488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

Analysis

max time kernel
154s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-05-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UQD_211116.exe
Size

11.7MB
MD5

4dadc2245fc209e51d9c22753f5a8eec
SHA1

2e32247294f43fac2edcdd1d044c70b398e03905
SHA256

488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA512

4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Score

10^/10

adware evasion persistence spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Drops file in Drivers directory 2 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	UQD_211116.exe
File created	C:\Windows\System32\drivers\etc\hosts	UQD_211116.exe

Executes dropped EXE 6 IoCs

Processes:

areodgu.exejeeussz.exe~wqqhibq.exe~wqqhibq.exelawczbh.exe~wqqhibq.exe

pid process

3740 areodgu.exe
4008 jeeussz.exe
1620 ~wqqhibq.exe
2172 ~wqqhibq.exe
2548 lawczbh.exe
2408 ~wqqhibq.exe

pid	process
3740	areodgu.exe
4008	jeeussz.exe
1620	~wqqhibq.exe
2172	~wqqhibq.exe
2548	lawczbh.exe
2408	~wqqhibq.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe	upx
C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe	upx
C:\Users\Admin\AppData\Local\Temp\jeeussz.exe	upx
C:\Users\Admin\AppData\Local\Temp\jeeussz.exe	upx
C:\Users\Admin\AppData\Local\Temp\lawczbh.exe	upx
C:\Users\Admin\AppData\Local\Temp\lawczbh.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UQD_211116.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	UQD_211116.exe

Drops startup file 1 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	UQD_211116.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

UQD_211116.exeRundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX	UQD_211116.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	UQD_211116.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	UQD_211116.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	UQD_211116.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Program Files directory 2 IoCs

Processes:

UQD_211116.exe

description	ioc	process
File created	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	UQD_211116.exe
File opened for modification	C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg	UQD_211116.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

UQD_211116.exe~wqqhibq.exe~wqqhibq.exe~wqqhibq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30503"	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~wqqhibq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30503"	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30503"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~wqqhibq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30503"	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30503"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30503"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN	~wqqhibq.exe

Modifies Internet Explorer start page 1 TTPs 3 IoCs

stealer

Modify Registry

T1112

Processes:

UQD_211116.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30503"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30503"	UQD_211116.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30503"	UQD_211116.exe

Modifies registry class 25 IoCs

Processes:

UQD_211116.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\ = "打开主页(&H)"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command\ = "C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,Control_RunDLL C:\\Windows\\SysWOW64\\inetcpl.cpl"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\ = "Internet Explorer"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\ = "在没有加载项的情况下启动"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\ = "属性(&R)"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -extoff"	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\""	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon	UQD_211116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\ieframe.dll,-190"	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command	UQD_211116.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	UQD_211116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	UQD_211116.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3544 PING.EXE

pid	process
3544	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

UQD_211116.exeUQD_211116.exe

pid	process
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2892	UQD_211116.exe
2892	UQD_211116.exe
2892	UQD_211116.exe
2892	UQD_211116.exe
2892	UQD_211116.exe
2892	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

UQD_211116.exeUQD_211116.exeareodgu.exejeeussz.exe~wqqhibq.exe~wqqhibq.exe~wqqhibq.exelawczbh.exe

description	pid	process
Token: SeDebugPrivilege	2040	UQD_211116.exe
Token: SeDebugPrivilege	2892	UQD_211116.exe
Token: SeDebugPrivilege	3740	areodgu.exe
Token: SeDebugPrivilege	4008	jeeussz.exe
Token: SeRestorePrivilege	4008	jeeussz.exe
Token: SeTakeOwnershipPrivilege	4008	jeeussz.exe
Token: SeDebugPrivilege	4008	jeeussz.exe
Token: SeSecurityPrivilege	4008	jeeussz.exe
Token: SeBackupPrivilege	1620	~wqqhibq.exe
Token: SeRestorePrivilege	1620	~wqqhibq.exe
Token: SeTakeOwnershipPrivilege	1620	~wqqhibq.exe
Token: SeBackupPrivilege	2172	~wqqhibq.exe
Token: SeRestorePrivilege	2172	~wqqhibq.exe
Token: SeTakeOwnershipPrivilege	2172	~wqqhibq.exe
Token: SeBackupPrivilege	2408	~wqqhibq.exe
Token: SeRestorePrivilege	2408	~wqqhibq.exe
Token: SeTakeOwnershipPrivilege	2408	~wqqhibq.exe
Token: SeDebugPrivilege	2548	lawczbh.exe
Token: SeRestorePrivilege	2548	lawczbh.exe
Token: SeTakeOwnershipPrivilege	2548	lawczbh.exe
Token: SeDebugPrivilege	2548	lawczbh.exe
Token: SeSecurityPrivilege	2548	lawczbh.exe

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

UQD_211116.exe

pid	process
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

UQD_211116.exe

pid	process
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe
2040	UQD_211116.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

UQD_211116.exeareodgu.execmd.exeRundll32.exerunonce.exe

description	pid	process	target process
PID 2040 wrote to memory of 2892	2040	UQD_211116.exe	UQD_211116.exe
PID 2040 wrote to memory of 2892	2040	UQD_211116.exe	UQD_211116.exe
PID 2040 wrote to memory of 2892	2040	UQD_211116.exe	UQD_211116.exe
PID 2040 wrote to memory of 3740	2040	UQD_211116.exe	areodgu.exe
PID 2040 wrote to memory of 3740	2040	UQD_211116.exe	areodgu.exe
PID 2040 wrote to memory of 3740	2040	UQD_211116.exe	areodgu.exe
PID 2040 wrote to memory of 4008	2040	UQD_211116.exe	jeeussz.exe
PID 2040 wrote to memory of 4008	2040	UQD_211116.exe	jeeussz.exe
PID 2040 wrote to memory of 4008	2040	UQD_211116.exe	jeeussz.exe
PID 3740 wrote to memory of 3712	3740	areodgu.exe	cmd.exe
PID 3740 wrote to memory of 3712	3740	areodgu.exe	cmd.exe
PID 3712 wrote to memory of 3544	3712	cmd.exe	PING.EXE
PID 3712 wrote to memory of 3544	3712	cmd.exe	PING.EXE
PID 2040 wrote to memory of 1620	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 1620	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 2172	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 2172	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 2548	2040	UQD_211116.exe	lawczbh.exe
PID 2040 wrote to memory of 2548	2040	UQD_211116.exe	lawczbh.exe
PID 2040 wrote to memory of 2548	2040	UQD_211116.exe	lawczbh.exe
PID 2040 wrote to memory of 2408	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 2408	2040	UQD_211116.exe	~wqqhibq.exe
PID 2040 wrote to memory of 3188	2040	UQD_211116.exe	Rundll32.exe
PID 2040 wrote to memory of 3188	2040	UQD_211116.exe	Rundll32.exe
PID 3188 wrote to memory of 1224	3188	Rundll32.exe	runonce.exe
PID 3188 wrote to memory of 1224	3188	Rundll32.exe	runonce.exe
PID 1224 wrote to memory of 1216	1224	runonce.exe	grpconv.exe
PID 1224 wrote to memory of 1216	1224	runonce.exe	grpconv.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

UQD_211116.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	UQD_211116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UQD_211116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	UQD_211116.exe

C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe
"C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2040

C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe
C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe /nstart
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe
C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe /nys
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\A49djNi.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\system32\PING.EXE
ping -n 1 127.0.0.1
4⤵
- Runs ping.exe
PID:3544

C:\Users\Admin\AppData\Local\Temp\jeeussz.exe
C:\Users\Admin\AppData\Local\Temp\jeeussz.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Users\Admin\AppData\Local\Temp\lawczbh.exe
C:\Users\Admin\AppData\Local\Temp\lawczbh.exe /HomeRegAccess10
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\SYSTEM32\Rundll32.exe
Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~wfwcwvq.inf
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A49djNi.bat
Filesize
493B

MD5
3ed870de9fdb199fa50a8c5ddf7478e9

SHA1
98b3214651ce834197648cd1ccfe29f9c477e326

SHA256
d7f7935fee159ff76d2dba4a630b03322d7a7c503476ea6cf277bbd57ba4a1fd

SHA512
9461f91f37d8591b1ac70980005e0a2b95a9a88ae2622f705e1f1a72c5ed5583901f0e24d14320cbad7f8dbaedf92932135363cffab08de77a238e7afb7500cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcvtndy\areodgu.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\jeeussz.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\jeeussz.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\lawczbh.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\lawczbh.exe
Filesize
11.7MB

MD5
4dadc2245fc209e51d9c22753f5a8eec

SHA1
2e32247294f43fac2edcdd1d044c70b398e03905

SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70

SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\~wfwcwvq.inf
Filesize
32B

MD5
8f5f4837dd4a1680d79bbdca9cc1e08f

SHA1
688b5d5ef993733b97b303ed4c8409a14b230de5

SHA256
2bce6b9395cc74d16b9c94fd90debd9d524ffb53c6f6ae3a49b6e139671417b2

SHA512
bd75b564fe3c93dffdc65fe58463378f54268308ca5eaba5fc7f80458016f331a6596bfdaf63845c1d5c6c60df2a0ec2aff94d2aae7797da4f5f975f0363bd66

Download Submit
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~wqqhibq.exe
Filesize
546KB

MD5
3e350eb5df15c06dec400a39dd1c6f29

SHA1
f1434cfef2c05fda919922b721ec1a17adb3194e

SHA256
427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

SHA512
b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

Download Submit
memory/1216-153-0x0000000000000000-mapping.dmp

Download
memory/1224-152-0x0000000000000000-mapping.dmp

Download
memory/1620-140-0x0000000000000000-mapping.dmp

Download
memory/2172-143-0x0000000000000000-mapping.dmp

Download
memory/2408-148-0x0000000000000000-mapping.dmp

Download
memory/2548-145-0x0000000000000000-mapping.dmp

Download
memory/2892-130-0x0000000000000000-mapping.dmp

Download
memory/3188-150-0x0000000000000000-mapping.dmp

Download
memory/3544-139-0x0000000000000000-mapping.dmp

Download
memory/3712-137-0x0000000000000000-mapping.dmp

Download
memory/3740-131-0x0000000000000000-mapping.dmp

Download
memory/4008-134-0x0000000000000000-mapping.dmp

Download