Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21/07/2021, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
qaz.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
qaz.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
qaz.exe
-
Size
489KB
-
MD5
8f7205aaf80ce4b5d0ee8f00369f301a
-
SHA1
401d3336eb33cf82eecb5df5c2ac6d5f7f78aa26
-
SHA256
655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5
-
SHA512
1de8e8e3e4e8356067365571e90a812425ef18da2b7c210656f79683d41d3943e7fd052160978e370952afe8b14555a51871bd2c3923294c5057a8bb6d82b47d
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3187353223" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30899723" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b15062600446716800000000020000000000106600000001000020000000fb3c5126f4f4ad5c94295c626e113cbd2423060c1f06e97100c7288dda5bf2ec000000000e8000000002000020000000b2234aa6845f36e2e702279c882a7bf603005766c4fd505a4c31a1c77722163d200000007edb22d20e06f15bbd4b851e516fb0951823b316bc41d90fa5f4cbed54de166a4000000098d0623ee5a313c24747b47d662fdfb6e457ad56ce3fbe6a2775992e0f907a89f6efcbb10772fdbd5366c986e3fb95416426379d543068f6c396440c8aa67db4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899723" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899723" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b150626004467168000000000200000000001066000000010000200000000ae25c585006c38aee51ef3f7a779fc53a5cc156d26d373befb041f987faa191000000000e80000000020000200000002f5e8e73709691cb2b240f17e8c2b8e683be300ede979e1700e41f88db1e455b20000000abd3afac29e5be44103f8bade4c9724b5b7f466ccab146f755879811d6576cd3400000000f63f7f4f6962de1ad5f46f30cfb97989b1297a255b0b647474d1dd8e80c9b512c9d11cdfa94c2d29cf7190de73155b4ab6fde70a5ba3240d051fb3820e3b861 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b1506260044671680000000002000000000010660000000100002000000011e2f6425e111197def37efbf0d37e506a782487626a1c46f845979b29ba772f000000000e80000000020000200000003d0dcac2e038eba840b8ded9ea058f1e39ba4ce8c20330b46a3485e22439c0a020000000a586e93cc3818d9a91bbe21b752c64f6cbead8c8668cb0d2be9413a1c189f50540000000598a21b79f5d3b1b37c231dbff7460b5324f01487a617e96fecfea507759eb2a0128f528f77b05dd7f9e22cd66671984a6c04a9b3d50bff8c6bdd58b909468d3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709d6caf0b7ed701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3204383927" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3187353223" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E942E94F-E9FE-11EB-B2DB-6AC8DF09D482} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08cadb10b7ed701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f6a4b00b7ed701 iexplore.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 2104 iexplore.exe 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 652 qaz.exe 2104 iexplore.exe 2104 iexplore.exe 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 2104 iexplore.exe 2104 iexplore.exe 3292 IEXPLORE.EXE 3292 IEXPLORE.EXE 2104 iexplore.exe 2104 iexplore.exe 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE 2104 iexplore.exe 2104 iexplore.exe 3140 IEXPLORE.EXE 3140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3140 2104 iexplore.exe 76 PID 2104 wrote to memory of 3140 2104 iexplore.exe 76 PID 2104 wrote to memory of 3140 2104 iexplore.exe 76 PID 2104 wrote to memory of 3292 2104 iexplore.exe 77 PID 2104 wrote to memory of 3292 2104 iexplore.exe 77 PID 2104 wrote to memory of 3292 2104 iexplore.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\qaz.exe"C:\Users\Admin\AppData\Local\Temp\qaz.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:652
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:82947 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3292
-