Analysis
-
max time kernel
116s -
max time network
124s -
platform
windows7_x64 -
resource
win7 -
submitted
16-07-2020 13:34
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quote.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Request For Quote.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Request For Quote.exe
-
Size
668KB
-
MD5
2a3778d63136b50697257cce57dfb445
-
SHA1
8763dca24313403a868111f8631a05ae691ca2ac
-
SHA256
306c19239cf2ece40cd0016faaff87964937998ffcdaa1059e907145ee8ba2a2
-
SHA512
48e8e9b9c120a5d4d6b35d740a71837acda93bd35be13540bc27b7b0ac5ae2e6453939bd1196b56aaed17b1bdc0b8cb229391c3a9833b537068a6af08b8ab63d
Score
6/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Request For Quote.exedescription pid process Token: SeDebugPrivilege 284 Request For Quote.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Request For Quote.exepid process 284 Request For Quote.exe 284 Request For Quote.exe 284 Request For Quote.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Request For Quote.execmd.exedescription pid process target process PID 284 wrote to memory of 1508 284 Request For Quote.exe cmd.exe PID 284 wrote to memory of 1508 284 Request For Quote.exe cmd.exe PID 284 wrote to memory of 1508 284 Request For Quote.exe cmd.exe PID 284 wrote to memory of 1508 284 Request For Quote.exe cmd.exe PID 1508 wrote to memory of 1772 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1772 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1772 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1772 1508 cmd.exe reg.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe PID 284 wrote to memory of 1200 284 Request For Quote.exe rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 1200 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\kash = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Desktop\\kash" reg.exe -
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"C:\Users\Admin\AppData\Local\Temp\Request For Quote.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v kash /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\kash"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v kash /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\kash"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\kash2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Modifies registry class