Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:40
Static task
static1
Behavioral task
behavioral1
Sample
quotation.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
quotation.exe
Resource
win10v2004-20240508-en
General
-
Target
quotation.exe
-
Size
925KB
-
MD5
45cc1bf65d887b4899f7c212b271e578
-
SHA1
95091ef8a659d6dbde4119cf45d8bc7600be35bd
-
SHA256
9d3e2f47c9e19eb3dd2ad6ff1b00ae5e7b429c4c997268a42b3f75c6d448090a
-
SHA512
aaeecd5fc1c395de750be26a62eac4c993d54da38ee6210c03c113fb33ae91b8e6cd3088e5101d54fdbe2708ca4fc479cf0956979622aebfe2cc71fce22bc326
-
SSDEEP
12288:vLdUcmDiSGP31lk463i3tINrHtkvT3Op44ZOloWvOkR:vLdeiNS4Oi9IN3p7OloWvV
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
quotation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation quotation.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
quotation.exeRegSvcs.exeiexpress.exedescription pid process target process PID 1436 set thread context of 4988 1436 quotation.exe RegSvcs.exe PID 4988 set thread context of 3460 4988 RegSvcs.exe Explorer.EXE PID 4988 set thread context of 1036 4988 RegSvcs.exe iexpress.exe PID 1036 set thread context of 3460 1036 iexpress.exe Explorer.EXE PID 1036 set thread context of 1664 1036 iexpress.exe Firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexpress.exedescription ioc process Key created \Registry\User\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 iexpress.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
quotation.exepowershell.exeRegSvcs.exeiexpress.exepid process 1436 quotation.exe 1436 quotation.exe 1436 quotation.exe 1436 quotation.exe 1436 quotation.exe 1436 quotation.exe 5012 powershell.exe 5012 powershell.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 4988 RegSvcs.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exeExplorer.EXEiexpress.exepid process 4988 RegSvcs.exe 3460 Explorer.EXE 3460 Explorer.EXE 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe 1036 iexpress.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
quotation.exepowershell.exedescription pid process Token: SeDebugPrivilege 1436 quotation.exe Token: SeDebugPrivilege 5012 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
quotation.exeExplorer.EXEiexpress.exedescription pid process target process PID 1436 wrote to memory of 5012 1436 quotation.exe powershell.exe PID 1436 wrote to memory of 5012 1436 quotation.exe powershell.exe PID 1436 wrote to memory of 5012 1436 quotation.exe powershell.exe PID 1436 wrote to memory of 4884 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4884 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4884 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 2372 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 2372 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 2372 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 1436 wrote to memory of 4988 1436 quotation.exe RegSvcs.exe PID 3460 wrote to memory of 1036 3460 Explorer.EXE iexpress.exe PID 3460 wrote to memory of 1036 3460 Explorer.EXE iexpress.exe PID 3460 wrote to memory of 1036 3460 Explorer.EXE iexpress.exe PID 1036 wrote to memory of 1664 1036 iexpress.exe Firefox.exe PID 1036 wrote to memory of 1664 1036 iexpress.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\quotation.exe"C:\Users\Admin\AppData\Local\Temp\quotation.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\quotation.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\iexpress.exe"C:\Windows\SysWOW64\iexpress.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gvsircb.uxz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1036-66-0x0000000001080000-0x00000000010BF000-memory.dmpFilesize
252KB
-
memory/1036-70-0x0000000001080000-0x00000000010BF000-memory.dmpFilesize
252KB
-
memory/1036-72-0x0000000001080000-0x00000000010BF000-memory.dmpFilesize
252KB
-
memory/1036-67-0x0000000001080000-0x00000000010BF000-memory.dmpFilesize
252KB
-
memory/1436-8-0x0000000006520000-0x00000000065AA000-memory.dmpFilesize
552KB
-
memory/1436-4-0x0000000004B50000-0x0000000004B5A000-memory.dmpFilesize
40KB
-
memory/1436-7-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1436-2-0x0000000005130000-0x00000000056D4000-memory.dmpFilesize
5.6MB
-
memory/1436-9-0x0000000008BE0000-0x0000000008C7C000-memory.dmpFilesize
624KB
-
memory/1436-16-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/1436-6-0x0000000004DF0000-0x0000000004E0A000-memory.dmpFilesize
104KB
-
memory/1436-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmpFilesize
4KB
-
memory/1436-3-0x0000000004B80000-0x0000000004C12000-memory.dmpFilesize
584KB
-
memory/1436-5-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/1436-1-0x0000000000070000-0x000000000015A000-memory.dmpFilesize
936KB
-
memory/1664-80-0x0000024EF8630000-0x0000024EF8707000-memory.dmpFilesize
860KB
-
memory/3460-65-0x000000000C6C0000-0x000000000CE9C000-memory.dmpFilesize
7.9MB
-
memory/3460-71-0x000000000C6C0000-0x000000000CE9C000-memory.dmpFilesize
7.9MB
-
memory/3460-73-0x0000000002CC0000-0x0000000002DB3000-memory.dmpFilesize
972KB
-
memory/4988-68-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4988-69-0x0000000000BA0000-0x0000000000BBF000-memory.dmpFilesize
124KB
-
memory/4988-61-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4988-53-0x0000000001180000-0x00000000014CA000-memory.dmpFilesize
3.3MB
-
memory/4988-64-0x0000000000BA0000-0x0000000000BBF000-memory.dmpFilesize
124KB
-
memory/4988-63-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4988-62-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4988-10-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/5012-34-0x0000000071680000-0x00000000716CC000-memory.dmpFilesize
304KB
-
memory/5012-47-0x0000000007520000-0x00000000075C3000-memory.dmpFilesize
652KB
-
memory/5012-49-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/5012-48-0x0000000007EA0000-0x000000000851A000-memory.dmpFilesize
6.5MB
-
memory/5012-50-0x00000000078C0000-0x00000000078CA000-memory.dmpFilesize
40KB
-
memory/5012-51-0x0000000007AD0000-0x0000000007B66000-memory.dmpFilesize
600KB
-
memory/5012-52-0x0000000007A50000-0x0000000007A61000-memory.dmpFilesize
68KB
-
memory/5012-46-0x0000000006B50000-0x0000000006B6E000-memory.dmpFilesize
120KB
-
memory/5012-54-0x0000000007A80000-0x0000000007A8E000-memory.dmpFilesize
56KB
-
memory/5012-55-0x0000000007A90000-0x0000000007AA4000-memory.dmpFilesize
80KB
-
memory/5012-56-0x0000000007B90000-0x0000000007BAA000-memory.dmpFilesize
104KB
-
memory/5012-57-0x0000000007B70000-0x0000000007B78000-memory.dmpFilesize
32KB
-
memory/5012-60-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/5012-33-0x0000000006AF0000-0x0000000006B22000-memory.dmpFilesize
200KB
-
memory/5012-45-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/5012-44-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/5012-31-0x0000000006530000-0x000000000654E000-memory.dmpFilesize
120KB
-
memory/5012-32-0x00000000065C0000-0x000000000660C000-memory.dmpFilesize
304KB
-
memory/5012-26-0x0000000005F20000-0x0000000006274000-memory.dmpFilesize
3.3MB
-
memory/5012-20-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/5012-19-0x00000000055F0000-0x0000000005656000-memory.dmpFilesize
408KB
-
memory/5012-18-0x0000000005550000-0x0000000005572000-memory.dmpFilesize
136KB
-
memory/5012-17-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/5012-14-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/5012-15-0x0000000074DCE000-0x0000000074DCF000-memory.dmpFilesize
4KB
-
memory/5012-12-0x0000000002C00000-0x0000000002C36000-memory.dmpFilesize
216KB
-
memory/5012-13-0x0000000005770000-0x0000000005D98000-memory.dmpFilesize
6.2MB