Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 11:31
Static task
static1
Behavioral task
behavioral1
Sample
quotation.scr.exe
Resource
win7-20231215-en
General
-
Target
quotation.scr.exe
-
Size
295KB
-
MD5
38699281db788537bea1ce577eb81ea9
-
SHA1
39e11046b7c615a047875ca3a0eafd20d583d693
-
SHA256
9598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
-
SHA512
fd33f696fc92ed4d496088715dbc82ca7c67e3049b1855ca56c3576381677274cdd1d437ea98cb3774c5bef0106a2dbc984c97b8c680d243cee104c042357c3f
-
SSDEEP
6144:mfzUOcy4y9KPUapZTWJSij3SoiQxTwMdU8gP2iDeE/T1u/cO:ozUO99K1Wdj3STsTwWUtyE8/c
Malware Config
Extracted
nanocore
1.2.2.0
harold.jetos.com:6051
c21ee39c-274d-42dc-9878-9c010930f524
-
activate_away_mode
true
-
backup_connection_host
harold.jetos.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-11-05T15:38:42.943803836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6051
-
default_group
sales224
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c21ee39c-274d-42dc-9878-9c010930f524
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
harold.jetos.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2520 explorer.exe 2832 explorer.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1732 set thread context of 2720 1732 quotation.scr.exe 28 PID 2520 set thread context of 796 2520 explorer.exe 40 PID 2832 set thread context of 1616 2832 explorer.exe 49 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2804 schtasks.exe 2996 schtasks.exe 980 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2720 vbc.exe 2720 vbc.exe 2720 vbc.exe 2720 vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2720 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2720 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2720 1732 quotation.scr.exe 28 PID 1732 wrote to memory of 2696 1732 quotation.scr.exe 29 PID 1732 wrote to memory of 2696 1732 quotation.scr.exe 29 PID 1732 wrote to memory of 2696 1732 quotation.scr.exe 29 PID 1732 wrote to memory of 2696 1732 quotation.scr.exe 29 PID 1732 wrote to memory of 2596 1732 quotation.scr.exe 30 PID 1732 wrote to memory of 2596 1732 quotation.scr.exe 30 PID 1732 wrote to memory of 2596 1732 quotation.scr.exe 30 PID 1732 wrote to memory of 2596 1732 quotation.scr.exe 30 PID 1732 wrote to memory of 3008 1732 quotation.scr.exe 34 PID 1732 wrote to memory of 3008 1732 quotation.scr.exe 34 PID 1732 wrote to memory of 3008 1732 quotation.scr.exe 34 PID 1732 wrote to memory of 3008 1732 quotation.scr.exe 34 PID 2596 wrote to memory of 2804 2596 cmd.exe 31 PID 2596 wrote to memory of 2804 2596 cmd.exe 31 PID 2596 wrote to memory of 2804 2596 cmd.exe 31 PID 2596 wrote to memory of 2804 2596 cmd.exe 31 PID 2824 wrote to memory of 2520 2824 taskeng.exe 39 PID 2824 wrote to memory of 2520 2824 taskeng.exe 39 PID 2824 wrote to memory of 2520 2824 taskeng.exe 39 PID 2824 wrote to memory of 2520 2824 taskeng.exe 39 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 796 2520 explorer.exe 40 PID 2520 wrote to memory of 1480 2520 explorer.exe 41 PID 2520 wrote to memory of 1480 2520 explorer.exe 41 PID 2520 wrote to memory of 1480 2520 explorer.exe 41 PID 2520 wrote to memory of 1480 2520 explorer.exe 41 PID 2520 wrote to memory of 1356 2520 explorer.exe 42 PID 2520 wrote to memory of 1356 2520 explorer.exe 42 PID 2520 wrote to memory of 1356 2520 explorer.exe 42 PID 2520 wrote to memory of 1356 2520 explorer.exe 42 PID 2520 wrote to memory of 2140 2520 explorer.exe 43 PID 2520 wrote to memory of 2140 2520 explorer.exe 43 PID 2520 wrote to memory of 2140 2520 explorer.exe 43 PID 2520 wrote to memory of 2140 2520 explorer.exe 43 PID 1356 wrote to memory of 2996 1356 cmd.exe 47 PID 1356 wrote to memory of 2996 1356 cmd.exe 47 PID 1356 wrote to memory of 2996 1356 cmd.exe 47 PID 1356 wrote to memory of 2996 1356 cmd.exe 47 PID 2824 wrote to memory of 2832 2824 taskeng.exe 48 PID 2824 wrote to memory of 2832 2824 taskeng.exe 48 PID 2824 wrote to memory of 2832 2824 taskeng.exe 48 PID 2824 wrote to memory of 2832 2824 taskeng.exe 48 PID 2832 wrote to memory of 1616 2832 explorer.exe 49 PID 2832 wrote to memory of 1616 2832 explorer.exe 49 PID 2832 wrote to memory of 1616 2832 explorer.exe 49 PID 2832 wrote to memory of 1616 2832 explorer.exe 49 PID 2832 wrote to memory of 1616 2832 explorer.exe 49 PID 2832 wrote to memory of 1616 2832 explorer.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe"C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"2⤵PID:2696
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f3⤵
- Creates scheduled task(s)
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"2⤵PID:3008
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A7887890-7BE2-4BC9-956D-B9F974D89F28} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:796
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"3⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f4⤵
- Creates scheduled task(s)
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"3⤵PID:2140
-
-
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"3⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f3⤵PID:1660
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f4⤵
- Creates scheduled task(s)
PID:980
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"3⤵PID:1032
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD538699281db788537bea1ce577eb81ea9
SHA139e11046b7c615a047875ca3a0eafd20d583d693
SHA2569598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
SHA512fd33f696fc92ed4d496088715dbc82ca7c67e3049b1855ca56c3576381677274cdd1d437ea98cb3774c5bef0106a2dbc984c97b8c680d243cee104c042357c3f