c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Size

479KB
MD5

0f918757d3c47cf961f534fd889861a0
SHA1

fd3dc7155a6cb7baef94e281833e4b63d4765a31
SHA256

c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8
SHA512

ae059d5697f9ee1d600a7f6ab7e63b1ee75d2d87220c80d156e49deac5e45e6c56f406fe909f8f0f2a45ca35ed445d75fa41881cfbd96cde624d4c081fb01ac8
SSDEEP

6144:QdspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70NqT:28kxNhOZElO5kkWjhD4AOj5lG

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\SZH.EXE \"%1\" %*"	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	QHM.EXE

Executes dropped EXE 1 IoCs

pid	Process
1732	QHM.EXE

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1144-54-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-55.dat	upx
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/memory/1732-60-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/memory/1144-61-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SZH.EXE = "C:\\$Recycle.Bin\\SZH.EXE"	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	QHM.EXE

Enumerates connected drives 3 TTPs 36 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	QHM.EXE
File opened (read-only)	\??\S:	QHM.EXE
File opened (read-only)	\??\K:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\R:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\V:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\G:	QHM.EXE
File opened (read-only)	\??\O:	QHM.EXE
File opened (read-only)	\??\E:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\I:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\K:	QHM.EXE
File opened (read-only)	\??\N:	QHM.EXE
File opened (read-only)	\??\R:	QHM.EXE
File opened (read-only)	\??\U:	QHM.EXE
File opened (read-only)	\??\F:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\H:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\L:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\O:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\Q:	QHM.EXE
File opened (read-only)	\??\M:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\P:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\F:	QHM.EXE
File opened (read-only)	\??\L:	QHM.EXE
File opened (read-only)	\??\J:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\N:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\S:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\Q:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\T:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\V:	QHM.EXE
File opened (read-only)	\??\G:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\U:	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File opened (read-only)	\??\E:	QHM.EXE
File opened (read-only)	\??\I:	QHM.EXE
File opened (read-only)	\??\J:	QHM.EXE
File opened (read-only)	\??\M:	QHM.EXE
File opened (read-only)	\??\P:	QHM.EXE
File opened (read-only)	\??\T:	QHM.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HWFIKT.EXE	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
File created	C:\Program Files (x86)\LTJXK.EXE	QHM.EXE

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	QHM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\$Recycle.Bin\\HWFIKT.EXE \"%1\""	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Program Files (x86)\\HWFIKT.EXE %1"	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	QHM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\PerfLogs\\HVX.EXE %1"	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\$Recycle.Bin\\AKC.EXE \"%1\""	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	QHM.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	QHM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\SZH.EXE \"%1\" %*"	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	QHM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1732	1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe	28
PID 1144 wrote to memory of 1732	1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe	28
PID 1144 wrote to memory of 1732	1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe	28
PID 1144 wrote to memory of 1732	1144	c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe	28

C:\Users\Admin\AppData\Local\Temp\c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe
"C:\Users\Admin\AppData\Local\Temp\c57f7218085d06e7f194b12b5a15559f6f1f7a6128fe75445037f2572c60ded8.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1144
- C:\$Recycle.Bin\QHM.EXE
  C:\$Recycle.Bin\QHM.EXE
  2⤵
  - Modifies system executable filetype association
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\QHM.EXE

Filesize
479KB

MD5
b624c02466d3a116543eea655d1d2fa6

SHA1
237b61d12bc59906dc63c43da85173312ee8c7a9

SHA256
514e7318245f6d79722df676d29661f9f0479473a48746831db89f17c86f6e78

SHA512
0b364fcc9fd21417010cd88157600615b8ec4aa0d281fee48b6d79a4c48b977490b6778f44c6d0bbee303410386bfa8166a6df180912cf88ec1b172d3975b167

Download Submit
C:\$Recycle.Bin\QHM.EXE

Filesize
479KB

MD5
b624c02466d3a116543eea655d1d2fa6

SHA1
237b61d12bc59906dc63c43da85173312ee8c7a9

SHA256
514e7318245f6d79722df676d29661f9f0479473a48746831db89f17c86f6e78

SHA512
0b364fcc9fd21417010cd88157600615b8ec4aa0d281fee48b6d79a4c48b977490b6778f44c6d0bbee303410386bfa8166a6df180912cf88ec1b172d3975b167

Download Submit
\$Recycle.Bin\QHM.EXE

Filesize
479KB

MD5
b624c02466d3a116543eea655d1d2fa6

SHA1
237b61d12bc59906dc63c43da85173312ee8c7a9

SHA256
514e7318245f6d79722df676d29661f9f0479473a48746831db89f17c86f6e78

SHA512
0b364fcc9fd21417010cd88157600615b8ec4aa0d281fee48b6d79a4c48b977490b6778f44c6d0bbee303410386bfa8166a6df180912cf88ec1b172d3975b167

Download Submit
\$Recycle.Bin\QHM.EXE

Filesize
479KB

MD5
b624c02466d3a116543eea655d1d2fa6

SHA1
237b61d12bc59906dc63c43da85173312ee8c7a9

SHA256
514e7318245f6d79722df676d29661f9f0479473a48746831db89f17c86f6e78

SHA512
0b364fcc9fd21417010cd88157600615b8ec4aa0d281fee48b6d79a4c48b977490b6778f44c6d0bbee303410386bfa8166a6df180912cf88ec1b172d3975b167

Download Submit
memory/1144-54-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1144-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1732-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads