655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5

Resubmissions

14-01-2022 07:01

220114-htmcysfahp 10

21-07-2021 06:34

210721-3fc9s711mx 10

Analysis

max time kernel
94s
max time network
96s
platform
windows10_x64
resource
win10v20210408
submitted
21-07-2021 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qaz.exe
Size

489KB
MD5

8f7205aaf80ce4b5d0ee8f00369f301a
SHA1

401d3336eb33cf82eecb5df5c2ac6d5f7f78aa26
SHA256

655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5
SHA512

1de8e8e3e4e8356067365571e90a812425ef18da2b7c210656f79683d41d3943e7fd052160978e370952afe8b14555a51871bd2c3923294c5057a8bb6d82b47d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3187353223"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30899723"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b15062600446716800000000020000000000106600000001000020000000fb3c5126f4f4ad5c94295c626e113cbd2423060c1f06e97100c7288dda5bf2ec000000000e8000000002000020000000b2234aa6845f36e2e702279c882a7bf603005766c4fd505a4c31a1c77722163d200000007edb22d20e06f15bbd4b851e516fb0951823b316bc41d90fa5f4cbed54de166a4000000098d0623ee5a313c24747b47d662fdfb6e457ad56ce3fbe6a2775992e0f907a89f6efcbb10772fdbd5366c986e3fb95416426379d543068f6c396440c8aa67db4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899723"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30899723"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b150626004467168000000000200000000001066000000010000200000000ae25c585006c38aee51ef3f7a779fc53a5cc156d26d373befb041f987faa191000000000e80000000020000200000002f5e8e73709691cb2b240f17e8c2b8e683be300ede979e1700e41f88db1e455b20000000abd3afac29e5be44103f8bade4c9724b5b7f466ccab146f755879811d6576cd3400000000f63f7f4f6962de1ad5f46f30cfb97989b1297a255b0b647474d1dd8e80c9b512c9d11cdfa94c2d29cf7190de73155b4ab6fde70a5ba3240d051fb3820e3b861	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000718741d575c51547b1506260044671680000000002000000000010660000000100002000000011e2f6425e111197def37efbf0d37e506a782487626a1c46f845979b29ba772f000000000e80000000020000200000003d0dcac2e038eba840b8ded9ea058f1e39ba4ce8c20330b46a3485e22439c0a020000000a586e93cc3818d9a91bbe21b752c64f6cbead8c8668cb0d2be9413a1c189f50540000000598a21b79f5d3b1b37c231dbff7460b5324f01487a617e96fecfea507759eb2a0128f528f77b05dd7f9e22cd66671984a6c04a9b3d50bff8c6bdd58b909468d3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709d6caf0b7ed701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3204383927"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3187353223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E942E94F-E9FE-11EB-B2DB-6AC8DF09D482} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08cadb10b7ed701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f6a4b00b7ed701	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2104	iexplore.exe
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

qaz.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	Process
652	qaz.exe
2104	iexplore.exe
2104	iexplore.exe
3140	IEXPLORE.EXE
3140	IEXPLORE.EXE
2104	iexplore.exe
2104	iexplore.exe
3292	IEXPLORE.EXE
3292	IEXPLORE.EXE
2104	iexplore.exe
2104	iexplore.exe
3140	IEXPLORE.EXE
3140	IEXPLORE.EXE
2104	iexplore.exe
2104	iexplore.exe
3140	IEXPLORE.EXE
3140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2104 wrote to memory of 3140	2104	iexplore.exe	76
PID 2104 wrote to memory of 3140	2104	iexplore.exe	76
PID 2104 wrote to memory of 3140	2104	iexplore.exe	76
PID 2104 wrote to memory of 3292	2104	iexplore.exe	77
PID 2104 wrote to memory of 3292	2104	iexplore.exe	77
PID 2104 wrote to memory of 3292	2104	iexplore.exe	77

C:\Users\Admin\AppData\Local\Temp\qaz.exe
"C:\Users\Admin\AppData\Local\Temp\qaz.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:82947 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
55c438c35cef29e837c8c9873da227ac

SHA1
3addbe32c1d953b194ef3a91b16c450c13da5ea4

SHA256
adc94239c1455c955879ca039a5a4ff67d2184b48df90870807dcf3165e1359d

SHA512
d979d78f588c779a05b54e8b731b4f212b5327dff13b52b02c38a521117cb33963c9035c0054db352b9c8b439575d557b907bf8b4f2560a716dccafb87e59a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
2d476daf1f96b00622edc8e8d5b8c254

SHA1
72357ce02b62836d9fde765f03087679bad7eb67

SHA256
060e8e240b26aae2c7652a4eff3d04e448bc08fa7a52c88e13028b70e20447f9

SHA512
0bd5c1d02587cb5e9fc39412a4cccc02d1418dfb8a0aeec42faa6ee671d22820cf84c77be22e298855c31cb06dd50a3ba236302d84248c8de26f810e1b9dbf86

Download Submit
memory/2104-114-0x00007FFDDA910000-0x00007FFDDA97B000-memory.dmp

Filesize
428KB

Download
memory/3140-115-0x0000000000000000-mapping.dmp

Download
memory/3292-116-0x0000000000000000-mapping.dmp

Download