Analysis
- max time kernel
96s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 07:56
General
- Target Request for Quotation.exe
- Size 942KB
- Sample240809-js4fhsyapk
- SHA256 de99d33baf08708519ab2d9dc15635280482b2b21e52653b8786a6eb34c2f262
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ToHYZKAyCCa.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ToHYZKAyCCa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE148.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mpufobt5.2ot.ps1
tmpE148.tmp
memory/1656-79-0x0000000007C30000-0x0000000007C44000-memory.dmp
memory/1656-15-0x0000000002D90000-0x0000000002DC6000-memory.dmp
memory/1656-77-0x0000000007BF0000-0x0000000007C01000-memory.dmp
memory/1656-76-0x0000000007C70000-0x0000000007D06000-memory.dmp
memory/1656-75-0x0000000007A60000-0x0000000007A6A000-memory.dmp
memory/1656-73-0x00000000080B0000-0x000000000872A000-memory.dmp
memory/1656-62-0x0000000070710000-0x000000007075C000-memory.dmp
memory/1656-80-0x0000000007D30000-0x0000000007D4A000-memory.dmp
memory/1656-17-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/1656-18-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/1656-16-0x0000000005AB0000-0x00000000060D8000-memory.dmp
memory/1656-87-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/1656-21-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/1656-24-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/1656-19-0x0000000005820000-0x0000000005842000-memory.dmp
memory/1656-22-0x00000000060E0000-0x0000000006146000-memory.dmp
memory/2256-47-0x0000000006200000-0x000000000621E000-memory.dmp
memory/2256-74-0x0000000007550000-0x000000000756A000-memory.dmp
memory/2256-88-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/2256-45-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/2256-81-0x0000000007870000-0x0000000007878000-memory.dmp
memory/2256-49-0x00000000065F0000-0x000000000663C000-memory.dmp
memory/2256-44-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/2256-43-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/2256-51-0x0000000070710000-0x000000007075C000-memory.dmp
memory/2256-50-0x0000000007400000-0x0000000007432000-memory.dmp
memory/2256-61-0x00000000073C0000-0x00000000073DE000-memory.dmp
memory/2256-72-0x0000000007440000-0x00000000074E3000-memory.dmp
memory/2256-78-0x0000000007780000-0x000000000778E000-memory.dmp
memory/2256-42-0x0000000005C30000-0x0000000005F84000-memory.dmp
memory/4316-8-0x00000000055A0000-0x00000000055AE000-memory.dmp
memory/4316-9-0x00000000055C0000-0x00000000055D6000-memory.dmp
memory/4316-7-0x00000000054F0000-0x000000000550A000-memory.dmp
memory/4316-4-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/4316-10-0x00000000083F0000-0x00000000084B0000-memory.dmp
memory/4316-6-0x00000000055D0000-0x000000000566C000-memory.dmp
memory/4316-48-0x0000000074F70000-0x0000000075720000-memory.dmp
memory/4316-5-0x0000000005300000-0x000000000530A000-memory.dmp
memory/4316-3-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/4316-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmp
memory/4316-2-0x00000000058E0000-0x0000000005E84000-memory.dmp
memory/4316-1-0x0000000000840000-0x0000000000932000-memory.dmp