Analysis

  • max time kernel
    3s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2022 20:56

General

  • Target

    f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe

  • Size

    72KB

  • MD5

    0edc99bedc614907cc0f2b9684e5cb96

  • SHA1

    2a4437a6bfe5e7fee750969481a1b3c53db59dba

  • SHA256

    f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754

  • SHA512

    12de5a04ce562e98d7ff7b5cec4dfb3f9f794244f8d13eb2a92f159be97a1d8fadca75bed0364a284bb4a6d02ac0f4da74fa907bc82d491cdad5781e0a77aeda

  • SSDEEP

    768:pOEh6izFHJScmhLd0UeWjR47w8HYyGaui2HxFZEu6+01iko9nX+ikCO+fSUzXh:px3XTAar2H3ZD6+gDog+fSqh

Score
8/10

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe
    "C:\Users\Admin\AppData\Local\Temp\f1c0ce551cee4974dc9dc20b1548b8ed3d7796b47f7692d58704953e31b48754.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1424
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\system32\takeown.exe /f "C:\Windows\system32\qqnt.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4964
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\system32\icacls.exe "C:\Windows\system32\qqnt.exe" /grant SYSTEM:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:4540

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\qqnt.exe
    Filesize

    30KB

    MD5

    a3661e7f90f9a87d1e0cbb2006545a8f

    SHA1

    0104b406c8d752340f95a9db90a18d2a690a3256

    SHA256

    53ba9518bcc9eaaa7b82230029775da62b7bc07d29cf779a528ae2fb79ae0b01

    SHA512

    518f50c1dd389b4593fcd7d94972082fc26c67c8e54a47fd22d0a82616d3e0e879d76a370c62a0faa7a4658373b8f9a05c538b847adaa56faad6df37ccfffc14

  • memory/4540-136-0x0000000000000000-mapping.dmp
  • memory/4964-134-0x0000000000000000-mapping.dmp