Windows Analysis Report URGENT REQUEST FOR QUOTATION.exe

Overview

General Information

Sample Name:	URGENT REQUEST FOR QUOTATION.exe
Analysis ID:	452545
MD5:	436f3797fc4c39d1a2319196bc15c1c3
SHA1:	1a93b32908c5def6129f192fd096f129ea575220
SHA256:	f7b11103bbd791d5c2452275ff23fe51eff41ba5071ba015ef50672138c9b459
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Defender Exclusion

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

AV Detection:

Found malware configuration

Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "brucechuks212@vivaldi.net", "Password": "23456789@@@@", "Host": "smtp.vivaldi.net"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\CCxRZUAFy.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: URGENT REQUEST FOR QUOTATION.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\CCxRZUAFy.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: URGENT REQUEST FOR QUOTATION.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.512448328.00000000033B1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.512448328.00000000033B1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: http://api.twitter.com/1/direct_messages.xml?since_id=
Source: powershell.exe, 0000000C.00000003.456686092.0000000009AB0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsof
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.512448328.00000000033B1000.00000004.00000001.sdmp	String found in binary or memory: http://qxLqgV.com
Source: powershell.exe, 0000000F.00000003.439686163.00000000051FA000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000F.00000003.439686163.00000000051FA000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: URGENT REQUEST FOR QUOTATION.exe	String found in binary or memory: http://twitter.com/statuses/user_timeline.xml?screen_name=
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comadi
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comarT
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.cometh
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlay
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239482199.0000000005F14000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.y
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcomd
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdV
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241974830.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessedD
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239203447.0000000005F10000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp, URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/3
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Webd
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.240785096.0000000005F08000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.239863376.0000000005F03000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ers
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.240785096.0000000005F08000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/i
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/r
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.241062822.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/p
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.240785096.0000000005F08000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/r
Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000003.240385875.0000000005F0A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/roso
Source: powershell.exe, 0000000C.00000003.416484110.0000000007FE1000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 0000000C.00000003.422321496.00000000058F8000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000003.427772960.0000000005440000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.503706672.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.512448328.00000000033B1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE28EDE1Au002d0DFFu002d45E9u002d9A29u002dC8551D143C75u007d/u0039ACB0DCFu002d05C4u002d49DCu002dB73Au002dD9A6D13ABB59.cs

Large array initialization: .cctor: array initializer size 11937

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: URGENT REQUEST FOR QUOTATION.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 20_2_00ECBF7F	20_2_00ECBF7F
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 20_2_018246A0	20_2_018246A0
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 20_2_01824690	20_2_01824690
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 20_2_01824673	20_2_01824673
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Code function: 20_2_0182D2E1	20_2_0182D2E1

Sample file is different than original file name gathered from version info

Source: URGENT REQUEST FOR QUOTATION.exe, 00000000.00000000.234931999.0000000000A72000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSinkProviderEnt.exe8 vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe	Binary or memory string: OriginalFilename vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.506375111.0000000000EC2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSinkProviderEnt.exe8 vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.520747940.0000000006500000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.503706672.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameQfAsAXkZdWxBQzlpGkABAoNnttg.exe4 vs URGENT REQUEST FOR QUOTATION.exe
Source: URGENT REQUEST FOR QUOTATION.exe	Binary or memory string: OriginalFilenameSinkProviderEnt.exe8 vs URGENT REQUEST FOR QUOTATION.exe

Uses 32bit PE files

Source: URGENT REQUEST FOR QUOTATION.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: URGENT REQUEST FOR QUOTATION.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CCxRZUAFy.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: URGENT REQUEST FOR QUOTATION.exe, ControlePorTwitter/Business/Seguranca.cs	Cryptographic APIs: 'CreateDecryptor'
Source: CCxRZUAFy.exe.0.dr, ControlePorTwitter/Business/Seguranca.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.URGENT REQUEST FOR QUOTATION.exe.a70000.0.unpack, ControlePorTwitter/Business/Seguranca.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.2.URGENT REQUEST FOR QUOTATION.exe.ec0000.1.unpack, ControlePorTwitter/Business/Seguranca.cs	Cryptographic APIs: 'CreateDecryptor'

Source: URGENT REQUEST FOR QUOTATION.exe

Binary or memory string: ++.vBpQ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/18@0/0

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe

File created: C:\Users\user\AppData\Roaming\CCxRZUAFy.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_01
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Mutant created: \Sessions\1\BaseNamedObjects\DyOiITGQOZVocaqJg
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3264:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_01

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: unknown	Process created: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe 'C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe'
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\CCxRZUAFy.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CCxRZUAFy' /XML 'C:\Users\user\AppData\Local\Temp\tmpD0B6.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\CCxRZUAFy.exe'
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe'	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\CCxRZUAFy.exe'	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CCxRZUAFy' /XML 'C:\Users\user\AppData\Local\Temp\tmpD0B6.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\CCxRZUAFy.exe'	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process created: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Jump to behavior

Source: initial sample	Static PE information: section name: .text entropy: 7.60723196503
Source: initial sample	Static PE information: section name: .text entropy: 7.60723196503

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4268	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2473	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4110	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2640	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4308
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4413
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Window / User API: threadDelayed 538
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Window / User API: threadDelayed 9302

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 5264	Thread sleep time: -39925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 4812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4960	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2148	Thread sleep count: 4110 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6344	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2148	Thread sleep count: 2640 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6292	Thread sleep count: 4308 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6292	Thread sleep count: 4413 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 2068	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 2252	Thread sleep count: 538 > 30
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe TID: 2252	Thread sleep count: 9302 > 30

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 39925	Jump to behavior
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000C.00000003.420260208.00000000057FB000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000003.427387537.000000000534E000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.520747940.0000000006500000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: URGENT REQUEST FOR QUOTATION.exe	Binary or memory string: DdUXhZQ[fUE6Ws]YTSk6WLInYD73f[o5QsEYYq{nV]8XY[8XVpEzfoQZd5M[]WMZ][<IgogJD}4pfy]3[3Y5]DL[]}Y4[3Y5]D75esU[\moJezE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD\|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg\|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e\|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ
Source: powershell.exe, 0000000C.00000003.420260208.00000000057FB000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000003.427387537.000000000534E000.00000004.00000001.sdmp	Binary or memory string: #l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.520747940.0000000006500000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.520747940.0000000006500000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.520747940.0000000006500000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\URGENT REQUEST FOR QUOTATION.exe	Process token adjusted: Debug

Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.511718751.0000000001E00000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.511718751.0000000001E00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.511718751.0000000001E00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: URGENT REQUEST FOR QUOTATION.exe, 00000014.00000002.511718751.0000000001E00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

ID:	452545
Product:	CloudBasic
Start time:	15:06:32
Start date:	22.07.2021
Sample:	URGENT REQUEST FOR QUOTATION.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	436f3797fc4c39d1a2319196bc15c1c3
SHA1:	1a93b32908c5def6129f192fd096f129ea575220
SHA256:	f7b11103bbd791d5c2452275ff23fe51eff41ba5071ba015ef50672138c9b459
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\URGENT REQUEST FOR QUOTATION.exe.log	ASCII text, with CRLF line terminators	1DC1A2DCC9EFAA84EABF4F6D6066565B	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	8D5E194411E038C060288366D6766D3D	DC1A8229ED0B909042065EA69253E86E86D71C88	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	158CE3622E7B2A3A0171CA62C6A5D08F	C79CC7E0C9AB10DDB443CB017895C198700C6D34	824F3D803040C23A6FEAA5C567991AACA29B03DE10901F77AD78399C398AA3F9
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_atfsddvg.sju.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cfw4f2kf.lgt.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mby5lfvb.ykp.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uj2qse0o.fof.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2ozaui5.3in.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xk3kxaoj.0rb.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmpD0B6.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	904F58B2E90F4AB00574DE411A33549F	CF3C774C3B00515D2CBD0A9AC6D26473832EB35D	BC8A6B40FDCD693079716DF2B9743443C60565CF085811392BC151918296E3C9
C:\Users\user\AppData\Roaming\CCxRZUAFy.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	436F3797FC4C39D1A2319196BC15C1C3	1A93B32908C5DEF6129F192FD096F129EA575220	F7B11103BBD791D5C2452275FF23FE51EFF41BA5071BA015EF50672138C9B459
C:\Users\user\AppData\Roaming\CCxRZUAFy.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20210722\PowerShell_transcript.887849.2t_TENv_.20210722150759.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	268E84561ABAE4E11F17AAFDA39D1CFF	CB45B544D2815DA8A8ECF3A447B0083720106940	847AEAE2110031F51A2FA6C5DDFA6B7D6906FD1BD2F94E67D1BC4D3A67ABF331
C:\Users\user\Documents\20210722\PowerShell_transcript.887849.CmVMk4On.20210722150759.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	E20587313F3F7E8F2B3EF7C979594AD6	9787A4E54DF0F78145A83E53A160CEB8293CD1AA	EFB3FEDFFB49E1D9B9D739E6E0AC8C2BFE0F5D0BFBF528D076E03FF56C4D9EE5
C:\Users\user\Documents\20210722\PowerShell_transcript.887849.tSO3nJDl.20210722150757.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	DB87767DD4402D72A44DAE34A7C1FFA5	2CAE9062D732301ACF9A8CD7B8F8D6EF1231D104	2CD691AE85743FB44AFA8916B57FC39BE151164A9C748EFD244F7B8DDF8B6899

Windows Analysis Report URGENT REQUEST FOR QUOTATION.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map