Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 08:26
Static task
static1
Behavioral task
behavioral1
Sample
Quote List.exe
Resource
win7-20240221-en
General
-
Target
Quote List.exe
-
Size
958KB
-
MD5
e2c7999f00c70d031a43c537714f7b52
-
SHA1
66306e6916c8760cbf99fa57431f56d2faf41acf
-
SHA256
70029840a2c10f707e5b6bee6a48c4c7fb1fc3efe79215d7bb01c5e2967848cb
-
SHA512
8820e701b0cdd135e295059e3971404513f9895567e91f4988ed8e168feebf6c6e1b781bbe6684496db70272b2e86d18bd69c369ee93c4614bd5a00b8db9b116
-
SSDEEP
12288:QWET/mr9KL0dPVbYuEfa3cFuX59v1vWePcN9fS0TUo12M+trJHgEyjd2u5Bh:QWtO0J/mgco9Rq9q0QUOHGjs
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Quote List.exepowershell.exepid process 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 1948 Quote List.exe 2976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Quote List.exepowershell.exedescription pid process Token: SeDebugPrivilege 1948 Quote List.exe Token: SeDebugPrivilege 2976 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Quote List.exedescription pid process target process PID 1948 wrote to memory of 2976 1948 Quote List.exe powershell.exe PID 1948 wrote to memory of 2976 1948 Quote List.exe powershell.exe PID 1948 wrote to memory of 2976 1948 Quote List.exe powershell.exe PID 1948 wrote to memory of 2976 1948 Quote List.exe powershell.exe PID 1948 wrote to memory of 2564 1948 Quote List.exe schtasks.exe PID 1948 wrote to memory of 2564 1948 Quote List.exe schtasks.exe PID 1948 wrote to memory of 2564 1948 Quote List.exe schtasks.exe PID 1948 wrote to memory of 2564 1948 Quote List.exe schtasks.exe PID 1948 wrote to memory of 2424 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2424 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2424 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2424 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2768 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2768 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2768 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2768 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2540 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2540 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2540 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2540 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2584 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2584 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2584 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2584 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2692 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2692 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2692 1948 Quote List.exe Quote List.exe PID 1948 wrote to memory of 2692 1948 Quote List.exe Quote List.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mINGIl.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mINGIl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5BE6.tmp"2⤵
- Creates scheduled task(s)
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5BE6.tmpFilesize
1KB
MD5645f26cb7098d3544e3f32eec7fabbee
SHA148db0d6528404d182b4c2e40b12303cbd819b903
SHA2566a40d71121435f79833cb5a4ba7b7e69f9751bbb3724a9d6effa9f7a1f933d0f
SHA512dff43ba831325e67cc61a0f0becf0f4bc892fa84cad71f55f88c937403332846e898299c5fef5cf7f61389888e9484850019660c08afa619940f88434c8130a1
-
memory/1948-0-0x00000000745DE000-0x00000000745DF000-memory.dmpFilesize
4KB
-
memory/1948-1-0x0000000000340000-0x0000000000436000-memory.dmpFilesize
984KB
-
memory/1948-2-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/1948-3-0x0000000001FB0000-0x0000000001FD2000-memory.dmpFilesize
136KB
-
memory/1948-4-0x0000000001E30000-0x0000000001E3C000-memory.dmpFilesize
48KB
-
memory/1948-5-0x0000000001D40000-0x0000000001D50000-memory.dmpFilesize
64KB
-
memory/1948-6-0x000000000D320000-0x000000000D3DE000-memory.dmpFilesize
760KB
-
memory/1948-14-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB