Analysis
- max time kernel
140s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
07/01/2022, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
- Size 1.6MB
- Sample220107-kh694acae5
- SHA256 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e
- MD5 e8f229e37cdfba2fec3d2734d5b36259
- SHA1 1a32349b2f09df58408b25fa5db5d432faf1fe9a
- SHA512 a4cfbd9613d3328150c3eaf1be43b80cc70c49432b96ebd11ab0f4a2167e0a589240684b2d3f37310d7d65e055fb6dd18bf1b90e668dd885dc9328b62d943fcf
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 524 QAiyqi.exe 1244 QAiyqi.exe - Deletes itself 1 IoCs
pid Process 1480 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 524 QAiyqi.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: QAiyqi.exe File opened (read-only) \??\I: QAiyqi.exe File opened (read-only) \??\K: QAiyqi.exe File opened (read-only) \??\P: QAiyqi.exe File opened (read-only) \??\F: QAiyqi.exe File opened (read-only) \??\L: QAiyqi.exe File opened (read-only) \??\N: QAiyqi.exe File opened (read-only) \??\S: QAiyqi.exe File opened (read-only) \??\U: QAiyqi.exe File opened (read-only) \??\X: QAiyqi.exe File opened (read-only) \??\Z: QAiyqi.exe File opened (read-only) \??\B: QAiyqi.exe File opened (read-only) \??\M: QAiyqi.exe File opened (read-only) \??\Q: QAiyqi.exe File opened (read-only) \??\T: QAiyqi.exe File opened (read-only) \??\W: QAiyqi.exe File opened (read-only) \??\V: QAiyqi.exe File opened (read-only) \??\Y: QAiyqi.exe File opened (read-only) \??\E: QAiyqi.exe File opened (read-only) \??\H: QAiyqi.exe File opened (read-only) \??\J: QAiyqi.exe File opened (read-only) \??\O: QAiyqi.exe File opened (read-only) \??\R: QAiyqi.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\QAiyqi.exe cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe File opened for modification C:\Windows\SysWOW64\QAiyqi.exe cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 524 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QAiyqi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz QAiyqi.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings QAiyqi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 QAiyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" QAiyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\SuppressDisableCompositionUI = "1" QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software QAiyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections QAiyqi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 QAiyqi.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1708 PING.EXE - Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe 1244 QAiyqi.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 524 QAiyqi.exe 1244 QAiyqi.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1480 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 28 PID 1848 wrote to memory of 1480 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 28 PID 1848 wrote to memory of 1480 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 28 PID 1848 wrote to memory of 1480 1848 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 28 PID 524 wrote to memory of 1244 524 QAiyqi.exe 30 PID 524 wrote to memory of 1244 524 QAiyqi.exe 30 PID 524 wrote to memory of 1244 524 QAiyqi.exe 30 PID 524 wrote to memory of 1244 524 QAiyqi.exe 30 PID 1480 wrote to memory of 1708 1480 cmd.exe 31 PID 1480 wrote to memory of 1708 1480 cmd.exe 31 PID 1480 wrote to memory of 1708 1480 cmd.exe 31 PID 1480 wrote to memory of 1708 1480 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe"C:\Users\Admin\AppData\Local\Temp\cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CBC999~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1708
-
-
-
C:\Windows\SysWOW64\QAiyqi.exeC:\Windows\SysWOW64\QAiyqi.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\QAiyqi.exeC:\Windows\SysWOW64\QAiyqi.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1244
-