Analysis
-
max time kernel
6s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 18:14
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Quotation.exe
-
Size
1.5MB
-
MD5
8ed2eb4f9aab811fef61c8cc1d61cf24
-
SHA1
d4e2452748d1efc5bb62ee873bbd0af96d5f5d13
-
SHA256
133a9c9b926ecb6806cf9afa73409b01472e67d80a7908dbadbfe2cf7e24f7e5
-
SHA512
7686e04c7a5c348e3eaa01f0a56e4062ff94b142164111857499682e50b7e05c2aa481a524099229e100e7c97a96ed58f45004a4c7f621287504640100f7ed52
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
Quotation.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url Quotation.exe -
Suspicious behavior: MapViewOfSection 100 IoCs
Processes:
Quotation.exepid process 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Quotation.exepid process 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Quotation.exepid process 324 Quotation.exe 324 Quotation.exe 324 Quotation.exe -
Suspicious use of WriteProcessMemory 400 IoCs
Processes:
Quotation.exedescription pid process target process PID 324 wrote to memory of 1160 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1160 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1160 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1160 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1812 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1812 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1812 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1812 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1776 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1776 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1776 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1776 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1688 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1688 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1688 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1688 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1704 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1704 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1704 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1704 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1680 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1680 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1680 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1680 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1712 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1712 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1712 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1712 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1780 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1780 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1780 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1780 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1792 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1792 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1792 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1792 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1872 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1872 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1872 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1872 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1664 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1664 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1664 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1664 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1768 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1768 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1768 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1768 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 828 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 828 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 828 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 828 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1132 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1132 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1132 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1132 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1224 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1224 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1224 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1224 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1276 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1276 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1276 324 Quotation.exe Quotation.exe PID 324 wrote to memory of 1276 324 Quotation.exe Quotation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵