Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe
- Size 1.6MB
- Sample220107-kjrwsscae7
- SHA256 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947
- MD5 514257b3833554e107952f7a33c31092
- SHA1 628b7199fbc62d4afe9e9f8f079323dc0a768c8d
- SHA512 2c0b361f120f0ced16e18adb8f089bcfb8252f107443e0cece12a34527ac6b63e4491180ce78dab1ebc382cdaceca410232a1b0cfda198d2eb02cc2dd5ac9b61
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1844 QiQyqi.exe 756 QiQyqi.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: QiQyqi.exe File opened (read-only) \??\N: QiQyqi.exe File opened (read-only) \??\O: QiQyqi.exe File opened (read-only) \??\R: QiQyqi.exe File opened (read-only) \??\Y: QiQyqi.exe File opened (read-only) \??\B: QiQyqi.exe File opened (read-only) \??\I: QiQyqi.exe File opened (read-only) \??\J: QiQyqi.exe File opened (read-only) \??\L: QiQyqi.exe File opened (read-only) \??\S: QiQyqi.exe File opened (read-only) \??\Z: QiQyqi.exe File opened (read-only) \??\F: QiQyqi.exe File opened (read-only) \??\H: QiQyqi.exe File opened (read-only) \??\Q: QiQyqi.exe File opened (read-only) \??\T: QiQyqi.exe File opened (read-only) \??\U: QiQyqi.exe File opened (read-only) \??\W: QiQyqi.exe File opened (read-only) \??\G: QiQyqi.exe File opened (read-only) \??\K: QiQyqi.exe File opened (read-only) \??\V: QiQyqi.exe File opened (read-only) \??\X: QiQyqi.exe File opened (read-only) \??\E: QiQyqi.exe File opened (read-only) \??\P: QiQyqi.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\QiQyqi.exe 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe File opened for modification C:\Windows\SysWOW64\QiQyqi.exe 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
pid Process 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 1844 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 QiQyqi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz QiQyqi.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum QiQyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software QiQyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft QiQyqi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie QiQyqi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" QiQyqi.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3236 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe 756 QiQyqi.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 1844 QiQyqi.exe 756 QiQyqi.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2740 wrote to memory of 3748 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 69 PID 2740 wrote to memory of 3748 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 69 PID 2740 wrote to memory of 3748 2740 03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe 69 PID 1844 wrote to memory of 756 1844 QiQyqi.exe 70 PID 1844 wrote to memory of 756 1844 QiQyqi.exe 70 PID 1844 wrote to memory of 756 1844 QiQyqi.exe 70 PID 3748 wrote to memory of 3236 3748 cmd.exe 72 PID 3748 wrote to memory of 3236 3748 cmd.exe 72 PID 3748 wrote to memory of 3236 3748 cmd.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe"C:\Users\Admin\AppData\Local\Temp\03cf1ab083083cb0b7bc90d18f9f8e3f78504f288daece26bfc0ec96aadd2947.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\03CF1A~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3236
-
-
-
C:\Windows\SysWOW64\QiQyqi.exeC:\Windows\SysWOW64\QiQyqi.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\QiQyqi.exeC:\Windows\SysWOW64\QiQyqi.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:756
-