Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2024 14:21

General

  • Target

    Quotation_pdf.exe

  • Size

    883KB

  • MD5

    571902de75705d1aeaa32be01459dc65

  • SHA1

    4ccf3c9a339146008c1d8466857e13d3c7752a05

  • SHA256

    8f2c4543e4bc9194d1c1a9bc946a75d49162b0eee2715df4ba626980892107b5

  • SHA512

    966381cdeaf8213fefdca876052a59dcda9e2436cfc50b4516eca936ebb9e75b9421058969526fa0b46d06067a43398a51c8e7201fa72d39faa0153c4328a9d7

  • SSDEEP

    24576:kBGzjcJ6NacNEyNOU+6cNuuH2SNcjmYY4Swv:kE86N1l5x8uuWSpYXS2

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\efsOOkOP.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2096
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\efsOOkOP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB50D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
      2⤵
        PID:2996
      • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
        2⤵
          PID:1632
        • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
          2⤵
            PID:3008
          • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
            2⤵
              PID:560
            • C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"
              2⤵
                PID:300

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpB50D.tmp

              Filesize

              1KB

              MD5

              058392715ba3218d45d65df005bd5179

              SHA1

              e164f674af1c6974c1771cbdec811ebe85c284f6

              SHA256

              5cd1d58c441f40187ae601ebd9bff7aca38a8e2d354d65e2e664a46766b6e8a1

              SHA512

              28df1bec99212409ece47d9bb3173a060cb8391d505cb39ecf501d2e0b188eaf6118e8a49bed37407a7f1fc36a216d39c82c89782e7d152a1f5561f6adda6353

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

              Filesize

              7KB

              MD5

              36259c9ae106a89b9808b0dfc91a8081

              SHA1

              9ff613bec920b7b828a44b8d8a8d2db11baf71f5

              SHA256

              182dfd39928c67fbf8c055f695492b21d9e960770e42948b00ee8c01a54d3e31

              SHA512

              d8481e6dba0b5322c841f12551d300725a6ee758474f49c4ed703320969cdbdc0f834be64ef9606996ca0cc88657a82ccee6a52030357aa61e26f10b507dd1aa

            • memory/2344-0-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

              Filesize

              4KB

            • memory/2344-1-0x0000000000350000-0x0000000000434000-memory.dmp

              Filesize

              912KB

            • memory/2344-2-0x0000000073C00000-0x00000000742EE000-memory.dmp

              Filesize

              6.9MB

            • memory/2344-3-0x0000000000580000-0x0000000000592000-memory.dmp

              Filesize

              72KB

            • memory/2344-4-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

              Filesize

              4KB

            • memory/2344-5-0x0000000073C00000-0x00000000742EE000-memory.dmp

              Filesize

              6.9MB

            • memory/2344-6-0x0000000005420000-0x00000000054DE000-memory.dmp

              Filesize

              760KB

            • memory/2344-19-0x0000000073C00000-0x00000000742EE000-memory.dmp

              Filesize

              6.9MB

            We care about your privacy.

            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.