74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca

Analysis

max time kernel
187s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:19

Target

74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
Size

472KB
MD5

5460113722a8266a86734b3283991920
SHA1

741308a9ea26c5e14935e036a36225aa4f219132
SHA256

74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca
SHA512

d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33
SSDEEP

12288:GmNQoc2wgN+SnjAkv1DpZeED4m7hoaiRsQ2pGgHx+i:Gm+otN+SnJVZXLhotszEgHx+i

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5076	Qmkhqqy.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	Qmkhqqy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	Qmkhqqy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	Qmkhqqy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	Qmkhqqy.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Qmkhqqy.exe	74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
File opened for modification	C:\Windows\Qmkhqqy.exe	74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Qmkhqqy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Qmkhqqy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Qmkhqqy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Qmkhqqy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Qmkhqqy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Qmkhqqy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Qmkhqqy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Qmkhqqy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
4604	74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe

C:\Windows\Qmkhqqy.exe

Filesize
472KB

MD5
5460113722a8266a86734b3283991920

SHA1
741308a9ea26c5e14935e036a36225aa4f219132

SHA256
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca

SHA512
d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33

Download Submit
C:\Windows\Qmkhqqy.exe

Filesize
472KB

MD5
5460113722a8266a86734b3283991920

SHA1
741308a9ea26c5e14935e036a36225aa4f219132

SHA256
74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca

SHA512
d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33

Download Submit
memory/4604-132-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4604-133-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4604-137-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/5076-136-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download