Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 15:17

General

  • Target

    Quotation.exe

  • Size

    1.0MB

  • MD5

    67b86e9595c2d0d2f44454ec239fda56

  • SHA1

    1a44600a7b4e010174d99c152dc20fef1d84061a

  • SHA256

    905eb3c354f4f1210442b25983482a2612d6354df9c3d26beb9a0bdaf1e9ac04

  • SHA512

    73fb542c826f8e75683e7944f0f616d2317d17c5cc153610e7d2107c6da7458da00c89e797aa4f59c92d92095dcf884ef9474cf7ac5dcc4bf526aa8389486604

  • SSDEEP

    24576:BHAXaxESQklIlQcZrVs+3FvrVOuHvKYKrVFmdGp7N1/TBt:BgAlFUrv3FjwuPKYaGK/t

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2888
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hVWuVAdS.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hVWuVAdS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA42B.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2660
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
        PID:1688
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        2⤵
          PID:2864
        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
          2⤵
            PID:2916
          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
            2⤵
              PID:1332
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              2⤵
                PID:1748

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpA42B.tmp

              Filesize

              1KB

              MD5

              b5dfd7c1d090b57ba6bcfc90f0e040fe

              SHA1

              378ce00065d38c3a61d9c6e463e8bcd7ee71a0b6

              SHA256

              c27b363bb890683d44b611988a7cf2a879caedd69282073dcde02da2d5dc0011

              SHA512

              8d5c790e9ad28b9e2d6f6ceaeb9bc4936cfcb81bacd0ae234a52264df867841b0ef824c57b8a94e4730213acd45ae43ae7da57a612c0d6030a20285eb90fea81

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7CKG2J4X6RTPP9P4HHYZ.temp

              Filesize

              7KB

              MD5

              1459263be176852983b568515581db66

              SHA1

              72c8c44fce453b52ffadbf248a1da9aeb59f2da4

              SHA256

              ebe81c815f7be9329a624886bdd83ba61b594d808b16108dbd33a0b20ab9a716

              SHA512

              d5d8689764690014b888cb5b83bbdca677575b126ee3b84c5546d191512df441fbf250ff49c047e88a6db194993827d6859d784e862f53eb482ddb591c175c4b

            • memory/1792-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

              Filesize

              4KB

            • memory/1792-1-0x00000000003D0000-0x00000000004DC000-memory.dmp

              Filesize

              1.0MB

            • memory/1792-2-0x00000000744E0000-0x0000000074BCE000-memory.dmp

              Filesize

              6.9MB

            • memory/1792-3-0x0000000000500000-0x0000000000518000-memory.dmp

              Filesize

              96KB

            • memory/1792-4-0x00000000744EE000-0x00000000744EF000-memory.dmp

              Filesize

              4KB

            • memory/1792-5-0x00000000744E0000-0x0000000074BCE000-memory.dmp

              Filesize

              6.9MB

            • memory/1792-6-0x0000000005230000-0x00000000052F2000-memory.dmp

              Filesize

              776KB

            • memory/1792-19-0x00000000744E0000-0x0000000074BCE000-memory.dmp

              Filesize

              6.9MB