Analysis
-
max time kernel
155s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
GFR Striff GmbH Quote Request.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
GFR Striff GmbH Quote Request.exe
Resource
win10v2004-20220414-en
General
-
Target
GFR Striff GmbH Quote Request.exe
-
Size
553KB
-
MD5
a2696acada8560e12f34664bd720decc
-
SHA1
90fba0988d19126be5f1f6ed2babe4d0f04986ef
-
SHA256
11aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
-
SHA512
66d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
winservie.exepid process 4936 winservie.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winservie = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\winservie.exe" reg.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
GFR Striff GmbH Quote Request.exepowershell.exewinservie.exepid process 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 2440 GFR Striff GmbH Quote Request.exe 3912 powershell.exe 3912 powershell.exe 4936 winservie.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
GFR Striff GmbH Quote Request.exepowershell.exewinservie.exedescription pid process Token: SeDebugPrivilege 2440 GFR Striff GmbH Quote Request.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeDebugPrivilege 4936 winservie.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
GFR Striff GmbH Quote Request.execmd.exepowershell.exedescription pid process target process PID 2440 wrote to memory of 4060 2440 GFR Striff GmbH Quote Request.exe cmd.exe PID 2440 wrote to memory of 4060 2440 GFR Striff GmbH Quote Request.exe cmd.exe PID 2440 wrote to memory of 4060 2440 GFR Striff GmbH Quote Request.exe cmd.exe PID 4060 wrote to memory of 1244 4060 cmd.exe reg.exe PID 4060 wrote to memory of 1244 4060 cmd.exe reg.exe PID 4060 wrote to memory of 1244 4060 cmd.exe reg.exe PID 2440 wrote to memory of 3912 2440 GFR Striff GmbH Quote Request.exe powershell.exe PID 2440 wrote to memory of 3912 2440 GFR Striff GmbH Quote Request.exe powershell.exe PID 2440 wrote to memory of 3912 2440 GFR Striff GmbH Quote Request.exe powershell.exe PID 3912 wrote to memory of 4936 3912 powershell.exe winservie.exe PID 3912 wrote to memory of 4936 3912 powershell.exe winservie.exe PID 3912 wrote to memory of 4936 3912 powershell.exe winservie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GFR Striff GmbH Quote Request.exe"C:\Users\Admin\AppData\Local\Temp\GFR Striff GmbH Quote Request.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v winservie /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winservie.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v winservie /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winservie.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Roaming\winservie.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winservie.exe"C:\Users\Admin\AppData\Roaming\winservie.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\winservie.exeFilesize
553KB
MD5a2696acada8560e12f34664bd720decc
SHA190fba0988d19126be5f1f6ed2babe4d0f04986ef
SHA25611aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
SHA51266d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
-
C:\Users\Admin\AppData\Roaming\winservie.exeFilesize
553KB
MD5a2696acada8560e12f34664bd720decc
SHA190fba0988d19126be5f1f6ed2babe4d0f04986ef
SHA25611aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
SHA51266d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
-
memory/1244-135-0x0000000000000000-mapping.dmp
-
memory/2440-130-0x0000000000370000-0x0000000000400000-memory.dmpFilesize
576KB
-
memory/2440-131-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/2440-132-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/2440-133-0x00000000057B0000-0x00000000057F4000-memory.dmpFilesize
272KB
-
memory/3912-142-0x0000000006360000-0x000000000637E000-memory.dmpFilesize
120KB
-
memory/3912-138-0x00000000055E0000-0x0000000005C08000-memory.dmpFilesize
6.2MB
-
memory/3912-139-0x0000000005440000-0x0000000005462000-memory.dmpFilesize
136KB
-
memory/3912-140-0x0000000005D10000-0x0000000005D76000-memory.dmpFilesize
408KB
-
memory/3912-141-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/3912-137-0x0000000004E30000-0x0000000004E66000-memory.dmpFilesize
216KB
-
memory/3912-143-0x0000000006950000-0x00000000069E6000-memory.dmpFilesize
600KB
-
memory/3912-145-0x00000000068F0000-0x0000000006912000-memory.dmpFilesize
136KB
-
memory/3912-144-0x00000000068A0000-0x00000000068BA000-memory.dmpFilesize
104KB
-
memory/3912-136-0x0000000000000000-mapping.dmp
-
memory/4060-134-0x0000000000000000-mapping.dmp
-
memory/4936-147-0x0000000000000000-mapping.dmp