Analysis
-
max time kernel
128s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-05-2022 02:20
Static task
static1
Behavioral task
behavioral1
Sample
UQD_211116.exe
Resource
win7-20220414-en
General
-
Target
UQD_211116.exe
-
Size
11.7MB
-
MD5
4dadc2245fc209e51d9c22753f5a8eec
-
SHA1
2e32247294f43fac2edcdd1d044c70b398e03905
-
SHA256
488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
-
SHA512
4d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
UQD_211116.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts UQD_211116.exe File created C:\Windows\System32\drivers\etc\hosts UQD_211116.exe -
Executes dropped EXE 6 IoCs
Processes:
nbqfoet.exeuvnmzmw.exe~bqzqxhj.exe~bqzqxhj.exespnzmez.exe~bqzqxhj.exepid process 4224 nbqfoet.exe 4392 uvnmzmw.exe 888 ~bqzqxhj.exe 3836 ~bqzqxhj.exe 4052 spnzmez.exe 4852 ~bqzqxhj.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exe upx C:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exe upx C:\Users\Admin\AppData\Local\Temp\uvnmzmw.exe upx C:\Users\Admin\AppData\Local\Temp\uvnmzmw.exe upx C:\Users\Admin\AppData\Local\Temp\spnzmez.exe upx C:\Users\Admin\AppData\Local\Temp\spnzmez.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
UQD_211116.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation UQD_211116.exe -
Drops startup file 1 IoCs
Processes:
UQD_211116.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini UQD_211116.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 28 IoCs
Processes:
UQD_211116.exeRundll32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" Rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX UQD_211116.exe Key deleted \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Key deleted \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key deleted \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run UQD_211116.exe Key deleted \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE UQD_211116.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce UQD_211116.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
UQD_211116.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini UQD_211116.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini UQD_211116.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
UQD_211116.exedescription ioc process File opened (read-only) \??\x: UQD_211116.exe File opened (read-only) \??\b: UQD_211116.exe File opened (read-only) \??\o: UQD_211116.exe File opened (read-only) \??\p: UQD_211116.exe File opened (read-only) \??\s: UQD_211116.exe File opened (read-only) \??\q: UQD_211116.exe File opened (read-only) \??\u: UQD_211116.exe File opened (read-only) \??\w: UQD_211116.exe File opened (read-only) \??\y: UQD_211116.exe File opened (read-only) \??\a: UQD_211116.exe File opened (read-only) \??\g: UQD_211116.exe File opened (read-only) \??\j: UQD_211116.exe File opened (read-only) \??\k: UQD_211116.exe File opened (read-only) \??\v: UQD_211116.exe File opened (read-only) \??\z: UQD_211116.exe File opened (read-only) \??\e: UQD_211116.exe File opened (read-only) \??\i: UQD_211116.exe File opened (read-only) \??\m: UQD_211116.exe File opened (read-only) \??\n: UQD_211116.exe File opened (read-only) \??\t: UQD_211116.exe File opened (read-only) \??\f: UQD_211116.exe File opened (read-only) \??\h: UQD_211116.exe File opened (read-only) \??\l: UQD_211116.exe File opened (read-only) \??\r: UQD_211116.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Program Files directory 2 IoCs
Processes:
UQD_211116.exedescription ioc process File created C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg UQD_211116.exe File opened for modification C:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hg UQD_211116.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
runonce.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe -
Processes:
UQD_211116.exe~bqzqxhj.exe~bqzqxhj.exe~bqzqxhj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30519" UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main UQD_211116.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30519" UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30519" UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN ~bqzqxhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN ~bqzqxhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\First Home Page = "http://www.136738.com/?30519" UQD_211116.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30519" UQD_211116.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.136738.com/?30519" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN ~bqzqxhj.exe -
Modifies Internet Explorer start page 1 TTPs 3 IoCs
Processes:
UQD_211116.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30519" UQD_211116.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30519" UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.136738.com/?30519" UQD_211116.exe -
Modifies registry class 25 IoCs
Processes:
UQD_211116.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\ = "Internet Explorer" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\ = "打开主页(&H)" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\DefaultIcon\ = "C:\\Windows\\SysWOW64\\ieframe.dll,-190" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\ = "在没有加载项的情况下启动" UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Open\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\"" UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\ = "属性(&R)" UQD_211116.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82} UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\NoAddOns\Command\ = "\"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" -extoff" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set UQD_211116.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B5EAD1DB-7C18-4954-8820-01733BC08C82}\shell\Set\Command\ = "C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,Control_RunDLL C:\\Windows\\SysWOW64\\inetcpl.cpl" UQD_211116.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 3756 PING.EXE 2900 PING.EXE 3084 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
UQD_211116.exepid process 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
UQD_211116.exepid process 936 UQD_211116.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
UQD_211116.exe~bqzqxhj.exe~bqzqxhj.exeUQD_211116.exenbqfoet.exeuvnmzmw.exespnzmez.exe~bqzqxhj.exedescription pid process Token: SeDebugPrivilege 936 UQD_211116.exe Token: SeBackupPrivilege 888 ~bqzqxhj.exe Token: SeRestorePrivilege 888 ~bqzqxhj.exe Token: SeTakeOwnershipPrivilege 888 ~bqzqxhj.exe Token: SeBackupPrivilege 3836 ~bqzqxhj.exe Token: SeRestorePrivilege 3836 ~bqzqxhj.exe Token: SeTakeOwnershipPrivilege 3836 ~bqzqxhj.exe Token: SeDebugPrivilege 4848 UQD_211116.exe Token: SeDebugPrivilege 4224 nbqfoet.exe Token: SeDebugPrivilege 4392 uvnmzmw.exe Token: SeRestorePrivilege 4392 uvnmzmw.exe Token: SeTakeOwnershipPrivilege 4392 uvnmzmw.exe Token: SeDebugPrivilege 4392 uvnmzmw.exe Token: SeSecurityPrivilege 4392 uvnmzmw.exe Token: SeDebugPrivilege 4052 spnzmez.exe Token: SeRestorePrivilege 4052 spnzmez.exe Token: SeTakeOwnershipPrivilege 4052 spnzmez.exe Token: SeDebugPrivilege 4052 spnzmez.exe Token: SeSecurityPrivilege 4052 spnzmez.exe Token: SeBackupPrivilege 4852 ~bqzqxhj.exe Token: SeRestorePrivilege 4852 ~bqzqxhj.exe Token: SeTakeOwnershipPrivilege 4852 ~bqzqxhj.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
UQD_211116.exepid process 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe -
Suspicious use of SendNotifyMessage 51 IoCs
Processes:
UQD_211116.exepid process 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe 936 UQD_211116.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
UQD_211116.exenbqfoet.execmd.exeRundll32.exerunonce.execmd.execmd.exedescription pid process target process PID 936 wrote to memory of 4848 936 UQD_211116.exe UQD_211116.exe PID 936 wrote to memory of 4848 936 UQD_211116.exe UQD_211116.exe PID 936 wrote to memory of 4848 936 UQD_211116.exe UQD_211116.exe PID 936 wrote to memory of 4224 936 UQD_211116.exe nbqfoet.exe PID 936 wrote to memory of 4224 936 UQD_211116.exe nbqfoet.exe PID 936 wrote to memory of 4224 936 UQD_211116.exe nbqfoet.exe PID 936 wrote to memory of 4392 936 UQD_211116.exe uvnmzmw.exe PID 936 wrote to memory of 4392 936 UQD_211116.exe uvnmzmw.exe PID 936 wrote to memory of 4392 936 UQD_211116.exe uvnmzmw.exe PID 936 wrote to memory of 888 936 UQD_211116.exe ~bqzqxhj.exe PID 936 wrote to memory of 888 936 UQD_211116.exe ~bqzqxhj.exe PID 936 wrote to memory of 3836 936 UQD_211116.exe ~bqzqxhj.exe PID 936 wrote to memory of 3836 936 UQD_211116.exe ~bqzqxhj.exe PID 4224 wrote to memory of 3176 4224 nbqfoet.exe cmd.exe PID 4224 wrote to memory of 3176 4224 nbqfoet.exe cmd.exe PID 3176 wrote to memory of 3756 3176 cmd.exe PING.EXE PID 3176 wrote to memory of 3756 3176 cmd.exe PING.EXE PID 936 wrote to memory of 4052 936 UQD_211116.exe spnzmez.exe PID 936 wrote to memory of 4052 936 UQD_211116.exe spnzmez.exe PID 936 wrote to memory of 4052 936 UQD_211116.exe spnzmez.exe PID 936 wrote to memory of 4852 936 UQD_211116.exe ~bqzqxhj.exe PID 936 wrote to memory of 4852 936 UQD_211116.exe ~bqzqxhj.exe PID 936 wrote to memory of 4200 936 UQD_211116.exe Rundll32.exe PID 936 wrote to memory of 4200 936 UQD_211116.exe Rundll32.exe PID 4200 wrote to memory of 2540 4200 Rundll32.exe runonce.exe PID 4200 wrote to memory of 2540 4200 Rundll32.exe runonce.exe PID 2540 wrote to memory of 716 2540 runonce.exe grpconv.exe PID 2540 wrote to memory of 716 2540 runonce.exe grpconv.exe PID 936 wrote to memory of 4104 936 UQD_211116.exe cmd.exe PID 936 wrote to memory of 4104 936 UQD_211116.exe cmd.exe PID 936 wrote to memory of 4688 936 UQD_211116.exe cmd.exe PID 936 wrote to memory of 4688 936 UQD_211116.exe cmd.exe PID 4104 wrote to memory of 2900 4104 cmd.exe PING.EXE PID 4104 wrote to memory of 2900 4104 cmd.exe PING.EXE PID 4688 wrote to memory of 3084 4688 cmd.exe PING.EXE PID 4688 wrote to memory of 3084 4688 cmd.exe PING.EXE -
System policy modification 1 TTPs 3 IoCs
Processes:
UQD_211116.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" UQD_211116.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System UQD_211116.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" UQD_211116.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe"C:\Users\Admin\AppData\Local\Temp\UQD_211116.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\UQD_211116.exeC:\Users\Admin\AppData\Local\Temp\UQD_211116.exe /nstart2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exeC:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exe /nys2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ucN8TEL.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\uvnmzmw.exeC:\Users\Admin\AppData\Local\Temp\uvnmzmw.exe /HomeRegAccess102⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeC:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeC:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\spnzmez.exeC:\Users\Admin\AppData\Local\Temp\spnzmez.exe /HomeRegAccess102⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeC:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\Rundll32.exeRundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~opfkavk.inf2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\HUpS0gz.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\4Hx43mB.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4Hx43mB.batFilesize
473B
MD5f6cd9532e2288d6d06cbeaa6c76d90f0
SHA17ba6b3546997a32b7f84176d6f090f14c889f46b
SHA25697849a6264afd5a008fdc35837ea7e672eb037be0a0a316b1468d938540b5202
SHA512b979ce778c1e58c0804ec46beab510e1da0bc3c7e7b9eabd22681e989c7f34d48af3321f82b9306b81e8cf3d6e724724d230a63ec7ad8bac4e8fa4bfa80d559a
-
C:\Users\Admin\AppData\Local\Temp\HUpS0gz.batFilesize
465B
MD5194cfa3c64dc63a50ac90a0bfc3eb5f9
SHA1d22526cab206a2e97a4716ca5138509825e33b20
SHA25678223a75fce0e8ff771bf804626969886f777fd5e5713276cf62732114e20455
SHA512664cb4aab83edd31d515a60533f8bae161b0f7c8ff3b983f8a5c23a2dc0546595a5d81521fac271c71713cb82bc5b38be6637da8c164b5f874fa54e98547ebc7
-
C:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\iqmjbxw\nbqfoet.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\spnzmez.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\spnzmez.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\ucN8TEL.batFilesize
493B
MD52fd2ccd93964460fb19f13134f7f7ef0
SHA1b286f2a4e988cf42c078adb88e92d33a7a531148
SHA25694fbdc44833544dbf3eaed51738b10ef1a9bb144e730b22614b2c3e92471f0f3
SHA512735096d450d2a9bbc2d32b38221e86d33110155cf6cc2ce4b5d9e0a706c4cc1f7d7c60f34b07e4eadb52fb00062fb931dbef2b7fc40fb483c17334519dafe1e4
-
C:\Users\Admin\AppData\Local\Temp\uvnmzmw.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\uvnmzmw.exeFilesize
11.7MB
MD54dadc2245fc209e51d9c22753f5a8eec
SHA12e32247294f43fac2edcdd1d044c70b398e03905
SHA256488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70
SHA5124d32dbb195618a4bc0bbeddea954d29ddbc8f1995fe090e54f9a0e41ca2bbc0cfdf8bc9cedb19436e936c59b8de162ed7d41c1537062106b48bf163faf190a14
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeFilesize
546KB
MD53e350eb5df15c06dec400a39dd1c6f29
SHA1f1434cfef2c05fda919922b721ec1a17adb3194e
SHA256427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419
SHA512b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeFilesize
546KB
MD53e350eb5df15c06dec400a39dd1c6f29
SHA1f1434cfef2c05fda919922b721ec1a17adb3194e
SHA256427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419
SHA512b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeFilesize
546KB
MD53e350eb5df15c06dec400a39dd1c6f29
SHA1f1434cfef2c05fda919922b721ec1a17adb3194e
SHA256427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419
SHA512b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6
-
C:\Users\Admin\AppData\Local\Temp\~bqzqxhj.exeFilesize
546KB
MD53e350eb5df15c06dec400a39dd1c6f29
SHA1f1434cfef2c05fda919922b721ec1a17adb3194e
SHA256427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419
SHA512b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6
-
C:\Users\Admin\AppData\Local\Temp\~opfkavk.infFilesize
32B
MD58f5f4837dd4a1680d79bbdca9cc1e08f
SHA1688b5d5ef993733b97b303ed4c8409a14b230de5
SHA2562bce6b9395cc74d16b9c94fd90debd9d524ffb53c6f6ae3a49b6e139671417b2
SHA512bd75b564fe3c93dffdc65fe58463378f54268308ca5eaba5fc7f80458016f331a6596bfdaf63845c1d5c6c60df2a0ec2aff94d2aae7797da4f5f975f0363bd66
-
memory/716-153-0x0000000000000000-mapping.dmp
-
memory/888-137-0x0000000000000000-mapping.dmp
-
memory/2540-152-0x0000000000000000-mapping.dmp
-
memory/2900-157-0x0000000000000000-mapping.dmp
-
memory/3084-159-0x0000000000000000-mapping.dmp
-
memory/3176-142-0x0000000000000000-mapping.dmp
-
memory/3756-144-0x0000000000000000-mapping.dmp
-
memory/3836-140-0x0000000000000000-mapping.dmp
-
memory/4052-145-0x0000000000000000-mapping.dmp
-
memory/4104-154-0x0000000000000000-mapping.dmp
-
memory/4200-150-0x0000000000000000-mapping.dmp
-
memory/4224-131-0x0000000000000000-mapping.dmp
-
memory/4392-134-0x0000000000000000-mapping.dmp
-
memory/4688-155-0x0000000000000000-mapping.dmp
-
memory/4848-130-0x0000000000000000-mapping.dmp
-
memory/4852-148-0x0000000000000000-mapping.dmp