Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
26-01-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-en-20211208
General
-
Target
QUOTATION.exe
-
Size
761KB
-
MD5
b7cd2e625aa05005e2326e5e6158a560
-
SHA1
420a83cd1c1703fbf7aeb8b7e51c46c407e5d6b5
-
SHA256
f08bb3738306349fa7b9217837de2e959cba48fdceb4ada3d3b58533bb3527f2
-
SHA512
c53ea74a3da53f82bc12bbe0d10a8050d8747737b3cff118465357c278d05b7ddf185b4f53759e636cf7da6000a6036220f1d3df3faa15b00e13f6c33ba18b30
Malware Config
Extracted
formbook
4.1
e10p
pompland.com
hybikebbs.com
sacramentocommercial.net
dixietales.com
rakan-group.com
wanmeipp.com
brandonwestjacksonville.com
jschenjitong.com
sedarous.com
cheapflightsandhotels.net
effectivehomeloans.com
haru-kun.com
pure-heartfelt.com
tlbdsm72.com
avantcarmomento.com
flighthonestpaulvids.com
xn--ok0b350biyc97gvlg.com
3bmmxvn.life
force-win.info
shvecarskiy-stil.store
youlikemassagespa.com
maniatr.info
tvephoto.com
makewebsites44.com
jenniferbaernutrition.com
surreyconectedcare.com
whattogetme.com
dranbok.xyz
nogza.com
lvsssj.com
maison-etoile.com
freemortgagetraining.com
aishastarsfabric.com
secrettextprime.com
fluidra-emea1.com
danstpaulcomedy.com
uklredygwe.com
mkto-nld1040159.com
lucidchains.com
ameiting.com
dipreemprende.com
fgc-limited.com
aggarudyog.com
shatoyaharrisenterprises.com
alpha-df.com
mversehollywood.com
espertoaml.com
yomamaverse.com
kidsroomfan.com
skill-course.com
quickbanknet.com
yelangrenti.com
marmocn.com
cattleyaproperties.com
cursosoficialdesites.com
utkrashtlandbase.com
percysangles.com
lesoq.com
brainhacksex.com
tabledumarais.com
30daysofpurposechallenge.com
yamanteknikbursa.com
sweetysmoke.com
piletekstil.com
kelqueenskloset.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1928-70-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 796 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATION.exeQUOTATION.exewininit.exedescription pid process target process PID 1132 set thread context of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1804 set thread context of 1416 1804 QUOTATION.exe Explorer.EXE PID 1928 set thread context of 1416 1928 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
QUOTATION.exeQUOTATION.exewininit.exepid process 1132 QUOTATION.exe 1804 QUOTATION.exe 1804 QUOTATION.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe 1928 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
QUOTATION.exewininit.exepid process 1804 QUOTATION.exe 1804 QUOTATION.exe 1804 QUOTATION.exe 1928 wininit.exe 1928 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
QUOTATION.exeQUOTATION.exewininit.exedescription pid process Token: SeDebugPrivilege 1132 QUOTATION.exe Token: SeDebugPrivilege 1804 QUOTATION.exe Token: SeDebugPrivilege 1928 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1416 Explorer.EXE 1416 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1416 Explorer.EXE 1416 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
QUOTATION.exeExplorer.EXEwininit.exedescription pid process target process PID 1132 wrote to memory of 1356 1132 QUOTATION.exe schtasks.exe PID 1132 wrote to memory of 1356 1132 QUOTATION.exe schtasks.exe PID 1132 wrote to memory of 1356 1132 QUOTATION.exe schtasks.exe PID 1132 wrote to memory of 1356 1132 QUOTATION.exe schtasks.exe PID 1132 wrote to memory of 1204 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1204 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1204 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1204 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1804 1132 QUOTATION.exe QUOTATION.exe PID 1416 wrote to memory of 1928 1416 Explorer.EXE wininit.exe PID 1416 wrote to memory of 1928 1416 Explorer.EXE wininit.exe PID 1416 wrote to memory of 1928 1416 Explorer.EXE wininit.exe PID 1416 wrote to memory of 1928 1416 Explorer.EXE wininit.exe PID 1928 wrote to memory of 796 1928 wininit.exe cmd.exe PID 1928 wrote to memory of 796 1928 wininit.exe cmd.exe PID 1928 wrote to memory of 796 1928 wininit.exe cmd.exe PID 1928 wrote to memory of 796 1928 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ecCgWUxCAvyuz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC35F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC35F.tmpMD5
8e7a456fb9f790873d92c755df7ce27c
SHA1d57176893b817a61ecb8aa47dcc90a33046e6bc3
SHA256229a9a06e2d7099e44a5fdc7f488fa6e80b73a73dd8024a69f254a2f07d8328c
SHA51222a1a66fe12f0b8655f01e2595b5ba8c08ae6573218a4d8e87537a045e36853605dfab62484b5d1b7a73bbecdafc8482c594ed47493d14446708a09fc99c6c16
-
memory/1132-55-0x0000000000BF0000-0x0000000000CB4000-memory.dmpFilesize
784KB
-
memory/1132-56-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1132-57-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1132-58-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1132-59-0x0000000005A30000-0x0000000005AE4000-memory.dmpFilesize
720KB
-
memory/1132-60-0x0000000000870000-0x00000000008D2000-memory.dmpFilesize
392KB
-
memory/1416-68-0x0000000004A30000-0x0000000004AF0000-memory.dmpFilesize
768KB
-
memory/1416-73-0x0000000004EE0000-0x0000000004FE0000-memory.dmpFilesize
1024KB
-
memory/1804-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-65-0x0000000000CC0000-0x0000000000FC3000-memory.dmpFilesize
3.0MB
-
memory/1804-67-0x0000000000290000-0x00000000002A5000-memory.dmpFilesize
84KB
-
memory/1804-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1928-69-0x0000000000450000-0x000000000046A000-memory.dmpFilesize
104KB
-
memory/1928-70-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1928-71-0x0000000001EE0000-0x00000000021E3000-memory.dmpFilesize
3.0MB
-
memory/1928-72-0x0000000001DF0000-0x0000000001E84000-memory.dmpFilesize
592KB