d252bafdd21ef871df2eeed20ae4cbf3b6e2f6df268d93ea563b01aaec889baa

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Copy H001510WHS.exe
Size 84KB
Sample201109-hsn7dv8gvx
SHA256 d252bafdd21ef871df2eeed20ae4cbf3b6e2f6df268d93ea563b01aaec889baa
MD5 049034fe9c4dddb2cd1369438d605966
SHA1 d9cbd66db2d8687635a21aba3fa05dcfab8d88a9
SHA512 3b54c68c9fa17a8210ea229f03e60201ba2883a7eeec7af66194af27b823ee2d97047e92cd3c8e37269b3bf3adef9a8c78990bad62a5de05f71e3b924db09f10
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	Payment Copy H001510WHS.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4076	Payment Copy H001510WHS.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4076	Payment Copy H001510WHS.exe

C:\Users\Admin\AppData\Local\Temp\Payment Copy H001510WHS.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy H001510WHS.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads