dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3

Analysis

max time kernel
91s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:08

Target

dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe
Size

34KB
MD5

1d327d8c9b18bb7149d7d3395a508aab
SHA1

8c358af5a5da471c2a266bca08b88bc0465cbc18
SHA256

dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3
SHA512

d659be63c99ede00518e702763fe29b7853becc45433a017790bf84089d8a29d42b3d6d85684efed70392f6a446f7ea3bc55a2d998e15588534b3539306f420d
SSDEEP

768:W/H5FyHlSh9squ1AfNCGRlgOpNI7+fd/xfTHefirw5:yH5FyH0h9sgNCGbgOpNI7+fFJEi

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

qiqaiy.exe

pid process

3192 qiqaiy.exe
Loads dropped DLL 1 IoCs

Processes:

qiqaiy.exe

pid process

3192 qiqaiy.exe

pid	process
3192	qiqaiy.exe

pid	process
3192	qiqaiy.exe

Drops file in System32 directory 3 IoCs

Processes:

dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exeqiqaiy.exe

description	ioc	process
File created	C:\Windows\SysWOW64\qiqaiy.exe	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe
File opened for modification	C:\Windows\SysWOW64\qiqaiy.exe	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe
File created	C:\Windows\SysWOW64\hra8.dll	qiqaiy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe

description pid process

Token: SeIncBasePriorityPrivilege 3836 dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3836	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe

description	pid	process	target process
PID 3836 wrote to memory of 4596	3836	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe	cmd.exe
PID 3836 wrote to memory of 4596	3836	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe	cmd.exe
PID 3836 wrote to memory of 4596	3836	dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\DD1BB3~1.EXE > nul
2⤵
PID:4596

C:\Windows\SysWOW64\hra8.dll

Filesize
43KB

MD5
c4fe291af01856a495db57a491bf0e32

SHA1
1724fed510813eb56179a33e00ca7e1d776fff95

SHA256
e7d911f45550b454c94b89517aea8836f1d2acd9b35d5b0286a163b27ac87d75

SHA512
856c1c4c98f21b9a1d60b8e4bfee80bb6dffbb3d2407a3b023a675fd698022e6bb720783ff9d03b4c5fb8b731d3fac9ff5bb297a2271d118c0233f4f440ca024

Download Submit
C:\Windows\SysWOW64\qiqaiy.exe

Filesize
34KB

MD5
1d327d8c9b18bb7149d7d3395a508aab

SHA1
8c358af5a5da471c2a266bca08b88bc0465cbc18

SHA256
dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3

SHA512
d659be63c99ede00518e702763fe29b7853becc45433a017790bf84089d8a29d42b3d6d85684efed70392f6a446f7ea3bc55a2d998e15588534b3539306f420d

Download Submit
C:\Windows\SysWOW64\qiqaiy.exe

Filesize
34KB

MD5
1d327d8c9b18bb7149d7d3395a508aab

SHA1
8c358af5a5da471c2a266bca08b88bc0465cbc18

SHA256
dd1bb3afbf96c822af8d5b8633e265621dc997a1e78e882f081124e255df59b3

SHA512
d659be63c99ede00518e702763fe29b7853becc45433a017790bf84089d8a29d42b3d6d85684efed70392f6a446f7ea3bc55a2d998e15588534b3539306f420d

Download Submit
memory/4596-134-0x0000000000000000-mapping.dmp

Download