4c988891326eea9e5fe8aeaa93ffb3f7001bd3cda048a72ab24c8b54dd1834e4

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2022, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
Size 918KB
Sample221209-w1f2eadg28
SHA256 4c988891326eea9e5fe8aeaa93ffb3f7001bd3cda048a72ab24c8b54dd1834e4
MD5 2a48228a37fe7bf1cf3f147d07884e30
SHA1 bb6a32c77ceb6d5b2c32731b0109c177c7aa6d96
SHA512 30699f8bc5982e40c3e9e52476b3b96f11ef85cb711c4beece38eba91646f870d0cb92a024adccd6ff4015e18a5a7d20863db0f48e2a295caa088a3a2ba8bf30
SSDEEP 24576:eijfgpFKJM3kEirzajXBJnORbhVjSFoSF4:eSK3Ore7bnAbhVjSFr4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3260	vkl.exe
5028	vkl.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	vkl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-MYD1QO = "\"C:\\Program Files (x86)\\vkl.exe\""	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	vkl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VKL-MYD1QO = "\"C:\\Program Files (x86)\\vkl.exe\""	vkl.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3436 set thread context of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3260 set thread context of 5028	3260	vkl.exe	102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\log.txt	vkl.exe
File created	C:\Program Files (x86)\vkl.exe	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
File opened for modification	C:\Program Files (x86)\vkl.exe	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
File opened for modification	C:\Program Files (x86)\Screenshots	vkl.exe
File opened for modification	C:\Program Files (x86)\Screenshots\time_2022.12.09_18.25.09.png	vkl.exe
File opened for modification	C:\Program Files (x86)\log.txt	vkl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2884	schtasks.exe
4036	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
1948	powershell.exe
1948	powershell.exe
3260	vkl.exe
3260	vkl.exe
3260	vkl.exe
3260	vkl.exe
3260	vkl.exe
3260	vkl.exe
3380	powershell.exe
3260	vkl.exe
3380	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	3260	vkl.exe
Token: SeDebugPrivilege	3380	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5028	vkl.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1948	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	89
PID 3436 wrote to memory of 1948	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	89
PID 3436 wrote to memory of 1948	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	89
PID 3436 wrote to memory of 2884	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	91
PID 3436 wrote to memory of 2884	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	91
PID 3436 wrote to memory of 2884	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	91
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 3436 wrote to memory of 2864	3436	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	93
PID 2864 wrote to memory of 3156	2864	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	94
PID 2864 wrote to memory of 3156	2864	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	94
PID 2864 wrote to memory of 3156	2864	REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe	94
PID 3156 wrote to memory of 2448	3156	WScript.exe	95
PID 3156 wrote to memory of 2448	3156	WScript.exe	95
PID 3156 wrote to memory of 2448	3156	WScript.exe	95
PID 2448 wrote to memory of 3260	2448	cmd.exe	97
PID 2448 wrote to memory of 3260	2448	cmd.exe	97
PID 2448 wrote to memory of 3260	2448	cmd.exe	97
PID 3260 wrote to memory of 3380	3260	vkl.exe	98
PID 3260 wrote to memory of 3380	3260	vkl.exe	98
PID 3260 wrote to memory of 3380	3260	vkl.exe	98
PID 3260 wrote to memory of 4036	3260	vkl.exe	100
PID 3260 wrote to memory of 4036	3260	vkl.exe	100
PID 3260 wrote to memory of 4036	3260	vkl.exe	100
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102
PID 3260 wrote to memory of 5028	3260	vkl.exe	102

C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FblUSm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FblUSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA066.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe
  "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION_NEW ORDER URGENTLY NEEDED.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\vkl.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Program Files (x86)\vkl.exe
        
        "C:\Program Files (x86)\vkl.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3260
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FblUSm.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3380
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FblUSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6AEA.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:4036
      - C:\Program Files (x86)\vkl.exe
        
        "C:\Program Files (x86)\vkl.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vkl.exe

Path C:\Program Files (x86)\vkl.exe
Size 918KB
SHA256 4c988891326eea9e5fe8aeaa93ffb3f7001bd3cda048a72ab24c8b54dd1834e4
MD5 2a48228a37fe7bf1cf3f147d07884e30
SHA1 bb6a32c77ceb6d5b2c32731b0109c177c7aa6d96
SHA512 30699f8bc5982e40c3e9e52476b3b96f11ef85cb711c4beece38eba91646f870d0cb92a024adccd6ff4015e18a5a7d20863db0f48e2a295caa088a3a2ba8bf30
SSDEEP 24576:eijfgpFKJM3kEirzajXBJnORbhVjSFoSF4:eSK3Ore7bnAbhVjSFr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkl.exe

Path C:\Program Files (x86)\vkl.exe
Size 918KB
SHA256 4c988891326eea9e5fe8aeaa93ffb3f7001bd3cda048a72ab24c8b54dd1834e4
MD5 2a48228a37fe7bf1cf3f147d07884e30
SHA1 bb6a32c77ceb6d5b2c32731b0109c177c7aa6d96
SHA512 30699f8bc5982e40c3e9e52476b3b96f11ef85cb711c4beece38eba91646f870d0cb92a024adccd6ff4015e18a5a7d20863db0f48e2a295caa088a3a2ba8bf30
SSDEEP 24576:eijfgpFKJM3kEirzajXBJnORbhVjSFoSF4:eSK3Ore7bnAbhVjSFr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkl.exe

Path C:\Program Files (x86)\vkl.exe
Size 918KB
SHA256 4c988891326eea9e5fe8aeaa93ffb3f7001bd3cda048a72ab24c8b54dd1834e4
MD5 2a48228a37fe7bf1cf3f147d07884e30
SHA1 bb6a32c77ceb6d5b2c32731b0109c177c7aa6d96
SHA512 30699f8bc5982e40c3e9e52476b3b96f11ef85cb711c4beece38eba91646f870d0cb92a024adccd6ff4015e18a5a7d20863db0f48e2a295caa088a3a2ba8bf30
SSDEEP 24576:eijfgpFKJM3kEirzajXBJnORbhVjSFoSF4:eSK3Ore7bnAbhVjSFr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0bf0a3165bafebc39b2286c357d576db00e7b0c1fcdb81d70a513a79ac0cf615
MD5 5cb15589f2d6f3051b09f6a54813b7fa
SHA1 7bec4836cde95a450ff97c67681676672e008cd5
SHA512 221b6db1881975b4e3fd8310926ccc5ab7d9b8d3c31050ce8e7bd99cfc8e994ed91193ccd438ad7e5848db62c30a1b719251a565181a6b934367cbc1f1234384
SSDEEP 384:psf+Bh9i+Iz1yT05zJkCDo9oViTVK6seYLME/B03SoZ2fYSggjEDk+Q0gdotkKhD:efXz1xeC0okTVNgrqSBWeEDDCK3
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 382B
SHA256 d002bab0115b6e6b14afcc42fbb70245827651e6fc0850dd4473fbe5bd737edf
MD5 b9a41fbe2abb9d375cfd1a276fcce1a4
SHA1 22459b02ac9221287ce93e823dbdc2344c2cd02d
SHA512 fa4ef885ac4a67878cf929f387ea7952f94870b2f6d83a4cab9743e571f83423d5fece1d8a1ad2e1096c091cbbf7b781a380538f9335285a1bfcc4a230add7d2
MD5 SHA1 SHA512

Submit Download

tmp6AEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6AEA.tmp
Size 1KB
SHA256 c5a72a50ac3ae8bba368656691f003e067149f5ab0b933255183b5f43b2f1f4e
MD5 63e36e1c832ee982af481cb3f0fb8a71
SHA1 e4ffe713be7deb7450ee5770812ba180c5ab2e02
SHA512 ae70067d8da083dd7b47b4ff6f71790394e04a972fca9b25ec4186497a91eb9d5e4055c80f14480c6e4ddfd8217bd46f3d52c41e10b492008f5d42bba1d2bc49
MD5 SHA1 SHA512

Submit Download

tmpA066.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA066.tmp
Size 1KB
SHA256 c5a72a50ac3ae8bba368656691f003e067149f5ab0b933255183b5f43b2f1f4e
MD5 63e36e1c832ee982af481cb3f0fb8a71
SHA1 e4ffe713be7deb7450ee5770812ba180c5ab2e02
SHA512 ae70067d8da083dd7b47b4ff6f71790394e04a972fca9b25ec4186497a91eb9d5e4055c80f14480c6e4ddfd8217bd46f3d52c41e10b492008f5d42bba1d2bc49
MD5 SHA1 SHA512

Submit Download

memory/1948-165-0x0000000007F10000-0x0000000007FA6000-memory.dmp

Download

memory/1948-163-0x0000000007C90000-0x0000000007CAA000-memory.dmp

Download

memory/1948-167-0x0000000007FD0000-0x0000000007FEA000-memory.dmp

Download

memory/1948-166-0x0000000007EC0000-0x0000000007ECE000-memory.dmp

Download

memory/1948-159-0x0000000006F60000-0x0000000006F92000-memory.dmp

Download

memory/1948-145-0x0000000005BB0000-0x0000000005BD2000-memory.dmp

Download

memory/1948-164-0x0000000007D00000-0x0000000007D0A000-memory.dmp

Download

memory/1948-149-0x0000000006370000-0x00000000063D6000-memory.dmp

Download

memory/1948-148-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Download

memory/1948-141-0x0000000005D40000-0x0000000006368000-memory.dmp

Download

memory/1948-162-0x00000000082D0000-0x000000000894A000-memory.dmp

Download

memory/1948-161-0x0000000006F40000-0x0000000006F5E000-memory.dmp

Download

memory/1948-139-0x0000000003070000-0x00000000030A6000-memory.dmp

Download

memory/1948-154-0x0000000006990000-0x00000000069AE000-memory.dmp

Download

memory/1948-160-0x00000000711C0000-0x000000007120C000-memory.dmp

Download

memory/1948-168-0x0000000007FB0000-0x0000000007FB8000-memory.dmp

Download

memory/2864-146-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2864-143-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2864-152-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2864-150-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2864-147-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3380-181-0x0000000070F80000-0x0000000070FCC000-memory.dmp

Download

memory/3436-132-0x00000000003C0000-0x00000000004AC000-memory.dmp

Download

memory/3436-133-0x0000000005370000-0x0000000005914000-memory.dmp

Download

memory/3436-136-0x000000000AF40000-0x000000000AFDC000-memory.dmp

Download

memory/3436-135-0x0000000004E40000-0x0000000004E4A000-memory.dmp

Download

memory/3436-134-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Download

memory/5028-178-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5028-177-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5028-180-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5028-182-0x0000000000400000-0x0000000000435000-memory.dmp

Download