Analysis
-
max time kernel
171s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
QQת/滻ð.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
QQת/滻ð.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ɳָɼͥͨð1230-1.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ɳָɼͥͨð1230-1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Ϸ.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Ϸ.url
Resource
win10v2004-20221111-en
General
-
Target
ɳָɼͥͨð1230-1.exe
-
Size
2.2MB
-
MD5
eca03a4b24d2a3590a1737bcc552c0fc
-
SHA1
e7cc5d390efad15059f657772cbb38c36df17255
-
SHA256
053ddbf900bade361964f53714cc2e9e61250dd0ba4cc42235558cae141f92fb
-
SHA512
96825e28cc49beab474acb60c20f5a02ec6fec1fd9534bca7f4b57fce259547a519558cc1c5b229b72d7f13f1b47d334efd4d0978ba62328354b7267fce9a97e
-
SSDEEP
49152:pmGHGyDECi3GPTKroiHFsQNiYqKbKxO7rc99cIW/dsd5q:pcyO2PT8ooFNNEKbK4/K9cIfd5q
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
ɳָɼͥͨð1230-1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ɳָɼͥͨð1230-1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ɳָɼͥͨð1230-1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ɳָɼͥͨð1230-1.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
ɳָɼͥͨð1230-1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine ɳָɼͥͨð1230-1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
ɳָɼͥͨð1230-1.exepid process 1176 ɳָɼͥͨð1230-1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
ɳָɼͥͨð1230-1.exeIEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com ɳָɼͥͨð1230-1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com ɳָɼͥͨð1230-1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage ɳָɼͥͨð1230-1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com\NumberOfSubdomains = "1" ɳָɼͥͨð1230-1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{64C2545E-6D4B-11ED-89AC-72E5C3FA065D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ɳָɼͥͨð1230-1.exepid process 1176 ɳָɼͥͨð1230-1.exe 1176 ɳָɼͥͨð1230-1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1584 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
ɳָɼͥͨð1230-1.exeiexplore.exeIEXPLORE.EXEpid process 1176 ɳָɼͥͨð1230-1.exe 1176 ɳָɼͥͨð1230-1.exe 1176 ɳָɼͥͨð1230-1.exe 1176 ɳָɼͥͨð1230-1.exe 1584 iexplore.exe 1584 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
ɳָɼͥͨð1230-1.exeiexplore.exedescription pid process target process PID 1176 wrote to memory of 1584 1176 ɳָɼͥͨð1230-1.exe iexplore.exe PID 1176 wrote to memory of 1584 1176 ɳָɼͥͨð1230-1.exe iexplore.exe PID 1584 wrote to memory of 1716 1584 iexplore.exe IEXPLORE.EXE PID 1584 wrote to memory of 1716 1584 iexplore.exe IEXPLORE.EXE PID 1584 wrote to memory of 1716 1584 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ɳָɼͥͨð1230-1.exe"C:\Users\Admin\AppData\Local\Temp\ɳָɼͥͨð1230-1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.qqwg.cc/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-132-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1176-133-0x00000000772D0000-0x0000000077473000-memory.dmpFilesize
1.6MB
-
memory/1176-134-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1176-135-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1176-136-0x00000000772D0000-0x0000000077473000-memory.dmpFilesize
1.6MB
-
memory/1176-137-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1176-138-0x0000000000400000-0x0000000000809000-memory.dmpFilesize
4.0MB
-
memory/1176-139-0x00000000772D0000-0x0000000077473000-memory.dmpFilesize
1.6MB