Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31-10-2022 07:05
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220812-en
General
-
Target
Quotation.exe
-
Size
1.0MB
-
MD5
7fd40d18e9804f154780cbb3d2b017d8
-
SHA1
772940d64eb308d240cd205d29c4e1c5881a96b4
-
SHA256
89af280045471592c70e1c139db75bbe28354d08370ac05dff4ea8245f2088b5
-
SHA512
1cbfe6168b30db197a140ccc3fdf9b2dbe5e63db246c734d3374c0e026863bec025f7a1f104f35e77058370203b76ee3ff805c697a74d04ba2343d722d9d1154
-
SSDEEP
12288:8OHgGPilFfoqztDiGW8E2YoFhqJLNu6n0o/rUbihaIJDk:HbiAkD08rYoFALK44bisYI
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ipconfig.exepid process 1864 ipconfig.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeRegSvcs.exeipconfig.exedescription pid process target process PID 1932 set thread context of 572 1932 Quotation.exe RegSvcs.exe PID 572 set thread context of 1324 572 RegSvcs.exe Explorer.EXE PID 1864 set thread context of 1324 1864 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1864 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RegSvcs.exepowershell.exeipconfig.exepid process 572 RegSvcs.exe 1076 powershell.exe 572 RegSvcs.exe 572 RegSvcs.exe 572 RegSvcs.exe 1864 ipconfig.exe 1864 ipconfig.exe 1864 ipconfig.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exeipconfig.exepid process 572 RegSvcs.exe 572 RegSvcs.exe 572 RegSvcs.exe 1864 ipconfig.exe 1864 ipconfig.exe 1864 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRegSvcs.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 572 RegSvcs.exe Token: SeDebugPrivilege 1864 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Quotation.exeExplorer.EXEipconfig.exedescription pid process target process PID 1932 wrote to memory of 1076 1932 Quotation.exe powershell.exe PID 1932 wrote to memory of 1076 1932 Quotation.exe powershell.exe PID 1932 wrote to memory of 1076 1932 Quotation.exe powershell.exe PID 1932 wrote to memory of 1076 1932 Quotation.exe powershell.exe PID 1932 wrote to memory of 2036 1932 Quotation.exe schtasks.exe PID 1932 wrote to memory of 2036 1932 Quotation.exe schtasks.exe PID 1932 wrote to memory of 2036 1932 Quotation.exe schtasks.exe PID 1932 wrote to memory of 2036 1932 Quotation.exe schtasks.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1932 wrote to memory of 572 1932 Quotation.exe RegSvcs.exe PID 1324 wrote to memory of 1864 1324 Explorer.EXE ipconfig.exe PID 1324 wrote to memory of 1864 1324 Explorer.EXE ipconfig.exe PID 1324 wrote to memory of 1864 1324 Explorer.EXE ipconfig.exe PID 1324 wrote to memory of 1864 1324 Explorer.EXE ipconfig.exe PID 1864 wrote to memory of 1636 1864 ipconfig.exe Firefox.exe PID 1864 wrote to memory of 1636 1864 ipconfig.exe Firefox.exe PID 1864 wrote to memory of 1636 1864 ipconfig.exe Firefox.exe PID 1864 wrote to memory of 1636 1864 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UDBEbqvAJGhh.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UDBEbqvAJGhh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8FD.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA8FD.tmpFilesize
1KB
MD509dd2203f36a0dc94cd0a1c0a24d4f4b
SHA1f54ba810936cfa2f144c4c0379a67cc23196c75c
SHA2568e6a5f796cd2a1df1402f957148d1bbbfd292d47610c03273628c71df0afc670
SHA512e4746279d2f1768057719c499e0d91165bd08636c411f87e583f91e8247a037fc68b863e5f4c71ae523ff2a6341b1c5b77743e892f916db192943de29eaa47e4
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
832KB
MD507fb6d31f37fb1b4164bef301306c288
SHA14cb41af6d63a07324ef6b18b1a1f43ce94e25626
SHA25606ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02
SHA512cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353
-
memory/572-72-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/572-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/572-73-0x0000000000130000-0x0000000000140000-memory.dmpFilesize
64KB
-
memory/572-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/572-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/572-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/572-65-0x00000000004012B0-mapping.dmp
-
memory/572-77-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/572-70-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/572-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1076-68-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1076-57-0x0000000000000000-mapping.dmp
-
memory/1076-82-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1324-84-0x0000000006AF0000-0x0000000006C78000-memory.dmpFilesize
1.5MB
-
memory/1324-74-0x0000000004CF0000-0x0000000004E25000-memory.dmpFilesize
1.2MB
-
memory/1324-86-0x0000000006AF0000-0x0000000006C78000-memory.dmpFilesize
1.5MB
-
memory/1864-80-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1864-75-0x0000000000000000-mapping.dmp
-
memory/1864-79-0x0000000000140000-0x000000000014A000-memory.dmpFilesize
40KB
-
memory/1864-81-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1864-83-0x0000000000350000-0x00000000003DF000-memory.dmpFilesize
572KB
-
memory/1864-85-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1932-55-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1932-67-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1932-56-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/2036-58-0x0000000000000000-mapping.dmp