Analysis
- max time kernel
142s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe
- Size 1.6MB
- Sample220107-kh694acae5
- SHA256 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e
- MD5 e8f229e37cdfba2fec3d2734d5b36259
- SHA1 1a32349b2f09df58408b25fa5db5d432faf1fe9a
- SHA512 a4cfbd9613d3328150c3eaf1be43b80cc70c49432b96ebd11ab0f4a2167e0a589240684b2d3f37310d7d65e055fb6dd18bf1b90e668dd885dc9328b62d943fcf
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 880 QAiyqi.exe 1256 QAiyqi.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: QAiyqi.exe File opened (read-only) \??\H: QAiyqi.exe File opened (read-only) \??\I: QAiyqi.exe File opened (read-only) \??\J: QAiyqi.exe File opened (read-only) \??\N: QAiyqi.exe File opened (read-only) \??\P: QAiyqi.exe File opened (read-only) \??\Q: QAiyqi.exe File opened (read-only) \??\S: QAiyqi.exe File opened (read-only) \??\W: QAiyqi.exe File opened (read-only) \??\G: QAiyqi.exe File opened (read-only) \??\K: QAiyqi.exe File opened (read-only) \??\L: QAiyqi.exe File opened (read-only) \??\O: QAiyqi.exe File opened (read-only) \??\R: QAiyqi.exe File opened (read-only) \??\U: QAiyqi.exe File opened (read-only) \??\B: QAiyqi.exe File opened (read-only) \??\M: QAiyqi.exe File opened (read-only) \??\T: QAiyqi.exe File opened (read-only) \??\V: QAiyqi.exe File opened (read-only) \??\X: QAiyqi.exe File opened (read-only) \??\Y: QAiyqi.exe File opened (read-only) \??\F: QAiyqi.exe File opened (read-only) \??\Z: QAiyqi.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\QAiyqi.exe cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe File opened for modification C:\Windows\SysWOW64\QAiyqi.exe cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 880 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QAiyqi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz QAiyqi.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft QAiyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie QAiyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" QAiyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\SuppressDisableCompositionUI = "0" QAiyqi.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 432 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe 1256 QAiyqi.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 880 QAiyqi.exe 1256 QAiyqi.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3240 wrote to memory of 1200 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 70 PID 3240 wrote to memory of 1200 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 70 PID 3240 wrote to memory of 1200 3240 cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe 70 PID 880 wrote to memory of 1256 880 QAiyqi.exe 71 PID 880 wrote to memory of 1256 880 QAiyqi.exe 71 PID 880 wrote to memory of 1256 880 QAiyqi.exe 71 PID 1200 wrote to memory of 432 1200 cmd.exe 73 PID 1200 wrote to memory of 432 1200 cmd.exe 73 PID 1200 wrote to memory of 432 1200 cmd.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe"C:\Users\Admin\AppData\Local\Temp\cbc999b807e96106a2aa4d457dd51afac52cee174e5f7ed04a5f3a0b74150f5e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CBC999~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:432
-
-
-
C:\Windows\SysWOW64\QAiyqi.exeC:\Windows\SysWOW64\QAiyqi.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\QAiyqi.exeC:\Windows\SysWOW64\QAiyqi.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1256
-