Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-09-2021 17:28
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE PRICE.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
QUOTE PRICE.exe
-
Size
558KB
-
MD5
3a35017603b428f692151484ad54ded0
-
SHA1
ac071c363f33e2a28aaffc77e5a34642d8246fe0
-
SHA256
45f5e2a682896ac3380522e26a0398b8112bafc42948666c9fecafa3dcab69e3
-
SHA512
6a2c113565aca37d63de00cdd59354400e901bb731d35e53a42951463662374dec5dfb83d109f059b59733abaf3c0f2057a87c22f69b2d738af37b6f19409d8d
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
QUOTE PRICE.exepid process 1116 QUOTE PRICE.exe 1116 QUOTE PRICE.exe 1116 QUOTE PRICE.exe 1116 QUOTE PRICE.exe 1116 QUOTE PRICE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QUOTE PRICE.exedescription pid process Token: SeDebugPrivilege 1116 QUOTE PRICE.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
QUOTE PRICE.exedescription pid process target process PID 1116 wrote to memory of 972 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 972 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 972 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 972 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 896 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 896 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 896 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 896 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 952 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 952 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 952 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 952 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1660 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1660 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1660 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1660 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1600 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1600 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1600 1116 QUOTE PRICE.exe QUOTE PRICE.exe PID 1116 wrote to memory of 1600 1116 QUOTE PRICE.exe QUOTE PRICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE PRICE.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-53-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1116-55-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/1116-56-0x0000000001E00000-0x0000000001E1D000-memory.dmpFilesize
116KB
-
memory/1116-57-0x0000000005240000-0x00000000052A9000-memory.dmpFilesize
420KB
-
memory/1116-58-0x0000000004160000-0x000000000419A000-memory.dmpFilesize
232KB