Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 12:44
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220812-en
General
-
Target
Quotation.exe
-
Size
991KB
-
MD5
59d24bcc44a883d21a48b2d368a1ff45
-
SHA1
d933aac89872b6a5f60901563b19c6715a0d007a
-
SHA256
5032a3dbc97f17dba5cf4a7dc67a6c9ae6293a344d9d9433d63e8cd180226927
-
SHA512
9281ea610f54c4df7f849d4c9e9021b6b3983a04ce0c6606db587d8d3b412de0494a1717adc9e701947ddd97f40216768d40af96983ad95449040e5bccbdecaf
-
SSDEEP
12288:dHeyEXo6MY++34Ot1UzDMHvRJUHoPYFoBMmTA0+bB/jIyBXRsZZ4wiPWL1QORWl5:m/DkM1nHvRJ9PYqs0+5FXk+P41Q7BBz
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Quotation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Quotation.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeRegSvcs.exerundll32.exedescription pid process target process PID 4864 set thread context of 832 4864 Quotation.exe RegSvcs.exe PID 832 set thread context of 2152 832 RegSvcs.exe Explorer.EXE PID 2184 set thread context of 2152 2184 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Quotation.exepowershell.exeRegSvcs.exerundll32.exepid process 4864 Quotation.exe 4864 Quotation.exe 3400 powershell.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 3400 powershell.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2152 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exerundll32.exepid process 832 RegSvcs.exe 832 RegSvcs.exe 832 RegSvcs.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Quotation.exepowershell.exeRegSvcs.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4864 Quotation.exe Token: SeDebugPrivilege 3400 powershell.exe Token: SeDebugPrivilege 832 RegSvcs.exe Token: SeDebugPrivilege 2184 rundll32.exe Token: SeShutdownPrivilege 2152 Explorer.EXE Token: SeCreatePagefilePrivilege 2152 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Quotation.exeExplorer.EXErundll32.exedescription pid process target process PID 4864 wrote to memory of 3400 4864 Quotation.exe powershell.exe PID 4864 wrote to memory of 3400 4864 Quotation.exe powershell.exe PID 4864 wrote to memory of 3400 4864 Quotation.exe powershell.exe PID 4864 wrote to memory of 3796 4864 Quotation.exe schtasks.exe PID 4864 wrote to memory of 3796 4864 Quotation.exe schtasks.exe PID 4864 wrote to memory of 3796 4864 Quotation.exe schtasks.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 4864 wrote to memory of 832 4864 Quotation.exe RegSvcs.exe PID 2152 wrote to memory of 2184 2152 Explorer.EXE rundll32.exe PID 2152 wrote to memory of 2184 2152 Explorer.EXE rundll32.exe PID 2152 wrote to memory of 2184 2152 Explorer.EXE rundll32.exe PID 2184 wrote to memory of 1812 2184 rundll32.exe Firefox.exe PID 2184 wrote to memory of 1812 2184 rundll32.exe Firefox.exe PID 2184 wrote to memory of 1812 2184 rundll32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OJGfLeUSALnpf.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OJGfLeUSALnpf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1618.tmp"3⤵
- Creates scheduled task(s)
PID:3796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:832 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1618.tmpFilesize
1KB
MD5771a2c043443bd78d6f97d12e732bae9
SHA1462965f969ffa3f8ad57d30246ab91801b017f43
SHA2560fb0ea70afba29da669495aa92b4166cf46421eca8b369977010ab9ea8d1b6c9
SHA512a167c0ae55285d898a95c058c561a2b6b9e17c452cdedbe8201633e793e7337991be18da243d471f1974593f288b995dd6169d9bb2077d9fb549a62be58e6fb1
-
memory/832-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/832-152-0x0000000001050000-0x0000000001060000-memory.dmpFilesize
64KB
-
memory/832-151-0x0000000001650000-0x000000000199A000-memory.dmpFilesize
3.3MB
-
memory/832-150-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/832-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/832-148-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/832-142-0x0000000000000000-mapping.dmp
-
memory/2152-172-0x0000000007B30000-0x0000000007BD8000-memory.dmpFilesize
672KB
-
memory/2152-170-0x0000000007B30000-0x0000000007BD8000-memory.dmpFilesize
672KB
-
memory/2152-153-0x0000000007CB0000-0x0000000007DB7000-memory.dmpFilesize
1.0MB
-
memory/2184-164-0x0000000000690000-0x00000000006BD000-memory.dmpFilesize
180KB
-
memory/2184-160-0x0000000000000000-mapping.dmp
-
memory/2184-171-0x0000000000690000-0x00000000006BD000-memory.dmpFilesize
180KB
-
memory/2184-169-0x00000000023D0000-0x000000000245F000-memory.dmpFilesize
572KB
-
memory/2184-165-0x00000000025A0000-0x00000000028EA000-memory.dmpFilesize
3.3MB
-
memory/2184-163-0x0000000000E10000-0x0000000000E24000-memory.dmpFilesize
80KB
-
memory/3400-166-0x0000000007AD0000-0x0000000007ADE000-memory.dmpFilesize
56KB
-
memory/3400-161-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/3400-146-0x00000000056C0000-0x00000000056E2000-memory.dmpFilesize
136KB
-
memory/3400-147-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/3400-154-0x0000000006580000-0x000000000659E000-memory.dmpFilesize
120KB
-
memory/3400-155-0x0000000006B60000-0x0000000006B92000-memory.dmpFilesize
200KB
-
memory/3400-156-0x0000000071240000-0x000000007128C000-memory.dmpFilesize
304KB
-
memory/3400-157-0x0000000006B40000-0x0000000006B5E000-memory.dmpFilesize
120KB
-
memory/3400-158-0x0000000007EE0000-0x000000000855A000-memory.dmpFilesize
6.5MB
-
memory/3400-159-0x00000000078A0000-0x00000000078BA000-memory.dmpFilesize
104KB
-
memory/3400-138-0x0000000000000000-mapping.dmp
-
memory/3400-168-0x0000000007BC0000-0x0000000007BC8000-memory.dmpFilesize
32KB
-
memory/3400-162-0x0000000007B20000-0x0000000007BB6000-memory.dmpFilesize
600KB
-
memory/3400-167-0x0000000007BE0000-0x0000000007BFA000-memory.dmpFilesize
104KB
-
memory/3400-143-0x0000000005720000-0x0000000005D48000-memory.dmpFilesize
6.2MB
-
memory/3400-140-0x0000000002C70000-0x0000000002CA6000-memory.dmpFilesize
216KB
-
memory/3796-139-0x0000000000000000-mapping.dmp
-
memory/4864-132-0x0000000000FC0000-0x00000000010BE000-memory.dmpFilesize
1016KB
-
memory/4864-137-0x0000000009CB0000-0x0000000009D16000-memory.dmpFilesize
408KB
-
memory/4864-135-0x0000000005A50000-0x0000000005A5A000-memory.dmpFilesize
40KB
-
memory/4864-134-0x0000000005A60000-0x0000000005AF2000-memory.dmpFilesize
584KB
-
memory/4864-136-0x0000000009870000-0x000000000990C000-memory.dmpFilesize
624KB
-
memory/4864-133-0x0000000006110000-0x00000000066B4000-memory.dmpFilesize
5.6MB