86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe
Size

24KB
MD5

decee0f98c9df60910ba7f98104ffedf
SHA1

3088c3329d65c6f5dce1e6a280e28de9947632ae
SHA256

86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae
SHA512

f115d950afcada6acdd4f74683d199f9414085eed3eaae6f8dc5923e7929d668605d5dfe687968ff91bb643e8befea6b29df02f0bfa5549c3f1acc6073cfe45a
SSDEEP

384:nN2qmH/zQBsI7F2OVWXIQjGMDKHs2Kuq2uP:n8ffIR2OwXIyh7Hp

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\baiduqq = "C:\\Program Files\\Common Files\\qq.exe"	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\qq.exe	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1236	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe
1236	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe
1236	86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe

C:\Users\Admin\AppData\Local\Temp\86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe
"C:\Users\Admin\AppData\Local\Temp\86233e5a95030fdd0c4109ab24e0e8092864250b03344fd6abaca34a569e50ae.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads