4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660

Analysis

max time kernel
124s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 13:10

Target

4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660.exe
Size

236KB
MD5

0e180c1adc2a94bb19cbd71afba95ae0
SHA1

10707267ffbf8b849720d45b2c9c0ef9544c20eb
SHA256

4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660
SHA512

14147168b8d6b82782a7c18055acdab7198240379b656262fa1ce5e7b37ba632760128bb801d20a3a6c9e1d04a3be479d42bc2d05857bec3c0a6f1d6f0c896cd
SSDEEP

6144:7qoMVYqnLDTqxgOMgrr86YuYp8Wds+uqG+zy9u2oxB+ul:75MVpLDOxgOMeA6Y/8Op2Q2B

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3728	Iqeeqjy.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	Iqeeqjy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	Iqeeqjy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	Iqeeqjy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	Iqeeqjy.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Iqeeqjy.exe	4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660.exe
File opened for modification	C:\Windows\Iqeeqjy.exe	4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Iqeeqjy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Iqeeqjy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Iqeeqjy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Iqeeqjy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Iqeeqjy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Iqeeqjy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Iqeeqjy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Iqeeqjy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4440	4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660.exe
4440	4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660.exe

C:\Windows\Iqeeqjy.exe

Filesize
236KB

MD5
0e180c1adc2a94bb19cbd71afba95ae0

SHA1
10707267ffbf8b849720d45b2c9c0ef9544c20eb

SHA256
4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660

SHA512
14147168b8d6b82782a7c18055acdab7198240379b656262fa1ce5e7b37ba632760128bb801d20a3a6c9e1d04a3be479d42bc2d05857bec3c0a6f1d6f0c896cd

Download Submit
C:\Windows\Iqeeqjy.exe

Filesize
236KB

MD5
0e180c1adc2a94bb19cbd71afba95ae0

SHA1
10707267ffbf8b849720d45b2c9c0ef9544c20eb

SHA256
4eaf7c54656f6b2be533089a77a192b475574d28c964a23729249674ae2e0660

SHA512
14147168b8d6b82782a7c18055acdab7198240379b656262fa1ce5e7b37ba632760128bb801d20a3a6c9e1d04a3be479d42bc2d05857bec3c0a6f1d6f0c896cd

Download Submit