Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
31-10-2022 11:37
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220901-en
General
-
Target
Quotation.exe
-
Size
1.0MB
-
MD5
7fd40d18e9804f154780cbb3d2b017d8
-
SHA1
772940d64eb308d240cd205d29c4e1c5881a96b4
-
SHA256
89af280045471592c70e1c139db75bbe28354d08370ac05dff4ea8245f2088b5
-
SHA512
1cbfe6168b30db197a140ccc3fdf9b2dbe5e63db246c734d3374c0e026863bec025f7a1f104f35e77058370203b76ee3ff805c697a74d04ba2343d722d9d1154
-
SSDEEP
12288:8OHgGPilFfoqztDiGW8E2YoFhqJLNu6n0o/rUbihaIJDk:HbiAkD08rYoFALK44bisYI
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
cmmon32.exepid process 1424 cmmon32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Quotation.exeRegSvcs.execmmon32.exedescription pid process target process PID 1228 set thread context of 1736 1228 Quotation.exe RegSvcs.exe PID 1736 set thread context of 1284 1736 RegSvcs.exe Explorer.EXE PID 1424 set thread context of 1284 1424 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeRegSvcs.execmmon32.exepid process 804 powershell.exe 1736 RegSvcs.exe 1736 RegSvcs.exe 1736 RegSvcs.exe 1736 RegSvcs.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1736 RegSvcs.exe 1736 RegSvcs.exe 1736 RegSvcs.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe 1424 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 804 powershell.exe Token: SeDebugPrivilege 1736 RegSvcs.exe Token: SeDebugPrivilege 1424 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Quotation.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1228 wrote to memory of 804 1228 Quotation.exe powershell.exe PID 1228 wrote to memory of 804 1228 Quotation.exe powershell.exe PID 1228 wrote to memory of 804 1228 Quotation.exe powershell.exe PID 1228 wrote to memory of 804 1228 Quotation.exe powershell.exe PID 1228 wrote to memory of 1712 1228 Quotation.exe schtasks.exe PID 1228 wrote to memory of 1712 1228 Quotation.exe schtasks.exe PID 1228 wrote to memory of 1712 1228 Quotation.exe schtasks.exe PID 1228 wrote to memory of 1712 1228 Quotation.exe schtasks.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1228 wrote to memory of 1736 1228 Quotation.exe RegSvcs.exe PID 1284 wrote to memory of 1424 1284 Explorer.EXE cmmon32.exe PID 1284 wrote to memory of 1424 1284 Explorer.EXE cmmon32.exe PID 1284 wrote to memory of 1424 1284 Explorer.EXE cmmon32.exe PID 1284 wrote to memory of 1424 1284 Explorer.EXE cmmon32.exe PID 1424 wrote to memory of 2000 1424 cmmon32.exe Firefox.exe PID 1424 wrote to memory of 2000 1424 cmmon32.exe Firefox.exe PID 1424 wrote to memory of 2000 1424 cmmon32.exe Firefox.exe PID 1424 wrote to memory of 2000 1424 cmmon32.exe Firefox.exe PID 1424 wrote to memory of 2000 1424 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UDBEbqvAJGhh.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UDBEbqvAJGhh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4EC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD4EC.tmpFilesize
1KB
MD515a6f63374e33155b835e4d68bc450cb
SHA18d644febb3615baa45ec92d531f09b67987eac95
SHA256cc3db0908498a80e2fca8ec485852303df313e8cbf93b649cdc0b281f4a7550b
SHA512e1df1ef12aef244e8e582a11064d73c470b0bbccb1a46f8d88f984aaf9459bc6f2ff38bab72952c076bad48bac70a777b9543924924aa389018f1fdbba16c0f2
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
832KB
MD507fb6d31f37fb1b4164bef301306c288
SHA14cb41af6d63a07324ef6b18b1a1f43ce94e25626
SHA25606ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02
SHA512cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353
-
memory/804-57-0x0000000000000000-mapping.dmp
-
memory/804-70-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/804-81-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/1228-67-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/1228-55-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/1228-56-0x0000000073F20000-0x00000000744CB000-memory.dmpFilesize
5.7MB
-
memory/1228-54-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/1284-80-0x0000000004DE0000-0x0000000004EC3000-memory.dmpFilesize
908KB
-
memory/1284-84-0x0000000004DE0000-0x0000000004EC3000-memory.dmpFilesize
908KB
-
memory/1284-74-0x0000000006A70000-0x0000000006BBC000-memory.dmpFilesize
1.3MB
-
memory/1424-82-0x0000000000110000-0x000000000013D000-memory.dmpFilesize
180KB
-
memory/1424-76-0x0000000000350000-0x000000000035D000-memory.dmpFilesize
52KB
-
memory/1424-79-0x0000000001D80000-0x0000000001E0F000-memory.dmpFilesize
572KB
-
memory/1424-78-0x0000000001E80000-0x0000000002183000-memory.dmpFilesize
3.0MB
-
memory/1424-77-0x0000000000110000-0x000000000013D000-memory.dmpFilesize
180KB
-
memory/1424-75-0x0000000000000000-mapping.dmp
-
memory/1712-58-0x0000000000000000-mapping.dmp
-
memory/1736-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1736-73-0x0000000000130000-0x0000000000140000-memory.dmpFilesize
64KB
-
memory/1736-72-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1736-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1736-69-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1736-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1736-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1736-65-0x00000000004012B0-mapping.dmp
-
memory/1736-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB