Overview

overview

9

Static

static

1

Quotation ...on.exe

windows7-x64

1

Quotation ...on.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    ebc60281e6f45c77af894189faa81b3a2d106044ff7d7ee28188d05bedfb5a3f.rar

  • Size

    27KB

  • Sample

    240228-vqlngahe2y

  • MD5

    2d6b264ab7c82f62fad61cbf0be6f3ca

  • SHA1

    7d20db34c1cf0fe45bfa0002794ef398a5e3a942

  • SHA256

    ebc60281e6f45c77af894189faa81b3a2d106044ff7d7ee28188d05bedfb5a3f

  • SHA512

    1cbb9897c2425402977d45a0cbe91c5061902a85a889ffc48c623f146b0cd934afb3ea56f04647e989695230821e1bcaa7bc9a934eb7097dd469fd06dc44b6b3

  • SSDEEP

    384:CdPYvFkIUl3OXx1B0p0vwUyZsTM79l9kBvDB3I6uo4zhz25HHsoUN3LAsIzS/uPe:gYvF23QP8qo9lKBvF3qb+soyuzSGVE

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      Quotation Drawing Specification.exe

    • Size

      62KB

    • MD5

      423c9605819245613a03f421d29bc24d

    • SHA1

      a913786f724a2d69a676a8b821b9f8cdb5bc9cbc

    • SHA256

      c64d2c1dcf51a5c9b9a52eed01e210f0e7c18a4afa42c26e59d852932d603834

    • SHA512

      c98cbd222069562f8c79cddb11424c413a97cce8b8d7d80666ee4e2a8ae2cfa48b4ddb7fb81e59e056b2e11f65a7d20674afd37fb365eaf0ed947cfa4028e534

    • SSDEEP

      768:7kgKgaBMfz0PuHcBkgQap6QdzpEm/xrbWUp5P8MF17TxfHIIIWyEFiRc:KuHcBkgnpdd6mp/pak7TxfHIIIWyei2

    Score
    9/10
    discoveryevasionpersistence

    • Contacts a large (4693) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Detects executables packed with or use KoiVM

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks