Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 11:31
Static task
static1
Behavioral task
behavioral1
Sample
quotation.scr.exe
Resource
win7-20231215-en
General
-
Target
quotation.scr.exe
-
Size
295KB
-
MD5
38699281db788537bea1ce577eb81ea9
-
SHA1
39e11046b7c615a047875ca3a0eafd20d583d693
-
SHA256
9598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
-
SHA512
fd33f696fc92ed4d496088715dbc82ca7c67e3049b1855ca56c3576381677274cdd1d437ea98cb3774c5bef0106a2dbc984c97b8c680d243cee104c042357c3f
-
SSDEEP
6144:mfzUOcy4y9KPUapZTWJSij3SoiQxTwMdU8gP2iDeE/T1u/cO:ozUO99K1Wdj3STsTwWUtyE8/c
Malware Config
Extracted
nanocore
1.2.2.0
harold.jetos.com:6051
c21ee39c-274d-42dc-9878-9c010930f524
-
activate_away_mode
true
-
backup_connection_host
harold.jetos.com
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-11-05T15:38:42.943803836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6051
-
default_group
sales224
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c21ee39c-274d-42dc-9878-9c010930f524
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
harold.jetos.com
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4168 explorer.exe 4844 explorer.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1624 set thread context of 4636 1624 quotation.scr.exe 98 PID 4168 set thread context of 3160 4168 explorer.exe 114 PID 4844 set thread context of 2000 4844 explorer.exe 116 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1212 schtasks.exe 2920 schtasks.exe 2196 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4636 vbc.exe 4636 vbc.exe 4636 vbc.exe 4636 vbc.exe 4636 vbc.exe 4636 vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4636 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4636 vbc.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 4636 1624 quotation.scr.exe 98 PID 1624 wrote to memory of 2684 1624 quotation.scr.exe 104 PID 1624 wrote to memory of 2684 1624 quotation.scr.exe 104 PID 1624 wrote to memory of 2684 1624 quotation.scr.exe 104 PID 1624 wrote to memory of 3324 1624 quotation.scr.exe 103 PID 1624 wrote to memory of 3324 1624 quotation.scr.exe 103 PID 1624 wrote to memory of 3324 1624 quotation.scr.exe 103 PID 1624 wrote to memory of 3624 1624 quotation.scr.exe 102 PID 1624 wrote to memory of 3624 1624 quotation.scr.exe 102 PID 1624 wrote to memory of 3624 1624 quotation.scr.exe 102 PID 3324 wrote to memory of 1212 3324 cmd.exe 105 PID 3324 wrote to memory of 1212 3324 cmd.exe 105 PID 3324 wrote to memory of 1212 3324 cmd.exe 105 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 3160 4168 explorer.exe 114 PID 4168 wrote to memory of 4140 4168 explorer.exe 113 PID 4168 wrote to memory of 4140 4168 explorer.exe 113 PID 4168 wrote to memory of 4140 4168 explorer.exe 113 PID 4168 wrote to memory of 3724 4168 explorer.exe 112 PID 4168 wrote to memory of 3724 4168 explorer.exe 112 PID 4168 wrote to memory of 3724 4168 explorer.exe 112 PID 4168 wrote to memory of 1180 4168 explorer.exe 108 PID 4168 wrote to memory of 1180 4168 explorer.exe 108 PID 4168 wrote to memory of 1180 4168 explorer.exe 108 PID 3724 wrote to memory of 2920 3724 cmd.exe 109 PID 3724 wrote to memory of 2920 3724 cmd.exe 109 PID 3724 wrote to memory of 2920 3724 cmd.exe 109 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2000 4844 explorer.exe 116 PID 4844 wrote to memory of 2604 4844 explorer.exe 117 PID 4844 wrote to memory of 2604 4844 explorer.exe 117 PID 4844 wrote to memory of 2604 4844 explorer.exe 117 PID 4844 wrote to memory of 2204 4844 explorer.exe 118 PID 4844 wrote to memory of 2204 4844 explorer.exe 118 PID 4844 wrote to memory of 2204 4844 explorer.exe 118 PID 4844 wrote to memory of 1588 4844 explorer.exe 120 PID 4844 wrote to memory of 1588 4844 explorer.exe 120 PID 4844 wrote to memory of 1588 4844 explorer.exe 120 PID 2204 wrote to memory of 2196 2204 cmd.exe 123 PID 2204 wrote to memory of 2196 2204 cmd.exe 123 PID 2204 wrote to memory of 2196 2204 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe"C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\quotation.scr.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"2⤵PID:3624
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f3⤵
- Creates scheduled task(s)
PID:1212
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"2⤵PID:2684
-
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"2⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3724
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"2⤵PID:4140
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3160
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f1⤵
- Creates scheduled task(s)
PID:2920
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\explorer"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\explorer\explorer.exe'" /f3⤵
- Creates scheduled task(s)
PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe" "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe"2⤵PID:1588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612B
MD581ab0e59097e03cb04c32378024d6628
SHA1cc2a7a335f905e787906b6a0820acfbd4c5d0ed2
SHA256704dd8b8fb6dfccf43fd0712e36950102151fe7232d6602c53a42af967969533
SHA5123dd1374962c4d913ad6ec4207889abcca3e28946fa8937626bd2d13025a538e676bfc2efe76d27031d3f741bb3934104c0cf4e10da62758839add1fe543dfacb
-
Filesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
Filesize
295KB
MD538699281db788537bea1ce577eb81ea9
SHA139e11046b7c615a047875ca3a0eafd20d583d693
SHA2569598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
SHA512fd33f696fc92ed4d496088715dbc82ca7c67e3049b1855ca56c3576381677274cdd1d437ea98cb3774c5bef0106a2dbc984c97b8c680d243cee104c042357c3f