Analysis
-
max time kernel
130s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 19:42
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER QUOTATION REQUEST.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NEW ORDER QUOTATION REQUEST.exe
Resource
win10v2004-20241007-en
General
-
Target
NEW ORDER QUOTATION REQUEST.exe
-
Size
1.2MB
-
MD5
274886fceb562b62f7c9047ea003e7cb
-
SHA1
4e08243ed9caf495ad6337029aad1ed207fe6a52
-
SHA256
1ecf2326311e2c2e98ec0548958da41dafcc961c9ec07088c0c646445f51a30a
-
SHA512
01544cf243f46ce27c59fc3ecb91df7941142d87260fae0c4c68191f6c1712e3f055040098bae7969200ea810daf03633937e6b9d194add7be0c46a14e3df2a6
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLjGFLhUQkAO6AS2GEuY5++o+:f3v+7/5QLcOYO6eLrk+
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
quinquennia.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quinquennia.vbs quinquennia.exe -
Executes dropped EXE 1 IoCs
Processes:
quinquennia.exepid process 776 quinquennia.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Vevina\quinquennia.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2792 776 WerFault.exe quinquennia.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
NEW ORDER QUOTATION REQUEST.exequinquennia.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW ORDER QUOTATION REQUEST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quinquennia.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
NEW ORDER QUOTATION REQUEST.exequinquennia.exepid process 764 NEW ORDER QUOTATION REQUEST.exe 764 NEW ORDER QUOTATION REQUEST.exe 776 quinquennia.exe 776 quinquennia.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
NEW ORDER QUOTATION REQUEST.exequinquennia.exepid process 764 NEW ORDER QUOTATION REQUEST.exe 764 NEW ORDER QUOTATION REQUEST.exe 776 quinquennia.exe 776 quinquennia.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
NEW ORDER QUOTATION REQUEST.exequinquennia.exedescription pid process target process PID 764 wrote to memory of 776 764 NEW ORDER QUOTATION REQUEST.exe quinquennia.exe PID 764 wrote to memory of 776 764 NEW ORDER QUOTATION REQUEST.exe quinquennia.exe PID 764 wrote to memory of 776 764 NEW ORDER QUOTATION REQUEST.exe quinquennia.exe PID 776 wrote to memory of 3156 776 quinquennia.exe RegSvcs.exe PID 776 wrote to memory of 3156 776 quinquennia.exe RegSvcs.exe PID 776 wrote to memory of 3156 776 quinquennia.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER QUOTATION REQUEST.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Vevina\quinquennia.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER QUOTATION REQUEST.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER QUOTATION REQUEST.exe"3⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 7603⤵
- Program crash
PID:2792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 776 -ip 7761⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD55fa22afa19dad9edf04c13437065bc95
SHA188a5776c79f44e06378e83471fc8295c44224a74
SHA256d6d9cb15653250a2377609a74ff533bd459f833fb3879064d1cab84e6a06c332
SHA512a0684e26bb22a36b5577a60a83d56806e928d3c39da66e93b03d48f986424f243f64a6015d852461a0e86ef7f123d1a8eb1924fa6502a4c402f787d50e2ed58e
-
Filesize
1.2MB
MD5274886fceb562b62f7c9047ea003e7cb
SHA14e08243ed9caf495ad6337029aad1ed207fe6a52
SHA2561ecf2326311e2c2e98ec0548958da41dafcc961c9ec07088c0c646445f51a30a
SHA51201544cf243f46ce27c59fc3ecb91df7941142d87260fae0c4c68191f6c1712e3f055040098bae7969200ea810daf03633937e6b9d194add7be0c46a14e3df2a6