5acd875611e7622ff7b4a922262a49897693943625d5b497f62eb3e7d903b186

Analysis

max time kernel
61s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

豪迪QQ群发7.7 破解版/QS2013.exe
Size

2.2MB
MD5

327f826191b63c077bbe95ef3dd5f63a
SHA1

bec63f9b09f91a4b307ad11619126ace7fe0b18e
SHA256

7e13145fdbdc9cdb8f103f1d654ebbd3188d75274b82298990eda1d9a5667ab2
SHA512

26b647ec8e8a435565ff914133d459c9aa9c58cfef8fa691025b104f356d01ab7d225c243a196a13a595a95bb4aab1942fd6a2619ee30c918368e59130819699
SSDEEP

49152:hDHRzI9C8WN+j65234IPcunLh6X/IwgqGl1WqYQby6WWouFhKUNmRWdiqUbL2Iql:ZHdIMHNgL0udmglGsjUOx

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

QS2013.exe

description ioc process

File opened for modification \??\PhysicalDrive0 QS2013.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

QS2013.exe

pid process

1932 QS2013.exe
1932 QS2013.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 1932 WerFault.exe QS2013.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

QS2013.exe

pid process

1932 QS2013.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	QS2013.exe

pid	process
1932	QS2013.exe
1932	QS2013.exe

pid	pid_target	process	target process
1956	1932	WerFault.exe	QS2013.exe

pid	process
1932	QS2013.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

QS2013.exe

description	pid	process	target process
PID 1932 wrote to memory of 1956	1932	QS2013.exe	WerFault.exe
PID 1932 wrote to memory of 1956	1932	QS2013.exe	WerFault.exe
PID 1932 wrote to memory of 1956	1932	QS2013.exe	WerFault.exe
PID 1932 wrote to memory of 1956	1932	QS2013.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\QS2013.exe
"C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发7.7 破解版\QS2013.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 212
2⤵
- Program crash
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000000020000-0x000000000002F000-memory.dmp

Filesize
60KB

Download
memory/1932-56-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1932-58-0x0000000075C20000-0x0000000075C67000-memory.dmp

Filesize
284KB

Download
memory/1932-392-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1932-467-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-469-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-468-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-466-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-470-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-471-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-472-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-473-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-474-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-475-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-476-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-477-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-478-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-479-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-480-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-481-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-484-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-485-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-483-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-482-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-486-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-487-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-488-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-489-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-491-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-490-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-492-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-493-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-494-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-495-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-496-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-497-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-499-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-498-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-500-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-502-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-501-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-503-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-504-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-505-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-506-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-507-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-508-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-509-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-510-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-511-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-512-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-513-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-515-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-514-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-516-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-517-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-518-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-519-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-520-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-521-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-522-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-523-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-524-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-525-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-1335-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-1336-0x00000000024D0000-0x0000000002651000-memory.dmp

Filesize
1.5MB

Download
memory/1932-2157-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1932-3414-0x0000000002789000-0x000000000278B000-memory.dmp

Filesize
8KB

Download
memory/1932-3947-0x0000000002780000-0x0000000002891000-memory.dmp

Filesize
1.1MB

Download
memory/1932-3948-0x00000000022D0000-0x00000000023D0000-memory.dmp

Filesize
1024KB

Download
memory/1932-5289-0x0000000002660000-0x0000000002761000-memory.dmp

Filesize
1.0MB

Download
memory/1932-5288-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1932-5290-0x00000000023D0000-0x0000000002471000-memory.dmp

Filesize
644KB

Download
memory/1932-5292-0x0000000002789000-0x000000000278B000-memory.dmp

Filesize
8KB

Download
memory/1932-5293-0x00000000022D0000-0x00000000023D0000-memory.dmp

Filesize
1024KB

Download
memory/1932-5294-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1956-5291-0x0000000000000000-mapping.dmp

Download