13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

Analysis

max time kernel
142s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
Size

118KB
MD5

0c03cc31ea5d181ffdffe9ad79c9b4da
SHA1

47080fe216461fd71aa84599a25867d54e6d1dc4
SHA256

13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2
SHA512

4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92
SSDEEP

3072:CIbejFUgxHiR1eNUB/1zc8OeudFKu3hu8sU6TuYd:HbwUgxCRwNUBdUdQuxls5Jd

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1472	Bqwlwm.exe
612	Bqwlwm.exe

Loads dropped DLL 2 IoCs

pid	Process
1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bqwlwm = "C:\\Users\\Admin\\AppData\\Roaming\\Bqwlwm.exe"	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1472 set thread context of 612	1472	Bqwlwm.exe	29

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06A5F920-5753-11ED-84F9-5A21EB137514} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373789951"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	Bqwlwm.exe
Token: SeDebugPrivilege	1724	iexplore.exe
Token: SeDebugPrivilege	612	Bqwlwm.exe
Token: SeDebugPrivilege	824	IEXPLORE.EXE
Token: SeDebugPrivilege	824	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
824	IEXPLORE.EXE
824	IEXPLORE.EXE
824	IEXPLORE.EXE
824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1044 wrote to memory of 1876	1044	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	27
PID 1876 wrote to memory of 1472	1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	28
PID 1876 wrote to memory of 1472	1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	28
PID 1876 wrote to memory of 1472	1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	28
PID 1876 wrote to memory of 1472	1876	13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe	28
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 1472 wrote to memory of 612	1472	Bqwlwm.exe	29
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 1724 wrote to memory of 1232	1724	iexplore.exe	31
PID 1724 wrote to memory of 1232	1724	iexplore.exe	31
PID 1724 wrote to memory of 1232	1724	iexplore.exe	31
PID 1724 wrote to memory of 1232	1724	iexplore.exe	31
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 612 wrote to memory of 1724	612	Bqwlwm.exe	30
PID 1724 wrote to memory of 612	1724	iexplore.exe	29
PID 1724 wrote to memory of 612	1724	iexplore.exe	29
PID 1232 wrote to memory of 824	1232	IEXPLORE.EXE	33
PID 1232 wrote to memory of 824	1232	IEXPLORE.EXE	33
PID 1232 wrote to memory of 824	1232	IEXPLORE.EXE	33
PID 1232 wrote to memory of 824	1232	IEXPLORE.EXE	33
PID 1724 wrote to memory of 824	1724	iexplore.exe	33
PID 1724 wrote to memory of 824	1724	iexplore.exe	33
PID 612 wrote to memory of 824	612	Bqwlwm.exe	33
PID 612 wrote to memory of 824	612	Bqwlwm.exe	33

C:\Users\Admin\AppData\Local\Temp\13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
"C:\Users\Admin\AppData\Local\Temp\13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
  C:\Users\Admin\AppData\Local\Temp\13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Users\Admin\AppData\Roaming\Bqwlwm.exe
    "C:\Users\Admin\AppData\Roaming\Bqwlwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Users\Admin\AppData\Roaming\Bqwlwm.exe
      C:\Users\Admin\AppData\Roaming\Bqwlwm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:612
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bqwlwm.exe

Filesize
118KB

MD5
0c03cc31ea5d181ffdffe9ad79c9b4da

SHA1
47080fe216461fd71aa84599a25867d54e6d1dc4

SHA256
13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

SHA512
4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92

Download Submit
C:\Users\Admin\AppData\Roaming\Bqwlwm.exe

Filesize
118KB

MD5
0c03cc31ea5d181ffdffe9ad79c9b4da

SHA1
47080fe216461fd71aa84599a25867d54e6d1dc4

SHA256
13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

SHA512
4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92

Download Submit
C:\Users\Admin\AppData\Roaming\Bqwlwm.exe

Filesize
118KB

MD5
0c03cc31ea5d181ffdffe9ad79c9b4da

SHA1
47080fe216461fd71aa84599a25867d54e6d1dc4

SHA256
13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

SHA512
4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J24OHB1I.txt

Filesize
606B

MD5
0c0b9b9c2f1a6fa1243fd303a1344194

SHA1
3ec6c3464e45f70e92e779f7b563d9b98b97a452

SHA256
f67bb757d0d0e0ec690d878f12c39592e49b70c7c3e96e1099f0083c65f82406

SHA512
23be0cac5eec72e17f2a8c836f847da1bcc0466e8c9e056728a0f6be938aa02589ed07ca127ff678c559b40e06ceba38e9aa9597248d65219bdb2b8adcd165b3

Download Submit
\Users\Admin\AppData\Roaming\Bqwlwm.exe

Filesize
118KB

MD5
0c03cc31ea5d181ffdffe9ad79c9b4da

SHA1
47080fe216461fd71aa84599a25867d54e6d1dc4

SHA256
13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

SHA512
4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92

Download Submit
\Users\Admin\AppData\Roaming\Bqwlwm.exe

Filesize
118KB

MD5
0c03cc31ea5d181ffdffe9ad79c9b4da

SHA1
47080fe216461fd71aa84599a25867d54e6d1dc4

SHA256
13943d488b77ad276a79458797c89d49f65334672398d1dec0b56da7c8ec0da2

SHA512
4c920b011aa29e4d51af164612100091d6bf37662633f0c9e5d320e36a6b3cb6de487cf19f6314847fe4ec21b37498b6e6bffff94dc040165b5ddd4294cdff92

Download Submit
memory/612-88-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-96-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-147-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/612-146-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-130-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-126-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-128-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-122-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-124-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-69-0x000000000040B200-mapping.dmp

Download
memory/612-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/612-76-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-78-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-82-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-80-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-86-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-84-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-90-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-118-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-94-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-92-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-120-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-98-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-102-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-100-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-106-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-104-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-110-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-108-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-114-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-112-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/612-116-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/1044-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1472-63-0x0000000000000000-mapping.dmp

Download
memory/1472-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1472-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1876-55-0x000000000040B200-mapping.dmp

Download
memory/1876-58-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1876-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1876-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1876-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1876-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download