Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
04/08/2022, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
yQVdMIhcpS.exe
Resource
win7-20220715-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
yQVdMIhcpS.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target yQVdMIhcpS.exe
- Size 423.9MB
- Sample220804-stmc3agch9
- SHA256 6a144aa0c4e1ef719d3f29093da5f306441026e843fa4730bdad7e0cbf331a14
- MD5 61705e04273d88e76d1b36e606f69b56
- SHA1 3c3822bd7cd6fb6479f70fb8345aa23e35ab6c30
- SHA512 727da8852cc0a44d69d210fbf2e197b85661b4b0e395423db0a4d778ea743bb9b3189ac53f79ad451df1f83d281c3f34d55535f66ca2891487dce9613b2588e2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run yQVdMIhcpS.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RadeonSoftware-StartupTask_27PG8DT126894671D3P = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yQVdMIhcpS.exe" yQVdMIhcpS.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RadeonSoftware-StartupTask_4164CD5RH8340SN1 = "cmd.exe /c start C:\\Users\\Admin\\AppData\\Local\\Temp\\yQVdMIhcpS.exe" yQVdMIhcpS.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: yQVdMIhcpS.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ipinfo.io - Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count yQVdMIhcpS.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 yQVdMIhcpS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum yQVdMIhcpS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe 1192 yQVdMIhcpS.exe - Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeDebugPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe Token: 33 1192 yQVdMIhcpS.exe Token: SeIncBasePriorityPrivilege 1192 yQVdMIhcpS.exe