Analysis

  • max time kernel
    37s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2022 20:56

General

  • Target

    f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe

  • Size

    72KB

  • MD5

    0edc99bedc614907cc0f2b9684e5cb96

  • SHA1

    2a4437a6bfe5e7fee750969481a1b3c53db59dba

  • SHA256

    f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754

  • SHA512

    12de5a04ce562e98d7ff7b5cec4dfb3f9f794244f8d13eb2a92f159be97a1d8fadca75bed0364a284bb4a6d02ac0f4da74fa907bc82d491cdad5781e0a77aeda

  • SSDEEP

    768:pOEh6izFHJScmhLd0UeWjR47w8HYyGaui2HxFZEu6+01iko9nX+ikCO+fSUzXh:px3XTAar2H3ZD6+gDog+fSqh

Score
8/10

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe
    "C:\Users\Admin\AppData\Local\Temp\f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\system32\takeown.exe /f "C:\Windows\system32\qqnt.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:1860
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\system32\icacls.exe "C:\Windows\system32\qqnt.exe" /grant SYSTEM:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\qqnt.exe
    Filesize

    72KB

    MD5

    0edc99bedc614907cc0f2b9684e5cb96

    SHA1

    2a4437a6bfe5e7fee750969481a1b3c53db59dba

    SHA256

    f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754

    SHA512

    12de5a04ce562e98d7ff7b5cec4dfb3f9f794244f8d13eb2a92f159be97a1d8fadca75bed0364a284bb4a6d02ac0f4da74fa907bc82d491cdad5781e0a77aeda

  • memory/1200-59-0x0000000000000000-mapping.dmp
  • memory/1860-57-0x0000000000000000-mapping.dmp
  • memory/1928-56-0x00000000762B1000-0x00000000762B3000-memory.dmp
    Filesize

    8KB