Analysis
-
max time kernel
171s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 18:30
General
-
Target
QQɳ̳ǸV2.3.exe
-
Size
2.1MB
-
MD5
ca5eec20e4b95edef98d7d4fe597f749
-
SHA1
663f6ee4079f771007aebae035954d9940137981
-
SHA256
48f126e6278b49049fe92d9e0f2d59be98c6167e547ae155ebb87afdb18a4821
-
SHA512
225877f68a30e914980d1e60d9302d0f9f4942a16a70070eb08e7421b33583e2464a049c09f11329cf7bb9b32691952abaa48ae017c858f3aef8a328a258b98a
-
SSDEEP
49152:AiHbSYUgLJ3nnjpR92uszYHoaR/daNcVh:ogLBnT4qoa+NcV
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer start page 1 TTPs 3 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QQɳ̳ǸV2.3.exe"C:\Users\Admin\AppData\Local\Temp\QQɳ̳ǸV2.3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5033d1db88147b6dab9a1795027a87e74
SHA1f6e9f5e82af3e9546711d42aab705a494e851d44
SHA256a85b830cec14449763cc174d600324372798f2bb8c5276546419cc6b2563db1c
SHA5127689fc5812fc89e27f5691259c15e4109b3ecfd1933393e1d9ce2d63acc37149aa4cf6124c353b62b39352162e9509d7b49caeaabc1618c8e495a14cef095e33
-
Filesize
188KB
MD53b9d965e5ec4fa1ac42029db187411d7
SHA11cab1712324a7b0ca0747b9bbdd07fd692783993
SHA256cae1507b787ec5fdbae3f5485281466eeff3f3ccb3b5a1ee8bd3a2d03021aba7
SHA512b4f87ac8aad300a169d30dee16eea0b604ed382c16d1e58d847ef257d233acc89acc2f6b5d030ec782dd3518b91dff7fd44f52188a184423f0bd3ff8b90e92c6
-
Filesize
8KB
-
Filesize
680KB
-
Filesize
2.3MB
-
Filesize
680KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
2.3MB