82eda530a922eedffda8d9d2b65d038ec7ca24029f242ad7c0e3cb429dc34538

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION#00343.exe
Size

1.8MB
MD5

1a42e34e1407e57bc06a09770a1c99c6
SHA1

dfb921a51dffb15f1b65dd303d25ebe9ee8f2057
SHA256

82eda530a922eedffda8d9d2b65d038ec7ca24029f242ad7c0e3cb429dc34538
SHA512

b56ea90940e2a1b67bc1b7ca05efa444a73d2ff5d136c84efec58d5b3e3714dd9a3450eaac3414e356bcb0405339c314d6d3d6d6efc6b3408ae1ee506dd59d5c
SSDEEP

49152:Wtf/Bn8MKtyNonstk42uf5xJtiuRlSW2K0KFLBJ:CDKoCok4Lf5Pt5SW2K0KlP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2952-10-0x0000000000400000-0x000000000054B000-memory.dmp	autoit_exe
behavioral1/memory/2952-8-0x0000000000400000-0x000000000054B000-memory.dmp	autoit_exe
behavioral1/memory/2952-12-0x0000000000400000-0x000000000054B000-memory.dmp	autoit_exe
behavioral1/memory/2580-24-0x0000000000400000-0x000000000054B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 2580	1968	QUOTATION#00343.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	QUOTATION#00343.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2952	1968	QUOTATION#00343.exe	28
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2488	1968	QUOTATION#00343.exe	29
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2580	1968	QUOTATION#00343.exe	30
PID 1968 wrote to memory of 2768	1968	QUOTATION#00343.exe	31
PID 1968 wrote to memory of 2768	1968	QUOTATION#00343.exe	31
PID 1968 wrote to memory of 2768	1968	QUOTATION#00343.exe	31

C:\Users\Admin\AppData\Local\Temp\QUOTATION#00343.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION#00343.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2952
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2488
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 684
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-1-0x0000000001300000-0x0000000001332000-memory.dmp

Filesize
200KB

Download
memory/1968-2-0x000007FEF5940000-0x000007FEF632C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-3-0x000000001B960000-0x000000001BAFE000-memory.dmp

Filesize
1.6MB

Download
memory/1968-36-0x000007FEF5940000-0x000007FEF632C000-memory.dmp

Filesize
9.9MB

Download
memory/1968-35-0x000007FEF5943000-0x000007FEF5944000-memory.dmp

Filesize
4KB

Download
memory/1968-0-0x000007FEF5943000-0x000007FEF5944000-memory.dmp

Filesize
4KB

Download
memory/2580-24-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-8-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-12-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-6-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-5-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-10-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2952-4-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download