Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe
-
Size
165KB
-
MD5
a903a386dcc7afd33f77fd116fcb9188
-
SHA1
3735c64def3bc770616c7451a6c06c5166b5ad88
-
SHA256
a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7
-
SHA512
44df8d5ee743fa53c0bc2952937472d4bbbe26f7c41b9951e07a6248157536852ac1338bdf51c56994d7d49d1304602d6048e1fbd8f55c313d8979c727c15cd8
-
SSDEEP
3072:MRRWZxzy0TjPbLJWyylXXaXclnTosZDVlk:9DzbZdy1Gktlk
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\qqmmck.vxd a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E826-2EEF-4435-8748-7639C7C9935F}\ a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E826-2EEF-4435-8748-7639C7C9935F}\InProcServer32 a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E826-2EEF-4435-8748-7639C7C9935F}\InProcServer32\ = "C:\\Windows\\SysWow64\\qqmmck.vxd" a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E826-2EEF-4435-8748-7639C7C9935F}\InProcServer32\ThreadingModel = "Apartment" a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E826-2EEF-4435-8748-7639C7C9935F} a63ab2482495d9cdcb2687bb83cd93bdd512d1aa5ab97312bb6a0240242518a7.exe