Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 09:54
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE.exe
Resource
win7-20220715-en
General
-
Target
QUOTE.exe
-
Size
705KB
-
MD5
69cce648572c35889b741d72ecfe9690
-
SHA1
2a86fae70b64f4266fa653bd5742fb558e5a5d41
-
SHA256
371982ab20054b57f6cd8698e9f64498c7a857b412d370febbf44d8cbe7f2285
-
SHA512
3ec1973dbc4f2d55d3e567d9b38993f79ef8f8746c701445b3d9e5d4e021647eb4fec22e9775d4ecc342444b5f35f2fa7daa98a42b63a73ee27309efe4b28fde
Malware Config
Extracted
formbook
4.1
ee27
gasimportsfiles.com
hospitaljobsindia.com
mymortgagecantips.xyz
yourenotalone.world
livethejesuslife.com
sobernv.com
bobgruber.online
badu100.com
id98qq12.com
naturalex.co.uk
metathrillrides.com
blessingstowing.com
juddsbarandgrill.com
qrcodemania.com
haodaculture.com
obot.xyz
soupmortgagemark.xyz
top-road.com
xiaoterv.com
madrstyonline.com
lntmemories.com
codeverse.store
coleadersolutions.com
xn--2i0bs4kuxch7w.com
trumanridgekc.com
urbansummerfest.com
prelistingphotos.com
ncknights.com
demo-box.com
rifinastore.com
costamp.online
growthdigitalstudios.com
mso-4.com
rebeccast.club
mobilebusinessmoneymachine.com
hardmails.com
taylorbeckerhair.com
bradarender.com
urfahaberdar.com
evershinetransportltd.co.uk
perfecttime.club
phch.pro
fccxzb.site
myassetssecured.com
mysticmindpublishingacademy.com
energyharvesting.online
nhckom.com
tomiburkolo.com
uplandshell.com
tabularasa.net.cn
pagosahanger.com
apicemtech.com
doomscene.com
yqxinydz.com
lolmaster.host
massageindenton.uk
95hillerdr.com
paymentwize.com
tamwen.app
4any4all.com
neustabos.com
jedonnadingesforgpboe.com
dabeiw.com
thatpaintlady.com
ndcolledge-traducteur.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3516-145-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3516-149-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4416-156-0x00000000010C0000-0x00000000010EF000-memory.dmp formbook behavioral2/memory/4416-169-0x00000000010C0000-0x00000000010EF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
QUOTE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation QUOTE.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTE.exeQUOTE.exemsiexec.exedescription pid process target process PID 1404 set thread context of 3516 1404 QUOTE.exe QUOTE.exe PID 3516 set thread context of 408 3516 QUOTE.exe Explorer.EXE PID 4416 set thread context of 408 4416 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
QUOTE.exeQUOTE.exepowershell.exemsiexec.exepid process 1404 QUOTE.exe 1404 QUOTE.exe 3516 QUOTE.exe 3516 QUOTE.exe 3516 QUOTE.exe 3516 QUOTE.exe 4512 powershell.exe 4512 powershell.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe 4416 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 408 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
QUOTE.exemsiexec.exepid process 3516 QUOTE.exe 3516 QUOTE.exe 3516 QUOTE.exe 4416 msiexec.exe 4416 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exeQUOTE.exeQUOTE.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4512 powershell.exe Token: SeDebugPrivilege 1404 QUOTE.exe Token: SeDebugPrivilege 3516 QUOTE.exe Token: SeDebugPrivilege 4416 msiexec.exe Token: SeShutdownPrivilege 408 Explorer.EXE Token: SeCreatePagefilePrivilege 408 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
QUOTE.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1404 wrote to memory of 4512 1404 QUOTE.exe powershell.exe PID 1404 wrote to memory of 4512 1404 QUOTE.exe powershell.exe PID 1404 wrote to memory of 4512 1404 QUOTE.exe powershell.exe PID 1404 wrote to memory of 3592 1404 QUOTE.exe schtasks.exe PID 1404 wrote to memory of 3592 1404 QUOTE.exe schtasks.exe PID 1404 wrote to memory of 3592 1404 QUOTE.exe schtasks.exe PID 1404 wrote to memory of 904 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 904 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 904 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 1404 wrote to memory of 3516 1404 QUOTE.exe QUOTE.exe PID 408 wrote to memory of 4416 408 Explorer.EXE msiexec.exe PID 408 wrote to memory of 4416 408 Explorer.EXE msiexec.exe PID 408 wrote to memory of 4416 408 Explorer.EXE msiexec.exe PID 4416 wrote to memory of 3760 4416 msiexec.exe cmd.exe PID 4416 wrote to memory of 3760 4416 msiexec.exe cmd.exe PID 4416 wrote to memory of 3760 4416 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mmsXmSlrtaXo.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mmsXmSlrtaXo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTE.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmpFilesize
1KB
MD5d6e6f0cdca6d7fea5c5c2cc86212c0c2
SHA18a8adcc47fbc8b19f3e7c3284e3491f45fe5dc78
SHA256d3e926667c8b0237706be37a9437ea80289f9520a0e4916b47b23e741e4ab1e9
SHA5120a443d9ba0084bf9b1b39af1fd42445500c1d0a709dc5f48855c6e888014c8a50c3807cb9153497de4c26b05a73c24e8c7157031f8ff1b320deb820f6b29946b
-
memory/408-172-0x0000000008240000-0x000000000831C000-memory.dmpFilesize
880KB
-
memory/408-152-0x0000000007E80000-0x0000000007F36000-memory.dmpFilesize
728KB
-
memory/408-171-0x0000000008240000-0x000000000831C000-memory.dmpFilesize
880KB
-
memory/904-143-0x0000000000000000-mapping.dmp
-
memory/1404-133-0x0000000005820000-0x0000000005DC4000-memory.dmpFilesize
5.6MB
-
memory/1404-134-0x0000000005310000-0x00000000053A2000-memory.dmpFilesize
584KB
-
memory/1404-135-0x0000000005300000-0x000000000530A000-memory.dmpFilesize
40KB
-
memory/1404-136-0x00000000012B0000-0x000000000134C000-memory.dmpFilesize
624KB
-
memory/1404-137-0x0000000007690000-0x00000000076F6000-memory.dmpFilesize
408KB
-
memory/1404-132-0x00000000008A0000-0x0000000000956000-memory.dmpFilesize
728KB
-
memory/3516-144-0x0000000000000000-mapping.dmp
-
memory/3516-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3516-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3516-150-0x0000000001410000-0x000000000175A000-memory.dmpFilesize
3.3MB
-
memory/3516-151-0x0000000000F20000-0x0000000000F34000-memory.dmpFilesize
80KB
-
memory/3592-139-0x0000000000000000-mapping.dmp
-
memory/3760-157-0x0000000000000000-mapping.dmp
-
memory/4416-170-0x0000000002E90000-0x0000000002F23000-memory.dmpFilesize
588KB
-
memory/4416-169-0x00000000010C0000-0x00000000010EF000-memory.dmpFilesize
188KB
-
memory/4416-163-0x0000000002F60000-0x00000000032AA000-memory.dmpFilesize
3.3MB
-
memory/4416-154-0x0000000000000000-mapping.dmp
-
memory/4416-155-0x0000000000050000-0x0000000000062000-memory.dmpFilesize
72KB
-
memory/4416-156-0x00000000010C0000-0x00000000010EF000-memory.dmpFilesize
188KB
-
memory/4512-142-0x0000000005910000-0x0000000005F38000-memory.dmpFilesize
6.2MB
-
memory/4512-158-0x0000000006BA0000-0x0000000006BD2000-memory.dmpFilesize
200KB
-
memory/4512-159-0x0000000071E30000-0x0000000071E7C000-memory.dmpFilesize
304KB
-
memory/4512-160-0x0000000006B10000-0x0000000006B2E000-memory.dmpFilesize
120KB
-
memory/4512-161-0x0000000007F20000-0x000000000859A000-memory.dmpFilesize
6.5MB
-
memory/4512-162-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/4512-153-0x00000000065C0000-0x00000000065DE000-memory.dmpFilesize
120KB
-
memory/4512-164-0x0000000007930000-0x000000000793A000-memory.dmpFilesize
40KB
-
memory/4512-165-0x0000000007B60000-0x0000000007BF6000-memory.dmpFilesize
600KB
-
memory/4512-166-0x0000000007B00000-0x0000000007B0E000-memory.dmpFilesize
56KB
-
memory/4512-167-0x0000000007C20000-0x0000000007C3A000-memory.dmpFilesize
104KB
-
memory/4512-168-0x0000000007B50000-0x0000000007B58000-memory.dmpFilesize
32KB
-
memory/4512-147-0x0000000005690000-0x00000000056F6000-memory.dmpFilesize
408KB
-
memory/4512-146-0x00000000055F0000-0x0000000005612000-memory.dmpFilesize
136KB
-
memory/4512-140-0x0000000002CD0000-0x0000000002D06000-memory.dmpFilesize
216KB
-
memory/4512-138-0x0000000000000000-mapping.dmp