2f4acbd783db771739523c21f32489679e97ad254b51b170981ad58bcf00575c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Quotation - TB046J12LCO2 Project Mechanical.exe
Size

1.1MB
MD5

16a009a8c64f7d483d331d27cc342f54
SHA1

e140137a852280f79e101e93276216643d1631aa
SHA256

2f4acbd783db771739523c21f32489679e97ad254b51b170981ad58bcf00575c
SHA512

0afa038e4cacec78cf5551c5f341c1342b077fef9608a51ba0b0cf39152687830d95665c9324ba3eaa5b3cb3964adc8e92964b710ac2de0da9891e3923540f4e
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHajd/h2cNa0yIvdFW5:mh+ZkldoPK8Yajd7lyI1O

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 2244	1580	Quotation - TB046J12LCO2 Project Mechanical.exe	81
PID 2244 set thread context of 3432	2244	svchost.exe	56
PID 2244 set thread context of 4196	2244	svchost.exe	84
PID 4196 set thread context of 3432	4196	RMActivate_ssp.exe	56

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
2244	svchost.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1580	Quotation - TB046J12LCO2 Project Mechanical.exe
2244	svchost.exe
3432	Explorer.EXE
3432	Explorer.EXE
4196	RMActivate_ssp.exe
4196	RMActivate_ssp.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1580	Quotation - TB046J12LCO2 Project Mechanical.exe
1580	Quotation - TB046J12LCO2 Project Mechanical.exe
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1580	Quotation - TB046J12LCO2 Project Mechanical.exe
1580	Quotation - TB046J12LCO2 Project Mechanical.exe
3432	Explorer.EXE
3432	Explorer.EXE
3432	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2244	1580	Quotation - TB046J12LCO2 Project Mechanical.exe	81
PID 1580 wrote to memory of 2244	1580	Quotation - TB046J12LCO2 Project Mechanical.exe	81
PID 1580 wrote to memory of 2244	1580	Quotation - TB046J12LCO2 Project Mechanical.exe	81
PID 1580 wrote to memory of 2244	1580	Quotation - TB046J12LCO2 Project Mechanical.exe	81
PID 3432 wrote to memory of 4196	3432	Explorer.EXE	84
PID 3432 wrote to memory of 4196	3432	Explorer.EXE	84
PID 3432 wrote to memory of 4196	3432	Explorer.EXE	84

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\Quotation - TB046J12LCO2 Project Mechanical.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation - TB046J12LCO2 Project Mechanical.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation - TB046J12LCO2 Project Mechanical.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2244
- C:\Windows\SysWOW64\RMActivate_ssp.exe
  "C:\Windows\SysWOW64\RMActivate_ssp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4064.tmp

Filesize
264KB

MD5
1cb65f815398054b6991c24f3a24e726

SHA1
5b5649d946e2d2b10bff465b3a291eee0e0c0052

SHA256
89cf65de807d861370b51d84eac316eb68ff0b3f208c078163210ad653b5cfd8

SHA512
2ce6ed9c82185dc60dd1633d5cadb5ffcc3517bb7d40f80519467f7dc7815b4e7cafcc0fe2c0c515cf6311398d2121039e4c3b991c177b03c8278bb9572bae94

Download Submit
memory/1580-12-0x0000000004470000-0x0000000004474000-memory.dmp

Filesize
16KB

Download
memory/2244-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-14-0x0000000001900000-0x0000000001C4A000-memory.dmp

Filesize
3.3MB

Download
memory/2244-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-18-0x00000000018A0000-0x00000000018BD000-memory.dmp

Filesize
116KB

Download
memory/2244-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3432-26-0x0000000008CD0000-0x0000000008DC5000-memory.dmp

Filesize
980KB

Download
memory/3432-19-0x000000000CC10000-0x000000000E51A000-memory.dmp

Filesize
25.0MB

Download
memory/3432-27-0x0000000008CD0000-0x0000000008DC5000-memory.dmp

Filesize
980KB

Download
memory/3432-28-0x000000000CC10000-0x000000000E51A000-memory.dmp

Filesize
25.0MB

Download
memory/3432-30-0x0000000008CD0000-0x0000000008DC5000-memory.dmp

Filesize
980KB

Download
memory/4196-21-0x0000000001200000-0x000000000123F000-memory.dmp

Filesize
252KB

Download
memory/4196-20-0x0000000001200000-0x000000000123F000-memory.dmp

Filesize
252KB

Download
memory/4196-23-0x00000000018D0000-0x0000000001C1A000-memory.dmp

Filesize
3.3MB

Download
memory/4196-24-0x0000000001200000-0x000000000123F000-memory.dmp

Filesize
252KB

Download
memory/4196-25-0x00000000017F0000-0x000000000188C000-memory.dmp

Filesize
624KB

Download
memory/4196-29-0x0000000001200000-0x000000000123F000-memory.dmp

Filesize
252KB

Download