Analysis
-
max time kernel
151s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:35
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
QUOTATION.exe
-
Size
810KB
-
MD5
f516dea583b4b0f7fcb8d6dd89699f78
-
SHA1
a7e60518cf65022b9ce54993ba40bca09b3a024c
-
SHA256
2f1b95fb8123decdb56781dc245603e02ff9a1d2c2962d51fab3946712059a0a
-
SHA512
d079db285753c2b74f4c2520042f2857a4523c8551da6dcad0ff5e02c28348585cf7ee126b0772977faf89fd4de0bf7cd3c96fea7a5069a5ef3d810df1147b92
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-63-0x000000000041C790-mapping.dmp xloader behavioral1/memory/1632-62-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1632-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1084-73-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
mstsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JTH0NRUHVFE = "C:\\Program Files (x86)\\Zwnuxv4rh\\colorcplg0h.exe" mstsc.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 320 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATION.exeQUOTATION.exemstsc.exedescription pid process target process PID 1304 set thread context of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1632 set thread context of 1268 1632 QUOTATION.exe Explorer.EXE PID 1084 set thread context of 1268 1084 mstsc.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
mstsc.exedescription ioc process File opened for modification C:\Program Files (x86)\Zwnuxv4rh\colorcplg0h.exe mstsc.exe -
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
QUOTATION.exemstsc.exepid process 1632 QUOTATION.exe 1632 QUOTATION.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
QUOTATION.exemstsc.exepid process 1632 QUOTATION.exe 1632 QUOTATION.exe 1632 QUOTATION.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe 1084 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
QUOTATION.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1632 QUOTATION.exe Token: SeDebugPrivilege 1084 mstsc.exe Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
QUOTATION.exeExplorer.EXEmstsc.exedescription pid process target process PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1304 wrote to memory of 1632 1304 QUOTATION.exe QUOTATION.exe PID 1268 wrote to memory of 1084 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1084 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1084 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1084 1268 Explorer.EXE mstsc.exe PID 1084 wrote to memory of 320 1084 mstsc.exe cmd.exe PID 1084 wrote to memory of 320 1084 mstsc.exe cmd.exe PID 1084 wrote to memory of 320 1084 mstsc.exe cmd.exe PID 1084 wrote to memory of 320 1084 mstsc.exe cmd.exe PID 1084 wrote to memory of 1504 1084 mstsc.exe Firefox.exe PID 1084 wrote to memory of 1504 1084 mstsc.exe Firefox.exe PID 1084 wrote to memory of 1504 1084 mstsc.exe Firefox.exe PID 1084 wrote to memory of 1504 1084 mstsc.exe Firefox.exe PID 1084 wrote to memory of 1504 1084 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-71-0x0000000000000000-mapping.dmp
-
memory/1084-69-0x0000000000000000-mapping.dmp
-
memory/1084-72-0x0000000000490000-0x0000000000594000-memory.dmpFilesize
1.0MB
-
memory/1084-73-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1084-74-0x0000000002130000-0x0000000002433000-memory.dmpFilesize
3.0MB
-
memory/1084-75-0x0000000002060000-0x00000000020EF000-memory.dmpFilesize
572KB
-
memory/1268-76-0x00000000063C0000-0x00000000064A3000-memory.dmpFilesize
908KB
-
memory/1268-68-0x0000000004D50000-0x0000000004E24000-memory.dmpFilesize
848KB
-
memory/1304-54-0x0000000000880000-0x0000000000950000-memory.dmpFilesize
832KB
-
memory/1304-58-0x0000000002000000-0x000000000203E000-memory.dmpFilesize
248KB
-
memory/1304-57-0x0000000004B60000-0x0000000004BC8000-memory.dmpFilesize
416KB
-
memory/1304-56-0x0000000000390000-0x00000000003A0000-memory.dmpFilesize
64KB
-
memory/1304-55-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1632-59-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1632-67-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1632-66-0x0000000000BF0000-0x0000000000EF3000-memory.dmpFilesize
3.0MB
-
memory/1632-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1632-62-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1632-63-0x000000000041C790-mapping.dmp
-
memory/1632-60-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB