Analysis
-
max time kernel
205s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 10:37
Static task
static1
Behavioral task
behavioral1
Sample
68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe
Resource
win7-20221111-en
General
-
Target
68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe
-
Size
2.6MB
-
MD5
372138948ec17d399fc82ef919ea65b3
-
SHA1
f4e1c87117fcc311f54dc33923728fea0c112842
-
SHA256
68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b
-
SHA512
dedc989462ba73396c1a3ee88b2ece4583fd4363c7dd6a893781c5ef1af97bd34495ae8fd9889bfd82a4646a4d28e8fb95f24c9a338bb008d0dbc73d14cb266a
-
SSDEEP
49152:KlG4F99Cdb5sfelNY/KsZDOfIdDZ7TD11p8MXivSE744G+2/YbQKmYoidpXLRwmh:KlG4F9IdmfelNYJDOo17X1f8cGSNZlKZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
1main.vmp.exeqttxz.exepid process 3708 1main.vmp.exe 4136 qttxz.exe -
Processes:
resource yara_rule behavioral2/memory/3708-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-167-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-177-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-179-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-181-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-183-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3708-184-0x0000000002750000-0x00000000027C2000-memory.dmp upx behavioral2/memory/3708-185-0x0000000002750000-0x00000000027C2000-memory.dmp upx behavioral2/memory/3708-187-0x0000000002750000-0x00000000027C2000-memory.dmp upx behavioral2/memory/3708-189-0x0000000002750000-0x00000000027C2000-memory.dmp upx -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1main.vmp.exe vmprotect C:\Users\Admin\AppData\Local\Temp\1main.vmp.exe vmprotect behavioral2/memory/3708-135-0x0000000000400000-0x0000000000695000-memory.dmp vmprotect behavioral2/memory/3708-148-0x0000000000400000-0x0000000000695000-memory.dmp vmprotect behavioral2/memory/3708-188-0x0000000000400000-0x0000000000695000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1main.vmp.exepid process 3708 1main.vmp.exe -
Drops file in Windows directory 1 IoCs
Processes:
qttxz.exedescription ioc process File opened for modification C:\Windows\s240614781 qttxz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ac175c1c00d901 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998556" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998556" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b080805c1c00d901 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{820C079A-6C0F-11ED-B8D8-66300FA194E6} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f000000000200000000001066000000010000200000007e3d8605b2d7f0203d71e332d3addcdcb8d41d58c6ce5e143636cf2631989e7d000000000e80000000020000200000000f8d1fee81e577bc83868d12569cfeb59543c8aef0468f53a8a7822b0163cf8f200000004c489318c24ba7fde6edd19d2c14c4068458b20276ed35807d2721bf94e019e34000000011408099b6933a0bc602aa776a14ce7f6f25c754f2a6afb56322cf2d7c9aa32a280d2a2c4d5f15add36b4a5b4b3ea6339d5ee0de70517c3e2e8266704efb95d5 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1556774544" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd62b78ee8587e4dac88ae50a840a17f00000000020000000000106600000001000020000000c732a1c11351caffb8162fe354dd42fb7ed69855e28dbcd08c0e5abfc2f66b3c000000000e8000000002000020000000324979d79e4f1824e13751b7d22151aa97b9f666d7619ee01f4a1cc59dae5292200000009bef4f95fa6c5264d60974a1c11f516a5e474f4935134c5fada85cd25b94ab9d400000007b946125923f329b20550f98906af037cc31cb58d8a32575b23d682e66c658772b92f3c49aa84ca346be626b2e05f636b701ee958819f9e89a3d2e4d0142b0d6 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1556774544" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1main.vmp.exepid process 3708 1main.vmp.exe 3708 1main.vmp.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 4908 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
1main.vmp.exeqttxz.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3708 1main.vmp.exe 3708 1main.vmp.exe 4136 qttxz.exe 4136 qttxz.exe 3708 1main.vmp.exe 4908 IEXPLORE.EXE 4908 IEXPLORE.EXE 3708 1main.vmp.exe 3708 1main.vmp.exe 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exeqttxz.exeIEXPLORE.EXEdescription pid process target process PID 3876 wrote to memory of 3708 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe 1main.vmp.exe PID 3876 wrote to memory of 3708 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe 1main.vmp.exe PID 3876 wrote to memory of 3708 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe 1main.vmp.exe PID 3876 wrote to memory of 4136 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe qttxz.exe PID 3876 wrote to memory of 4136 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe qttxz.exe PID 3876 wrote to memory of 4136 3876 68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe qttxz.exe PID 4136 wrote to memory of 4908 4136 qttxz.exe IEXPLORE.EXE PID 4136 wrote to memory of 4908 4136 qttxz.exe IEXPLORE.EXE PID 4136 wrote to memory of 4572 4136 qttxz.exe cmd.exe PID 4136 wrote to memory of 4572 4136 qttxz.exe cmd.exe PID 4136 wrote to memory of 4572 4136 qttxz.exe cmd.exe PID 4908 wrote to memory of 1800 4908 IEXPLORE.EXE IEXPLORE.EXE PID 4908 wrote to memory of 1800 4908 IEXPLORE.EXE IEXPLORE.EXE PID 4908 wrote to memory of 1800 4908 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe"C:\Users\Admin\AppData\Local\Temp\68cf5832d4b74fcfa10bf18e120fd1f20969817e2c0671336f20569dd882385b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1main.vmp.exe"C:\Users\Admin\AppData\Local\Temp\1main.vmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\qttxz.exe"C:\Users\Admin\AppData\Local\Temp\qttxz.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXEopen http://qttxz.haoyue1688.com/qttxz.htm3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4908 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\qttxz.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1main.vmp.exeFilesize
2.3MB
MD576731dd1633e4e558e496760f87166c6
SHA1fc99880bf9910ae76df84e8d9e25e35c23db3064
SHA256fd4af37b1e17c2c6dfe967b428d8f78e3b845083c4a91ec45f0bdf154782b566
SHA51286e3bab9e49167e05f5bde74651e8568b52cc007840ba9a9d9f731b9cf2ecbf0b175ec096baf9b2838c9397ee54fd4d01367f1e9ca24426917346c0af35c6b9e
-
C:\Users\Admin\AppData\Local\Temp\1main.vmp.exeFilesize
2.3MB
MD576731dd1633e4e558e496760f87166c6
SHA1fc99880bf9910ae76df84e8d9e25e35c23db3064
SHA256fd4af37b1e17c2c6dfe967b428d8f78e3b845083c4a91ec45f0bdf154782b566
SHA51286e3bab9e49167e05f5bde74651e8568b52cc007840ba9a9d9f731b9cf2ecbf0b175ec096baf9b2838c9397ee54fd4d01367f1e9ca24426917346c0af35c6b9e
-
C:\Users\Admin\AppData\Local\Temp\qttxz.exeFilesize
2.2MB
MD5431b7cb4420b03df286d30329c3e5e9d
SHA1aa7e96f8d2b7f782c3c1b398f4d0829665b164a9
SHA256d83f014cfc6b36d2547027f2da443aa5c15990b1ba09fdcd0c00470b4e8926f2
SHA512bd845dc57d14b2dc7c4b10f7bd4ed005704ce65821bba3ab36cea3a89d316b1c457f8870dba39dd8b5ab996b3f2b5efc764b82f00328f5f865a30a5e70398700
-
C:\Users\Admin\AppData\Local\Temp\qttxz.exeFilesize
2.2MB
MD5431b7cb4420b03df286d30329c3e5e9d
SHA1aa7e96f8d2b7f782c3c1b398f4d0829665b164a9
SHA256d83f014cfc6b36d2547027f2da443aa5c15990b1ba09fdcd0c00470b4e8926f2
SHA512bd845dc57d14b2dc7c4b10f7bd4ed005704ce65821bba3ab36cea3a89d316b1c457f8870dba39dd8b5ab996b3f2b5efc764b82f00328f5f865a30a5e70398700
-
memory/3708-159-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-163-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-137-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-139-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-135-0x0000000000400000-0x0000000000695000-memory.dmpFilesize
2.6MB
-
memory/3708-143-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-145-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-147-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-148-0x0000000000400000-0x0000000000695000-memory.dmpFilesize
2.6MB
-
memory/3708-151-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-153-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-155-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-157-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-132-0x0000000000000000-mapping.dmp
-
memory/3708-161-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-165-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-189-0x0000000002750000-0x00000000027C2000-memory.dmpFilesize
456KB
-
memory/3708-167-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-169-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-171-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-173-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-175-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-177-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-179-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-181-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-183-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3708-184-0x0000000002750000-0x00000000027C2000-memory.dmpFilesize
456KB
-
memory/3708-185-0x0000000002750000-0x00000000027C2000-memory.dmpFilesize
456KB
-
memory/3708-188-0x0000000000400000-0x0000000000695000-memory.dmpFilesize
2.6MB
-
memory/3708-187-0x0000000002750000-0x00000000027C2000-memory.dmpFilesize
456KB
-
memory/4136-138-0x0000000000000000-mapping.dmp
-
memory/4572-186-0x0000000000000000-mapping.dmp