Analysis
-
max time kernel
148s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe
-
Size
203KB
-
MD5
ec31c7b2f853827ccd78c573265f9c3f
-
SHA1
c006b12716ef9fce677aad9ab99984492adc3fd2
-
SHA256
7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44
-
SHA512
9df0a12462ea635efc9487bab993292cfd5fa1d2eda87cfaae37a3f00a6401012886ecc616bf9d8c8b3a77ec808da709a92099617ea230fe3ef69337469a0e75
-
SSDEEP
6144:TXD8eWfctN54ehNrXTYIE3QcFmms3yKimtSp:TXD8eW0tnYIEAec3M
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2044 QQlive.exe -
Sets DLL path for service in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TCPService\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\Docype.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\metSvcUpdate\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\UPNPhaj.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DHCPLog0n\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\Srvbaf.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\UPNPSysapp\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\Sqlylo.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\UDPServices\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\Seckxn.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RegLog0n\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\NetCC97.dll" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\W32Svc\Parameters\ServiceDll = "C:\\ProgramData\\Microsoft\\Windows\\WNetwyt.dll" QQlive.exe -
Sets service image path in registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RegLog0n\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\W32Svc\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TCPService\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\metSvcUpdate\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DHCPLog0n\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\UPNPSysapp\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\UDPServices\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" QQlive.exe -
Loads dropped DLL 3 IoCs
pid Process 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 2044 QQlive.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_97A2CB43E01F27293633B7B57353C80B svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecisionTime = 900fdabcb704d901 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\c2-9b-92-db-05-ef svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecisionTime = 900fdabcb704d901 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0099000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 916 wrote to memory of 2044 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 27 PID 916 wrote to memory of 2044 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 27 PID 916 wrote to memory of 2044 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 27 PID 916 wrote to memory of 2044 916 7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe"C:\Users\Admin\AppData\Local\Temp\7b06b55321fc80a3c0047a9a158e37bc1383ad8294940e1b0c8628aa2fa01c44.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916 -
C:\ProgramData\Microsoft\Windows\QQlive.exeC:\ProgramData\Microsoft\Windows\QQlive.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
PID:2044
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD5d6dd81f976dbf793df322f4ae779f0dd
SHA1051c8ad764b561eea932573e1bd796fae87c2cf7
SHA2566a31be8366fba742e3995f088c1a0a4abff6e3aeb70a04cdb175b54c36ad7508
SHA5125b52cf250a8b41717556ae0915511010effbc2f49c355872a5925239b2df59a18982df6fd0501a67cbd7d07b1f742cd5f1f7e8e319ff7e3405a6a4a94fd4f02d
-
Filesize
14KB
MD55e95e6131ff0e79ad5df107db915760c
SHA15c3370b98798aab405c724250ab543291fed2fb2
SHA256059ceeede58369f41c5090cc2eb264098ad0a0fd41b14a166e743de41e56f7cf
SHA51207c6cb9faa40b0db3f80bb952a1a4cacdb97025a4c96add3fb67a692c6e8ef4fe19f0eb9727fa019431abd7892f9053662fcf61bf21df65a0630f0af563dda32
-
Filesize
112KB
MD5d6dd81f976dbf793df322f4ae779f0dd
SHA1051c8ad764b561eea932573e1bd796fae87c2cf7
SHA2566a31be8366fba742e3995f088c1a0a4abff6e3aeb70a04cdb175b54c36ad7508
SHA5125b52cf250a8b41717556ae0915511010effbc2f49c355872a5925239b2df59a18982df6fd0501a67cbd7d07b1f742cd5f1f7e8e319ff7e3405a6a4a94fd4f02d
-
Filesize
14KB
MD55e95e6131ff0e79ad5df107db915760c
SHA15c3370b98798aab405c724250ab543291fed2fb2
SHA256059ceeede58369f41c5090cc2eb264098ad0a0fd41b14a166e743de41e56f7cf
SHA51207c6cb9faa40b0db3f80bb952a1a4cacdb97025a4c96add3fb67a692c6e8ef4fe19f0eb9727fa019431abd7892f9053662fcf61bf21df65a0630f0af563dda32
-
Filesize
14KB
MD55e95e6131ff0e79ad5df107db915760c
SHA15c3370b98798aab405c724250ab543291fed2fb2
SHA256059ceeede58369f41c5090cc2eb264098ad0a0fd41b14a166e743de41e56f7cf
SHA51207c6cb9faa40b0db3f80bb952a1a4cacdb97025a4c96add3fb67a692c6e8ef4fe19f0eb9727fa019431abd7892f9053662fcf61bf21df65a0630f0af563dda32