6674b1e2edc04c5ef7fbb935bbf79564a31304a3c38d1e2afca673c95f8c3e62

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 05:14 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order Quotation.exe
Size

328KB
MD5

8933001b2016741520a7b3634bbee9b5
SHA1

872b493fbfcbfc53399a59fde354200e68988a66
SHA256

f35af82ca51d0a71780cfd0a71b6353e57b11f97d8a56615058dd512df91f1f2
SHA512

7ef44942a4b9d1160c170d7d6db49028a3c33bfcea4b1ae2288711b0bec91f20d2b3172635041d9624ef25c6cf5875a48ec2ad6f5e2fe48179731797b436421b
SSDEEP

6144:mYa6m2DqJ7qQ//AZjTa/bVd6zeWpmivMXYMikvPXCQLkIS3:mYIBqQg9aBMzXpmUM7qQLp6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2220	Order Quotation.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2552	2220	Order Quotation.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe
2552	Order Quotation.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2220	Order Quotation.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	Order Quotation.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2552	2220	Order Quotation.exe	28
PID 2220 wrote to memory of 2552	2220	Order Quotation.exe	28
PID 2220 wrote to memory of 2552	2220	Order Quotation.exe	28
PID 2220 wrote to memory of 2552	2220	Order Quotation.exe	28
PID 2220 wrote to memory of 2552	2220	Order Quotation.exe	28

C:\Users\Admin\AppData\Local\Temp\Order Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Order Quotation.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\Order Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Order Quotation.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstAC77.tmp\snbns.dll

Filesize
75KB

MD5
ed89bb6f338887301b62ecb7b4d5aa58

SHA1
7b8950568af0cc234d06f1573dde8fc87331344d

SHA256
e6a3e946896a6389c7b771fd6094527b6f14784aad3820b31ca7f7145b95220d

SHA512
353d2754e8b25fcbb9c4abcd1f25e69184d8bd0abb3d6dfcbd366b486c27ba2fcdb56acf5f4fd1d2e7db0e4ff36152a8b6507028dff30b062ea39155e6046870

Download Submit
\Users\Admin\AppData\Local\Temp\nstAC77.tmp\snbns.dll

Filesize
75KB

MD5
ed89bb6f338887301b62ecb7b4d5aa58

SHA1
7b8950568af0cc234d06f1573dde8fc87331344d

SHA256
e6a3e946896a6389c7b771fd6094527b6f14784aad3820b31ca7f7145b95220d

SHA512
353d2754e8b25fcbb9c4abcd1f25e69184d8bd0abb3d6dfcbd366b486c27ba2fcdb56acf5f4fd1d2e7db0e4ff36152a8b6507028dff30b062ea39155e6046870

Download Submit
memory/2220-60-0x0000000001EA0000-0x0000000001EA2000-memory.dmp

Filesize
8KB

Download
memory/2552-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2552-62-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/2552-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2552-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download