Analysis
-
max time kernel
153s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe
-
Size
236KB
-
MD5
68a7dfb2d90d5fc1766abacd3035b2a0
-
SHA1
fb0ada1f7a2a68fb4378c770b77ee75f4f203a18
-
SHA256
870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce
-
SHA512
4005820031d2c9254dbcf0c69c8e839647bbcec8c027247e5fd6837620f8231318793ec5b9ce700143645e04e396f9ae42a90bcd15261fa4125df8eb4dd967a4
-
SSDEEP
3072:rdNh0TwKzzGKXW28oYLVp0uP5cPLa6KMWM+x2rfdnpcJMyaegtmNbW6grc:rtpmzGXoYZpDPCPLa64fmdK+dtEx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qnzez.exe -
Executes dropped EXE 1 IoCs
pid Process 1576 qnzez.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /e" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /s" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /w" 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /b" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /f" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /r" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /w" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /y" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /a" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /d" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /t" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /h" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /z" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /i" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /v" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /l" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /k" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /m" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /g" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /p" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /c" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /q" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /x" qnzez.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /j" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /n" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /o" qnzez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnzez = "C:\\Users\\Admin\\qnzez.exe /u" qnzez.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe 1576 qnzez.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 1576 qnzez.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5008 wrote to memory of 1576 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 81 PID 5008 wrote to memory of 1576 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 81 PID 5008 wrote to memory of 1576 5008 870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe"C:\Users\Admin\AppData\Local\Temp\870a0ffa27ac477069085a11d2a92f738021fef4541a9ac2355a36e43a3f9fce.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\qnzez.exe"C:\Users\Admin\qnzez.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5ff0e20ebd594214dabe7412e4ecce5cc
SHA16ab1194ec6aa92efc36cce16a78b2f3873fc43d3
SHA256de06273c2d0eeb40e26dfa9853c4384dbb0b0794e0032efd906d323f1d3d69c3
SHA512ebfc5fad2ab5cabc70a0f91ede38c7d857dad6db6aae2553b92f21b3a36441d250821a32cfcdde1f453650ed4ab8b83c751ded055f7050dbce49b0c0fa3f8331
-
Filesize
236KB
MD5ff0e20ebd594214dabe7412e4ecce5cc
SHA16ab1194ec6aa92efc36cce16a78b2f3873fc43d3
SHA256de06273c2d0eeb40e26dfa9853c4384dbb0b0794e0032efd906d323f1d3d69c3
SHA512ebfc5fad2ab5cabc70a0f91ede38c7d857dad6db6aae2553b92f21b3a36441d250821a32cfcdde1f453650ed4ab8b83c751ded055f7050dbce49b0c0fa3f8331