341a30be185f9984fc4fb3328b8846f97499259f35a6d98abe32532b2c2516af

Analysis

max time kernel
42s
max time network
11s
platform
windows7_x64
resource
win7v200722
submitted
07/08/2020, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[Dev] ¿áQ Air [ÕýÊ½°æ]/¿áQ Air/CQA.exe
Size

5.6MB
MD5

6aa36f386a3e645f67cd6945374b8ea8
SHA1

17f6d3dedfd6afe56135d3a2e7ae3a7d120151ca
SHA256

39599008089755aa7cccb534b2c94ccb537f266018bb67ae3ed4b9f51c0a40b9
SHA512

87f59bb1a8d6887fa967d811e2db70c2bfb9bf9673347c6bada2d03f1e3371fbe05e7853a063a90df71627f9ea803d83c71c89b88859199f5a28e2c05e38d706

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	CQA.exe
272	itunes.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1588	CQA.exe
1588	CQA.exe
272	itunes.exe
272	itunes.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	CQA.exe
Token: SeDebugPrivilege	1588	CQA.exe
Token: SeDebugPrivilege	272	itunes.exe

Loads dropped DLL 2 IoCs

pid	Process
1588	CQA.exe
1588	CQA.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1588	CQA.exe
272	itunes.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 272	1588	CQA.exe	24
PID 1588 wrote to memory of 272	1588	CQA.exe	24
PID 1588 wrote to memory of 272	1588	CQA.exe	24
PID 1588 wrote to memory of 272	1588	CQA.exe	24

Executes dropped EXE 1 IoCs

pid	Process
272	itunes.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CQA.exe

C:\Users\Admin\AppData\Local\Temp\[Dev] ¿áQ Air [ÕýÊ½°æ]\¿áQ Air\CQA.exe
"C:\Users\Admin\AppData\Local\Temp\[Dev] ¿áQ Air [ÕýÊ½°æ]\¿áQ Air\CQA.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
PID:1588
- C:\Users\Admin\Documents\itunes.exe
  "C:\Users\Admin\Documents\itunes.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  PID:272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads