Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
17/07/2023, 13:35
General
-
Target
QUOTATION_JUL7FIBA00541·PDF.scr
-
Size
77KB
-
MD5
cbda8cb8fd16a2172972e8fa81cc11a8
-
SHA1
9fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
-
SHA256
7cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
-
SHA512
3b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
SSDEEP
1536:N5wInQOcC+rhr+KoYlU88VGzm2v9cbpAQlTlBcUu1Vm1fR4:PwRrA88VGl9YpAQlTlBAC1fR4
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUL7FIBA00541·PDF.scr"C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUL7FIBA00541·PDF.scr" /S1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8925.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD586a0b5e42041979cd49486499c53f6ca
SHA104d5078f8d1656b7b50fa5fb44de6d18b9c66521
SHA256008639a77a4a397f197f4b3ed79a44f9126ac283f68776d98eab04b731958df1
SHA5128b642efa21fbccae03ff5061efd672e2c458fac8f5c8db8ab864508e6d3c4662a502fa5f0103e0330f18d3722a62fa292cbc00c0c10486c99ba234d3b9e34940
-
Filesize
77KB
MD5cbda8cb8fd16a2172972e8fa81cc11a8
SHA19fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
SHA2567cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
SHA5123b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
Filesize
77KB
MD5cbda8cb8fd16a2172972e8fa81cc11a8
SHA19fbe855f5a322c4848ed6f0d02a0b7e7be3d52dd
SHA2567cadda6850c04813046afddaea278ff58b38dc49bc8e10f121560580c9eae27a
SHA5123b53a255c67e8edcd1f73d84adb7c4c7c6f13e0f9387655cc4806ca493e0c87f07b32520e89692050f1aefcb79f79252e095cc532b8fd5e7e20b5c004a8fbff7
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB