Analysis
-
max time kernel
151s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 03:17
General
-
Target
30f056456e85b4375c34fbfca57a634b28fa3f8f7eb1c258392a83d799f89f72.exe
-
Size
28KB
-
MD5
71f6171d29c04e7ba2aa8830ba4122de
-
SHA1
c4c2516d0b56d8bca9a51502486d2c4227b86f29
-
SHA256
30f056456e85b4375c34fbfca57a634b28fa3f8f7eb1c258392a83d799f89f72
-
SHA512
c4b90a91374935571de8f84a7bcc441c0a79efa8852a8821b834cea7870713ccd92358df593b9d1299522096a467083316c61b02dbf1d08842644ccc505d7463
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 43 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30f056456e85b4375c34fbfca57a634b28fa3f8f7eb1c258392a83d799f89f72.exe"C:\Users\Admin\AppData\Local\Temp\30f056456e85b4375c34fbfca57a634b28fa3f8f7eb1c258392a83d799f89f72.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QQBrowser_Setup_10.5.3869_1100110740.exeC:\Users\Admin\AppData\Local\Temp/QQBrowser_Setup_10.5.3869_1100110740.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exe"C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exe" pin "C:\Users\Admin\AppData\Local\Temp\14abe56d2c6\QQ浏览器.lnk"3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exe"C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exe" pin_start "C:\Users\Admin\AppData\Local\Temp\14abe56d2c6\QQ浏览器.lnk"3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\F1Assistant.dllFilesize
5.3MB
MD509f90156bcb0f9686ffff2cde3860788
SHA1e1fb137b7c81cd1f72322956757b729d8985ebbb
SHA256fd35fef15f2145ac5247133b93a57ebe3f8caad04148d654bc5334833b827b87
SHA512e2b0eb09ed6d3661a098e7a92069d51a4bc3aa1e69e69ede7d5e76f5be77d7edebd43d9a0917cab8494f5180bdd0b4dcaa23edfe56fa2ec4669d6032657fe5f1
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exeFilesize
138KB
MD53126674c646133739fd0d7b8b7fe03c1
SHA1ddcb79d99f637e540983d788840c0d1199261eb7
SHA256f5f14299e79074e68ae72ad1e7d934850a6850758af605b7fd50aab549b83d99
SHA512a6d4059ada182428c93c779f119097cc548e833f5db4ce1c04772d3155a8787b53919c346a9fe828b8eb01c4ecdb44c7df8bb99688387fa4d979d2a62caa693b
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exeFilesize
138KB
MD53126674c646133739fd0d7b8b7fe03c1
SHA1ddcb79d99f637e540983d788840c0d1199261eb7
SHA256f5f14299e79074e68ae72ad1e7d934850a6850758af605b7fd50aab549b83d99
SHA512a6d4059ada182428c93c779f119097cc548e833f5db4ce1c04772d3155a8787b53919c346a9fe828b8eb01c4ecdb44c7df8bb99688387fa4d979d2a62caa693b
-
C:\Program Files (x86)\Tencent\QQBrowser\10.5.3869.400\QBPin.exeFilesize
138KB
MD53126674c646133739fd0d7b8b7fe03c1
SHA1ddcb79d99f637e540983d788840c0d1199261eb7
SHA256f5f14299e79074e68ae72ad1e7d934850a6850758af605b7fd50aab549b83d99
SHA512a6d4059ada182428c93c779f119097cc548e833f5db4ce1c04772d3155a8787b53919c346a9fe828b8eb01c4ecdb44c7df8bb99688387fa4d979d2a62caa693b
-
C:\Users\Admin\AppData\Local\Temp\14abe56d2c6\QQ浏览器.lnkFilesize
2KB
MD5e2f8dbb41cf18fba74ee8575997c2e07
SHA1f7b779ef6dbb860a280fc3d60aaa3f5bfcd888a3
SHA256b1ccb7d3772db37ff60efa1ef83a5a034ef1cf9a33708503d7144804a702d576
SHA51268f957bf830f1c9e7259f8aa9229cad34157abb41679138a85a61fb1502ba1d5f81fdc0ac476ee707f5ee3d32d1ebe2a96a300f1c61a8d5675cfadbda263f377
-
C:\Users\Admin\AppData\Local\Temp\QQBrowser_Setup_10.5.3869_1100110740.exeFilesize
78.9MB
MD5282dc7b3c792de1cb65f59602f394e28
SHA10a6f0a6f22534ef90282ba94d6562ffd0780e5e5
SHA256f439e5cb87d8c25913cbadb6a57b41b725ee526dedc24c1c26678bf5c4f1f078
SHA512fcf2c1df37adaa6ae650964d541622a7c63f96937c691614773dff8a14b580c287dc4e751326966399ddc02d36fde0abb72e267bb1343f6aa4bf4c07e7f3b324
-
C:\Users\Admin\AppData\Local\Temp\QQBrowser_Setup_10.5.3869_1100110740.exeFilesize
78.9MB
MD5282dc7b3c792de1cb65f59602f394e28
SHA10a6f0a6f22534ef90282ba94d6562ffd0780e5e5
SHA256f439e5cb87d8c25913cbadb6a57b41b725ee526dedc24c1c26678bf5c4f1f078
SHA512fcf2c1df37adaa6ae650964d541622a7c63f96937c691614773dff8a14b580c287dc4e751326966399ddc02d36fde0abb72e267bb1343f6aa4bf4c07e7f3b324
-
memory/1540-135-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1540-137-0x000000006FFE0000-0x000000006FFF0000-memory.dmpFilesize
64KB
-
memory/1540-132-0x0000000000000000-mapping.dmp
-
memory/2044-138-0x0000000000000000-mapping.dmp
-
memory/2044-141-0x00007FFE32330000-0x00007FFE32340000-memory.dmpFilesize
64KB
-
memory/3340-143-0x0000000000000000-mapping.dmp