Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08/07/2024, 13:51
General
-
Target
QUOTE--GEI REF 2177700XX02400.exe
-
Size
1.1MB
-
MD5
33b7516bf609bb5f78b3fff6fbdc41c5
-
SHA1
560e020e292b8d70ddf723bd74f187035b8f4305
-
SHA256
60590527a11cde51827a5534142be786eb4bd7781ffdcdd4515e2b9fd3200194
-
SHA512
258ddad46f42c0be70a1733df3e68a530a643cdc3a8d6b9ff8b026c53c0541b0c19b6d8e8575bf1e4d7c30c17534abe0b3bce723f501be0582c30ce0fd0a93df
-
SSDEEP
24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaukIUaVrMs+HJtI9VjMB5:Zh+ZkldoPK8YauPF9VG
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE--GEI REF 2177700XX02400.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE--GEI REF 2177700XX02400.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE--GEI REF 2177700XX02400.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5aa88f3e6dff0cfc6d09b1596504774b9
SHA101b8ebce47a5e5d78b58e840c12f1dbd4773096a
SHA256c22397aa4aacd65b6e88ca017303ccdb46861fd98eeac4dfbdf8d14a1b4ba454
SHA512c02982189578840d4352eae5d7813abc8453688afda90cb325a0ba7ba3ddcaae8a44b4554bba47e28b3d278a775c98eb8bb225514c1b42aafa6715738c2e4ba8
-
Filesize
16KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
3.0MB
-
Filesize
264KB
-
Filesize
264KB