Analysis

  • max time kernel
    4s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 12:54

General

  • Target

    QUOTATION REQUIRD.exe

  • Size

    39KB

  • MD5

    a08fc570175654538ef118d911b16436

  • SHA1

    2712e7784d75d4746032e825eca8abc0a8306245

  • SHA256

    013cfd5a41b2ad509d642e132c4eee49ed5a19418b7ff77523a9965a08afa008

  • SHA512

    5b0aced9b7a7a1c82195b178a55351ba51ced19052e7fa1f837055e5c2b763d8ab00ff420206a65541cd6b9568d8baa954fe457b019402edf5921e6e3b39848d

  • SSDEEP

    768:iRXnmQnpZJE8sNd9LnZVxSy9eg1W6T+v5q:QhnpZJEj39DNSy9rdCvU

Score
9/10

Malware Config

Signatures

  • Contacts a large (2114) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUIRD.exe
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUIRD.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4356

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4356-0-0x00000150E8080000-0x00000150E808E000-memory.dmp

          Filesize

          56KB

        • memory/4356-1-0x00007FFF2A160000-0x00007FFF2AC21000-memory.dmp

          Filesize

          10.8MB

        • memory/4356-2-0x00000150E9F20000-0x00000150E9F30000-memory.dmp

          Filesize

          64KB