Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 14:30
Static task
static1
Behavioral task
behavioral1
Sample
Quotation 12052020-doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Quotation 12052020-doc.exe
Resource
win10v2004-20220414-en
General
-
Target
Quotation 12052020-doc.exe
-
Size
760KB
-
MD5
a755796ffa8f905ecc4e382b80518a71
-
SHA1
28a9048dd5f82525e8bbd1012c11f24941d07112
-
SHA256
9f20ec0199d293e7dd83aec28d9a12669880eed778ce2132f13ce5aa54c14d3c
-
SHA512
dabcd1f4a1d5dcb1339ca5e9a4013633ca268f64987f76ddd49cc9a21675ad986794b070073b4edd476b2c5d6cd2092f9fbcfcbac52c86f4e105de08894699a1
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Host.exeHost.exeHost.exepid process 2516 Host.exe 2824 Host.exe 3236 Host.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Quotation 12052020-doc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Quotation 12052020-doc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Host.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 20 IoCs
Processes:
Quotation 12052020-doc.exeHost.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exedescription pid process target process PID 1964 set thread context of 2348 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 2516 set thread context of 2824 2516 Host.exe Host.exe PID 1956 set thread context of 3552 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 set thread context of 4736 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 set thread context of 4360 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 set thread context of 1364 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 set thread context of 4428 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4220 set thread context of 4456 4220 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 544 set thread context of 3660 544 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4836 set thread context of 1748 4836 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 332 set thread context of 4924 332 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 2652 set thread context of 2920 2652 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3256 set thread context of 4564 3256 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1388 set thread context of 3620 1388 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1180 set thread context of 4024 1180 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4088 set thread context of 3648 4088 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1144 set thread context of 3576 1144 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 2608 set thread context of 2572 2608 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3880 set thread context of 1384 3880 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1160 set thread context of 2160 1160 Quotation 12052020-doc.exe Quotation 12052020-doc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Quotation 12052020-doc.exeQuotation 12052020-doc.exeHost.exeQuotation 12052020-doc.exeHost.exeQuotation 12052020-doc.exepid process 1964 Quotation 12052020-doc.exe 1964 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 772 Quotation 12052020-doc.exe 2516 Host.exe 2516 Host.exe 1956 Quotation 12052020-doc.exe 1956 Quotation 12052020-doc.exe 3236 Host.exe 3236 Host.exe 3236 Host.exe 3236 Host.exe 3372 Quotation 12052020-doc.exe 3372 Quotation 12052020-doc.exe 3372 Quotation 12052020-doc.exe 3372 Quotation 12052020-doc.exe 3372 Quotation 12052020-doc.exe 3372 Quotation 12052020-doc.exe 3236 Host.exe 3236 Host.exe 3372 Quotation 12052020-doc.exe 3236 Host.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
Quotation 12052020-doc.exeHost.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exepid process 1964 Quotation 12052020-doc.exe 2516 Host.exe 1956 Quotation 12052020-doc.exe 5076 Quotation 12052020-doc.exe 4304 Quotation 12052020-doc.exe 3120 Quotation 12052020-doc.exe 740 Quotation 12052020-doc.exe 4220 Quotation 12052020-doc.exe 544 Quotation 12052020-doc.exe 4836 Quotation 12052020-doc.exe 332 Quotation 12052020-doc.exe 2652 Quotation 12052020-doc.exe 3256 Quotation 12052020-doc.exe 1388 Quotation 12052020-doc.exe 1180 Quotation 12052020-doc.exe 4088 Quotation 12052020-doc.exe 1144 Quotation 12052020-doc.exe 2608 Quotation 12052020-doc.exe 3880 Quotation 12052020-doc.exe 1160 Quotation 12052020-doc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Quotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeHost.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exeQuotation 12052020-doc.exedescription pid process target process PID 1964 wrote to memory of 2348 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1964 wrote to memory of 2348 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1964 wrote to memory of 2348 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1964 wrote to memory of 772 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1964 wrote to memory of 772 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1964 wrote to memory of 772 1964 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 2348 wrote to memory of 2516 2348 Quotation 12052020-doc.exe Host.exe PID 2348 wrote to memory of 2516 2348 Quotation 12052020-doc.exe Host.exe PID 2348 wrote to memory of 2516 2348 Quotation 12052020-doc.exe Host.exe PID 772 wrote to memory of 1956 772 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 772 wrote to memory of 1956 772 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 772 wrote to memory of 1956 772 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 2516 wrote to memory of 2824 2516 Host.exe Host.exe PID 2516 wrote to memory of 2824 2516 Host.exe Host.exe PID 2516 wrote to memory of 2824 2516 Host.exe Host.exe PID 2516 wrote to memory of 3236 2516 Host.exe Host.exe PID 2516 wrote to memory of 3236 2516 Host.exe Host.exe PID 2516 wrote to memory of 3236 2516 Host.exe Host.exe PID 1956 wrote to memory of 3552 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1956 wrote to memory of 3552 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1956 wrote to memory of 3552 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1956 wrote to memory of 3372 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1956 wrote to memory of 3372 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 1956 wrote to memory of 3372 1956 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3372 wrote to memory of 5076 3372 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3372 wrote to memory of 5076 3372 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3372 wrote to memory of 5076 3372 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 4736 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 4736 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 4736 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 3332 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 3332 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 5076 wrote to memory of 3332 5076 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3332 wrote to memory of 4304 3332 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3332 wrote to memory of 4304 3332 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3332 wrote to memory of 4304 3332 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4360 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4360 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4360 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4392 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4392 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4304 wrote to memory of 4392 4304 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4392 wrote to memory of 3120 4392 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4392 wrote to memory of 3120 4392 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4392 wrote to memory of 3120 4392 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 1364 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 1364 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 1364 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 4436 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 4436 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 3120 wrote to memory of 4436 3120 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4436 wrote to memory of 740 4436 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4436 wrote to memory of 740 4436 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4436 wrote to memory of 740 4436 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 4428 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 4428 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 4428 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 532 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 532 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 740 wrote to memory of 532 740 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 532 wrote to memory of 4220 532 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 532 wrote to memory of 4220 532 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 532 wrote to memory of 4220 532 Quotation 12052020-doc.exe Quotation 12052020-doc.exe PID 4220 wrote to memory of 4456 4220 Quotation 12052020-doc.exe Quotation 12052020-doc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 2824 2405463594⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 2348 2405439372⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 3552 2405464844⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4736 2405547186⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4360 2405630318⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 1364 24057129610⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4428 24057953112⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4456 24058782814⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 3660 24059607816⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 1748 24060437518⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4924 24061268720⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 2920 24062092122⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4564 24062918724⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 3620 24063746826⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 4024 24064578128⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 3648 24065404630⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 3576 24066234332⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 2572 24067057834⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 1384 24067887536⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe" 2 2160 24068712538⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 12052020-doc.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
760KB
MD5a755796ffa8f905ecc4e382b80518a71
SHA128a9048dd5f82525e8bbd1012c11f24941d07112
SHA2569f20ec0199d293e7dd83aec28d9a12669880eed778ce2132f13ce5aa54c14d3c
SHA512dabcd1f4a1d5dcb1339ca5e9a4013633ca268f64987f76ddd49cc9a21675ad986794b070073b4edd476b2c5d6cd2092f9fbcfcbac52c86f4e105de08894699a1
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
760KB
MD5a755796ffa8f905ecc4e382b80518a71
SHA128a9048dd5f82525e8bbd1012c11f24941d07112
SHA2569f20ec0199d293e7dd83aec28d9a12669880eed778ce2132f13ce5aa54c14d3c
SHA512dabcd1f4a1d5dcb1339ca5e9a4013633ca268f64987f76ddd49cc9a21675ad986794b070073b4edd476b2c5d6cd2092f9fbcfcbac52c86f4e105de08894699a1
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
760KB
MD5a755796ffa8f905ecc4e382b80518a71
SHA128a9048dd5f82525e8bbd1012c11f24941d07112
SHA2569f20ec0199d293e7dd83aec28d9a12669880eed778ce2132f13ce5aa54c14d3c
SHA512dabcd1f4a1d5dcb1339ca5e9a4013633ca268f64987f76ddd49cc9a21675ad986794b070073b4edd476b2c5d6cd2092f9fbcfcbac52c86f4e105de08894699a1
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
760KB
MD5a755796ffa8f905ecc4e382b80518a71
SHA128a9048dd5f82525e8bbd1012c11f24941d07112
SHA2569f20ec0199d293e7dd83aec28d9a12669880eed778ce2132f13ce5aa54c14d3c
SHA512dabcd1f4a1d5dcb1339ca5e9a4013633ca268f64987f76ddd49cc9a21675ad986794b070073b4edd476b2c5d6cd2092f9fbcfcbac52c86f4e105de08894699a1
-
memory/332-186-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/332-183-0x0000000000000000-mapping.dmp
-
memory/404-170-0x0000000000000000-mapping.dmp
-
memory/404-172-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/532-165-0x0000000000000000-mapping.dmp
-
memory/532-167-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/544-173-0x0000000000000000-mapping.dmp
-
memory/544-176-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/740-166-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/740-163-0x0000000000000000-mapping.dmp
-
memory/772-131-0x0000000000000000-mapping.dmp
-
memory/772-133-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1144-216-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1144-213-0x0000000000000000-mapping.dmp
-
memory/1160-228-0x0000000000000000-mapping.dmp
-
memory/1160-231-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1180-203-0x0000000000000000-mapping.dmp
-
memory/1180-206-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1364-159-0x0000000000000000-mapping.dmp
-
memory/1384-224-0x0000000000000000-mapping.dmp
-
memory/1388-201-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1388-198-0x0000000000000000-mapping.dmp
-
memory/1632-180-0x0000000000000000-mapping.dmp
-
memory/1632-182-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1748-179-0x0000000000000000-mapping.dmp
-
memory/1956-137-0x0000000000000000-mapping.dmp
-
memory/1956-145-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/1964-132-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2160-229-0x0000000000000000-mapping.dmp
-
memory/2348-130-0x0000000000000000-mapping.dmp
-
memory/2516-134-0x0000000000000000-mapping.dmp
-
memory/2516-143-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2528-210-0x0000000000000000-mapping.dmp
-
memory/2528-212-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2572-219-0x0000000000000000-mapping.dmp
-
memory/2608-218-0x0000000000000000-mapping.dmp
-
memory/2608-221-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2652-191-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2652-188-0x0000000000000000-mapping.dmp
-
memory/2752-222-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/2752-220-0x0000000000000000-mapping.dmp
-
memory/2824-138-0x0000000000000000-mapping.dmp
-
memory/2920-189-0x0000000000000000-mapping.dmp
-
memory/3120-161-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3120-158-0x0000000000000000-mapping.dmp
-
memory/3188-177-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3188-175-0x0000000000000000-mapping.dmp
-
memory/3236-140-0x0000000000000000-mapping.dmp
-
memory/3236-146-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3256-196-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3256-193-0x0000000000000000-mapping.dmp
-
memory/3332-150-0x0000000000000000-mapping.dmp
-
memory/3332-152-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3360-205-0x0000000000000000-mapping.dmp
-
memory/3360-207-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3372-144-0x0000000000000000-mapping.dmp
-
memory/3372-147-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3552-142-0x0000000000000000-mapping.dmp
-
memory/3576-214-0x0000000000000000-mapping.dmp
-
memory/3620-199-0x0000000000000000-mapping.dmp
-
memory/3648-209-0x0000000000000000-mapping.dmp
-
memory/3660-174-0x0000000000000000-mapping.dmp
-
memory/3732-202-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3732-200-0x0000000000000000-mapping.dmp
-
memory/3880-226-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/3880-223-0x0000000000000000-mapping.dmp
-
memory/3960-185-0x0000000000000000-mapping.dmp
-
memory/3960-187-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4024-204-0x0000000000000000-mapping.dmp
-
memory/4032-217-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4032-215-0x0000000000000000-mapping.dmp
-
memory/4088-211-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4088-208-0x0000000000000000-mapping.dmp
-
memory/4220-171-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4220-168-0x0000000000000000-mapping.dmp
-
memory/4296-195-0x0000000000000000-mapping.dmp
-
memory/4296-197-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4304-153-0x0000000000000000-mapping.dmp
-
memory/4304-156-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4360-154-0x0000000000000000-mapping.dmp
-
memory/4392-155-0x0000000000000000-mapping.dmp
-
memory/4392-157-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4428-164-0x0000000000000000-mapping.dmp
-
memory/4436-162-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4436-160-0x0000000000000000-mapping.dmp
-
memory/4456-169-0x0000000000000000-mapping.dmp
-
memory/4472-192-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4472-190-0x0000000000000000-mapping.dmp
-
memory/4564-194-0x0000000000000000-mapping.dmp
-
memory/4692-227-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4692-225-0x0000000000000000-mapping.dmp
-
memory/4736-149-0x0000000000000000-mapping.dmp
-
memory/4836-181-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4836-178-0x0000000000000000-mapping.dmp
-
memory/4892-232-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4892-230-0x0000000000000000-mapping.dmp
-
memory/4924-184-0x0000000000000000-mapping.dmp
-
memory/5076-151-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/5076-148-0x0000000000000000-mapping.dmp