bba2e071694f069d2a4fa10ca22bdf180943153b2421bd7a41de28394e6e1335

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REQUEST FOR QUOTATION - CNCE7 1006-23.exe
Size

1.3MB
MD5

d70190c4b581dfeb624e567a0f02cf7c
SHA1

c67c057ec7d52c1a6e4c8f2b51a48974a90f0f8a
SHA256

bba2e071694f069d2a4fa10ca22bdf180943153b2421bd7a41de28394e6e1335
SHA512

d7dafd7d34b88448a5a5108611de7378046e2fa3d199544fb081e2e7740922477ac1657e9c167c7d4a105587e32163698939f0bf32afe173f4cd33b68990cf28
SSDEEP

24576:9seebI3gFtjpEcyP8KG/dwL4IFHArHKOpDf5qA5z+t:C9FtjpE8Kie4I6JpjMG+t

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe
2740	REQUEST FOR QUOTATION - CNCE7 1006-23.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29
PID 1964 wrote to memory of 2740	1964	REQUEST FOR QUOTATION - CNCE7 1006-23.exe	29

C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION - CNCE7 1006-23.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION - CNCE7 1006-23.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION - CNCE7 1006-23.exe
  "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION - CNCE7 1006-23.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi4896.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
memory/1964-13-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/1964-14-0x0000000076FB0000-0x0000000077086000-memory.dmp

Filesize
856KB

Download
memory/1964-15-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2740-16-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download
memory/2740-17-0x0000000072340000-0x00000000733A2000-memory.dmp

Filesize
16.4MB

Download
memory/2740-18-0x0000000076DC0000-0x0000000076F69000-memory.dmp

Filesize
1.7MB

Download