Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2022, 18:29

General

  • Target

    75b12244eb2ad3612a39b3cc2902181011c65fbd6911767493d440f4cab3658a.exe

  • Size

    96KB

  • MD5

    005fbdc604317bb6b65aa89721fea7d0

  • SHA1

    1d2ecac549295fd8c2d98396d333198d00b45c7a

  • SHA256

    75b12244eb2ad3612a39b3cc2902181011c65fbd6911767493d440f4cab3658a

  • SHA512

    90bc9b87e16d0b843519a72be53027a5e66937b8b7274839dbc7e0de9f19f1426a57789977cbe72d1ed5f41af1b10c05b29bbe6e8cf322a27bd61de446801a68

  • SSDEEP

    1536:EVQcEVXEsTCfNEHYkJouJjcXCSuyAn7X3i6Emq/d:4mckJouJjcgcd

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75b12244eb2ad3612a39b3cc2902181011c65fbd6911767493d440f4cab3658a.exe
    "C:\Users\Admin\AppData\Local\Temp\75b12244eb2ad3612a39b3cc2902181011c65fbd6911767493d440f4cab3658a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\qiizook.exe
      "C:\Users\Admin\qiizook.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qiizook.exe

    Filesize

    96KB

    MD5

    bf8141eb909a9f5f3b547a58f1e53f14

    SHA1

    971f3e32455f652cd9bdce8a14564b038940837e

    SHA256

    8613b7ee8ba086deeddf5b5a6c71f5897e8297188ad1b179ea5dfb5082d81ca9

    SHA512

    daf92a4d622bf9134187c301b8e744d291230a6c019852afea4f61d203c4c7545ecd8d56726c7e1511d4a550ff8aa3fa2492a17ad4304d2d08ba0a31a48c3af3

  • C:\Users\Admin\qiizook.exe

    Filesize

    96KB

    MD5

    bf8141eb909a9f5f3b547a58f1e53f14

    SHA1

    971f3e32455f652cd9bdce8a14564b038940837e

    SHA256

    8613b7ee8ba086deeddf5b5a6c71f5897e8297188ad1b179ea5dfb5082d81ca9

    SHA512

    daf92a4d622bf9134187c301b8e744d291230a6c019852afea4f61d203c4c7545ecd8d56726c7e1511d4a550ff8aa3fa2492a17ad4304d2d08ba0a31a48c3af3

  • \Users\Admin\qiizook.exe

    Filesize

    96KB

    MD5

    bf8141eb909a9f5f3b547a58f1e53f14

    SHA1

    971f3e32455f652cd9bdce8a14564b038940837e

    SHA256

    8613b7ee8ba086deeddf5b5a6c71f5897e8297188ad1b179ea5dfb5082d81ca9

    SHA512

    daf92a4d622bf9134187c301b8e744d291230a6c019852afea4f61d203c4c7545ecd8d56726c7e1511d4a550ff8aa3fa2492a17ad4304d2d08ba0a31a48c3af3

  • \Users\Admin\qiizook.exe

    Filesize

    96KB

    MD5

    bf8141eb909a9f5f3b547a58f1e53f14

    SHA1

    971f3e32455f652cd9bdce8a14564b038940837e

    SHA256

    8613b7ee8ba086deeddf5b5a6c71f5897e8297188ad1b179ea5dfb5082d81ca9

    SHA512

    daf92a4d622bf9134187c301b8e744d291230a6c019852afea4f61d203c4c7545ecd8d56726c7e1511d4a550ff8aa3fa2492a17ad4304d2d08ba0a31a48c3af3

  • memory/944-66-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/944-72-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1048-56-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1048-64-0x00000000031C0000-0x00000000031DA000-memory.dmp

    Filesize

    104KB

  • memory/1048-65-0x00000000031C0000-0x00000000031DA000-memory.dmp

    Filesize

    104KB

  • memory/1048-57-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/1048-69-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1048-70-0x00000000031C0000-0x00000000031DA000-memory.dmp

    Filesize

    104KB

  • memory/1048-71-0x00000000031C0000-0x00000000031DA000-memory.dmp

    Filesize

    104KB