Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
17/07/2023, 13:04
General
-
Target
QUOTATION_JUL7FIBA00541·PDF.scr.exe
-
Size
77KB
-
MD5
cbda8cb8fd16a2172972e8fa81cc11a8
-
SHA1
9fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
-
SHA256
7cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
-
SHA512
3b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
SSDEEP
1536:N5wInQOcC+rhr+KoYlU88VGzm2v9cbpAQlTlBcUu1Vm1fR4:PwRrA88VGl9YpAQlTlBAC1fR4
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUL7FIBA00541·PDF.scr.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUL7FIBA00541·PDF.scr.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7947.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD5eabb9e4b8d9dd6c1e7f002aa66194ce0
SHA1e41d4a645a7defd8f8b99c672a79e4da9bcb8123
SHA256679ca2a2f7b3252c4c3822f8f6591560245923d25ea1b67ee79da00bb6dd03bb
SHA512678d0cf395224b19a3efa783e7963fc9a1038dbf755e668f2ead25437a8283f4c52bc9a2bd3113925b315e74fda9f72a5f70a61449d89d7317698dff01878321
-
Filesize
77KB
MD5cbda8cb8fd16a2172972e8fa81cc11a8
SHA19fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
SHA2567cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
SHA5123b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
Filesize
77KB
MD5cbda8cb8fd16a2172972e8fa81cc11a8
SHA19fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
SHA2567cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
SHA5123b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB