Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240729-en
General
-
Target
Quotation.exe
-
Size
773KB
-
MD5
439dad5646f8f78adada2e1d5740d0eb
-
SHA1
85ab73db3b73f38a97a44e0fddc829f2d5977c8a
-
SHA256
69dec355a88f71f9880052143f091580cecd4c6f301c1c6fefe931d44bf8c77d
-
SHA512
d867e2f561fe99d8fdee5abea882ff27b560ca60e22736c3e0862bf409d70d233cc204b37b71133f96c3f7827f642ae9335b07891ae419815e29f45fdbbb18c3
-
SSDEEP
24576:VmMt9lRuEDUgbwUCGnksyrlKNstj4Pif703:0Mt9lRu19Alyx4qj1g
Malware Config
Extracted
formbook
4.1
dn13
5q53s.top
f9813.top
ysticsmoke.net
ignorysingeysquints.cfd
yncsignature.live
svp-their.xyz
outya.xyz
wlkflwef3sf2wf.top
etterjugfetkaril.cfd
p9eh2s99b5.top
400108iqlnnqi219.top
ynsu-condition.xyz
ndividual-bfiaen.xyz
anceibizamagazine.net
itrussips.live
orkcubefood.xyz
lindsandfurnishings.shop
ajwmid.top
pigramescentfeatous.shop
mbvcv56789.click
rmei2-cnpj.website
81uu.top
cis.services
ptionsxpress-17520.vip
ltimatraceglow.vip
apu4dmain.cfd
hckc-sell.xyz
nough-smae.xyz
fsoiw-hotel.xyz
mile-hkajwx.xyz
ay-hbcsg.xyz
articulart.net
ozezae7.pro
asy-jatcrz.xyz
wiftsscend.click
tinky.vip
ould-ktlgl.xyz
vagames.pro
sncmk.shop
trategy-eyewna.xyz
orty.pro
hanprojects.tech
ronsoy.vip
aoxiangwu.top
8tsl.fashion
ashersmeaningmellitz.cfd
ood-packing-iasehq19x224.today
oldier-zjfuu.xyz
ysterywarrior932.top
omercialec.shop
ashclub.xyz
trongenergetichealth.top
addedcaitiffcanzos.shop
ack-gtiij.xyz
nformation-gdrs.xyz
ouwmsoe.top
apermatepens.net
5i34whsisp.top
appen-zuxs.xyz
trennebaffinbayamon.cfd
nablerententeewart.shop
xpert-private-tutors.today
zzw-tv.xyz
ffvd-traditional.xyz
31231851.xyz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3480-47-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3480-90-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4192-93-0x0000000001430000-0x000000000145F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 948 powershell.exe 5068 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Quotation.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 216 set thread context of 3480 216 Quotation.exe 101 PID 3480 set thread context of 3560 3480 Quotation.exe 56 PID 3480 set thread context of 3560 3480 Quotation.exe 56 PID 4192 set thread context of 3560 4192 explorer.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 216 Quotation.exe 948 powershell.exe 5068 powershell.exe 216 Quotation.exe 948 powershell.exe 3480 Quotation.exe 3480 Quotation.exe 3480 Quotation.exe 3480 Quotation.exe 5068 powershell.exe 3480 Quotation.exe 3480 Quotation.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe 4192 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3480 Quotation.exe 3480 Quotation.exe 3480 Quotation.exe 3480 Quotation.exe 4192 explorer.exe 4192 explorer.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 216 Quotation.exe Token: SeDebugPrivilege 948 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeDebugPrivilege 3480 Quotation.exe Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeDebugPrivilege 4192 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3560 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 216 wrote to memory of 948 216 Quotation.exe 95 PID 216 wrote to memory of 948 216 Quotation.exe 95 PID 216 wrote to memory of 948 216 Quotation.exe 95 PID 216 wrote to memory of 5068 216 Quotation.exe 97 PID 216 wrote to memory of 5068 216 Quotation.exe 97 PID 216 wrote to memory of 5068 216 Quotation.exe 97 PID 216 wrote to memory of 2296 216 Quotation.exe 99 PID 216 wrote to memory of 2296 216 Quotation.exe 99 PID 216 wrote to memory of 2296 216 Quotation.exe 99 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 216 wrote to memory of 3480 216 Quotation.exe 101 PID 3560 wrote to memory of 4192 3560 Explorer.EXE 103 PID 3560 wrote to memory of 4192 3560 Explorer.EXE 103 PID 3560 wrote to memory of 4192 3560 Explorer.EXE 103 PID 4192 wrote to memory of 4548 4192 explorer.exe 104 PID 4192 wrote to memory of 4548 4192 explorer.exe 104 PID 4192 wrote to memory of 4548 4192 explorer.exe 104
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NNQONPlQHe.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNQONPlQHe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE05D.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1632
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5e0f3ec3071162a904807f455be49ab8e
SHA1ad9647a910b37b558310e058114de0ff8b8f3e19
SHA2563b83dff52ebe25d3f19c649282916d06475ca1d98bfc0cf917e50a7e303a2a22
SHA512198e2e960daceb5526cf6193c9ce59377e6c831b5cf88d007990778eb89f1c6cdb2d8fedbee0177854e970726fb9ca470e30e5cc241326081e8e84a578fefeaf