Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
04-08-2022 09:54
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE.exe
Resource
win7-20220715-en
General
-
Target
QUOTE.exe
-
Size
705KB
-
MD5
69cce648572c35889b741d72ecfe9690
-
SHA1
2a86fae70b64f4266fa653bd5742fb558e5a5d41
-
SHA256
371982ab20054b57f6cd8698e9f64498c7a857b412d370febbf44d8cbe7f2285
-
SHA512
3ec1973dbc4f2d55d3e567d9b38993f79ef8f8746c701445b3d9e5d4e021647eb4fec22e9775d4ecc342444b5f35f2fa7daa98a42b63a73ee27309efe4b28fde
Malware Config
Extracted
formbook
4.1
ee27
gasimportsfiles.com
hospitaljobsindia.com
mymortgagecantips.xyz
yourenotalone.world
livethejesuslife.com
sobernv.com
bobgruber.online
badu100.com
id98qq12.com
naturalex.co.uk
metathrillrides.com
blessingstowing.com
juddsbarandgrill.com
qrcodemania.com
haodaculture.com
obot.xyz
soupmortgagemark.xyz
top-road.com
xiaoterv.com
madrstyonline.com
lntmemories.com
codeverse.store
coleadersolutions.com
xn--2i0bs4kuxch7w.com
trumanridgekc.com
urbansummerfest.com
prelistingphotos.com
ncknights.com
demo-box.com
rifinastore.com
costamp.online
growthdigitalstudios.com
mso-4.com
rebeccast.club
mobilebusinessmoneymachine.com
hardmails.com
taylorbeckerhair.com
bradarender.com
urfahaberdar.com
evershinetransportltd.co.uk
perfecttime.club
phch.pro
fccxzb.site
myassetssecured.com
mysticmindpublishingacademy.com
energyharvesting.online
nhckom.com
tomiburkolo.com
uplandshell.com
tabularasa.net.cn
pagosahanger.com
apicemtech.com
doomscene.com
yqxinydz.com
lolmaster.host
massageindenton.uk
95hillerdr.com
paymentwize.com
tamwen.app
4any4all.com
neustabos.com
jedonnadingesforgpboe.com
dabeiw.com
thatpaintlady.com
ndcolledge-traducteur.com
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1692-68-0x000000000041F170-mapping.dmp formbook behavioral1/memory/1692-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1692-80-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1044-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1044-87-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1056 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
QUOTE.exeQUOTE.exechkdsk.exedescription pid process target process PID 1808 set thread context of 1692 1808 QUOTE.exe QUOTE.exe PID 1692 set thread context of 1284 1692 QUOTE.exe Explorer.EXE PID 1692 set thread context of 1284 1692 QUOTE.exe Explorer.EXE PID 1044 set thread context of 1284 1044 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
QUOTE.exepowershell.exechkdsk.exepid process 1692 QUOTE.exe 1692 QUOTE.exe 1248 powershell.exe 1692 QUOTE.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe 1044 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
QUOTE.exechkdsk.exepid process 1692 QUOTE.exe 1692 QUOTE.exe 1692 QUOTE.exe 1692 QUOTE.exe 1044 chkdsk.exe 1044 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
QUOTE.exepowershell.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1692 QUOTE.exe Token: SeDebugPrivilege 1248 powershell.exe Token: SeDebugPrivilege 1044 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
QUOTE.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1808 wrote to memory of 1248 1808 QUOTE.exe powershell.exe PID 1808 wrote to memory of 1248 1808 QUOTE.exe powershell.exe PID 1808 wrote to memory of 1248 1808 QUOTE.exe powershell.exe PID 1808 wrote to memory of 1248 1808 QUOTE.exe powershell.exe PID 1808 wrote to memory of 1516 1808 QUOTE.exe schtasks.exe PID 1808 wrote to memory of 1516 1808 QUOTE.exe schtasks.exe PID 1808 wrote to memory of 1516 1808 QUOTE.exe schtasks.exe PID 1808 wrote to memory of 1516 1808 QUOTE.exe schtasks.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1808 wrote to memory of 1692 1808 QUOTE.exe QUOTE.exe PID 1284 wrote to memory of 1044 1284 Explorer.EXE chkdsk.exe PID 1284 wrote to memory of 1044 1284 Explorer.EXE chkdsk.exe PID 1284 wrote to memory of 1044 1284 Explorer.EXE chkdsk.exe PID 1284 wrote to memory of 1044 1284 Explorer.EXE chkdsk.exe PID 1044 wrote to memory of 1056 1044 chkdsk.exe cmd.exe PID 1044 wrote to memory of 1056 1044 chkdsk.exe cmd.exe PID 1044 wrote to memory of 1056 1044 chkdsk.exe cmd.exe PID 1044 wrote to memory of 1056 1044 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mmsXmSlrtaXo.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mmsXmSlrtaXo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4809.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4809.tmpFilesize
1KB
MD59980c52e0a5a96f51fd5a045c3dd91b0
SHA1aa4b5fa9a57895c27b1db70d063d00528fd0ced6
SHA2569f4bd0a5aba501d978087470a374880922cfe45e6e5cce01747285e39c435dbc
SHA5120ab85d3c1bf9b1366214629c9e19a173823ae5bc367d8ff297920aa20b819fbc3d1c821a119d795b3cf351463d0fb53bb408e3901ddf954757f24cee5b634da1
-
memory/1044-79-0x0000000000000000-mapping.dmp
-
memory/1044-87-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1044-85-0x0000000000620000-0x00000000006B3000-memory.dmpFilesize
588KB
-
memory/1044-84-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1044-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1044-82-0x00000000006D0000-0x00000000006D7000-memory.dmpFilesize
28KB
-
memory/1056-81-0x0000000000000000-mapping.dmp
-
memory/1248-71-0x000000006E490000-0x000000006EA3B000-memory.dmpFilesize
5.7MB
-
memory/1248-59-0x0000000000000000-mapping.dmp
-
memory/1248-75-0x000000006E490000-0x000000006EA3B000-memory.dmpFilesize
5.7MB
-
memory/1284-74-0x0000000006BF0000-0x0000000006D8E000-memory.dmpFilesize
1.6MB
-
memory/1284-88-0x0000000006130000-0x00000000061DC000-memory.dmpFilesize
688KB
-
memory/1284-86-0x0000000006130000-0x00000000061DC000-memory.dmpFilesize
688KB
-
memory/1284-78-0x00000000048F0000-0x0000000004A02000-memory.dmpFilesize
1.1MB
-
memory/1516-60-0x0000000000000000-mapping.dmp
-
memory/1692-77-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/1692-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1692-72-0x0000000000BD0000-0x0000000000ED3000-memory.dmpFilesize
3.0MB
-
memory/1692-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1692-73-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB
-
memory/1692-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1692-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1692-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1692-68-0x000000000041F170-mapping.dmp
-
memory/1808-54-0x0000000000B10000-0x0000000000BC6000-memory.dmpFilesize
728KB
-
memory/1808-57-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/1808-58-0x0000000005F50000-0x0000000005FD4000-memory.dmpFilesize
528KB
-
memory/1808-56-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1808-55-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1808-63-0x00000000043D0000-0x0000000004406000-memory.dmpFilesize
216KB