysis

  • max time kernel
    142s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    11-07-2020 16:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MATWORLD_QUOTE221.exe

  • Size

    959KB

  • MD5

    f67268e684c9c3c9aec485d3b8011d57

  • SHA1

    12872aad2d3327b5cd32d1b2af56c2667aa74add

  • SHA256

    0874b3168d4582178f30aac5d4e86a935228aa76e68754692539105c51059467

  • SHA512

    1a084d70cd1964e4ea1f9b140c83d40495b6d2ee3ad88eef76917ab5b871e88adf329648e1c00dbbdf2b6cc072a16cc9e3b25db8cc5c821a6b46b6f5ae24d140

Score
9/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MATWORLD_QUOTE221.exe
    "C:\Users\Admin\AppData\Local\Temp\MATWORLD_QUOTE221.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Checks BIOS information in registry
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Maps connected drives based on registry
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\MATWORLD_QUOTE221.exe
      "{path}"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:1772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1772-0-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/1772-1-0x000000000044CBAE-mapping.dmp

    Download

  • memory/1772-2-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/1772-3-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download