Overview

overview

9

Static

static

3

QUOTATION_...cr.exe

windows7-x64

9

QUOTATION_...cr.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION_JUL7FIBA00541·PDF.scr.exe

  • Size

    77KB

  • Sample

    230717-qaxzcacf91

  • MD5

    cbda8cb8fd16a2172972e8fa81cc11a8

  • SHA1

    9fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd

  • SHA256

    7cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a

  • SHA512

    3b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7

  • SSDEEP

    1536:N5wInQOcC+rhr+KoYlU88VGzm2v9cbpAQlTlBcUu1Vm1fR4:PwRrA88VGl9YpAQlTlBAC1fR4

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      QUOTATION_JUL7FIBA00541·PDF.scr.exe

    • Size

      77KB

    • MD5

      cbda8cb8fd16a2172972e8fa81cc11a8

    • SHA1

      9fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd

    • SHA256

      7cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a

    • SHA512

      3b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7

    • SSDEEP

      1536:N5wInQOcC+rhr+KoYlU88VGzm2v9cbpAQlTlBcUu1Vm1fR4:PwRrA88VGl9YpAQlTlBAC1fR4

    Score
    9/10
    evasionpersistence

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks