Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe
-
Size
156KB
-
MD5
5bed80e1ef8747973c96e7deb9c23774
-
SHA1
02e8152c4f06903bedfe135799d10993328b01c3
-
SHA256
921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba
-
SHA512
7c4436b419cbbff003d20de7f696ce72903c150efa04d7cbd7679ff74c787fc62412dc12e1f1c5fe1f983a58f2bc590aaec19615cd10ab3e9b33be50ca1853b4
-
SSDEEP
3072:X0O2WKj5h3QKWXXWXG8FF7K+AmsgE5kEZZZy6x8z4oQZiEPc:TKjX3QKKXWFFF7KlgaS/WO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qjzal.exe -
Executes dropped EXE 1 IoCs
pid Process 5112 qjzal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /h" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /P" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /C" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /V" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /x" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /m" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /X" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /g" 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /e" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /J" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /c" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /M" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /v" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /B" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /b" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /s" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /o" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /I" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /r" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /U" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /q" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /u" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /O" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /R" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /E" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /G" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /i" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /H" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /a" qjzal.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /Y" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /A" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /j" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /W" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /l" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /y" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /L" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /T" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /K" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /D" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /g" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /f" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /z" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /p" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /n" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /F" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /N" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /k" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /d" qjzal.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /S" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /Z" qjzal.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qjzal = "C:\\Users\\Admin\\qjzal.exe /w" qjzal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe 5112 qjzal.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 5112 qjzal.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 884 wrote to memory of 5112 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 81 PID 884 wrote to memory of 5112 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 81 PID 884 wrote to memory of 5112 884 921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe"C:\Users\Admin\AppData\Local\Temp\921193350ef06f783dc078f92015041722cd62454323bd4e41891b3a6f147cba.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\qjzal.exe"C:\Users\Admin\qjzal.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD54d884665d53436189e91be5b5a053e77
SHA1ccc2493325ce3d00e4b2197883438688932581b3
SHA25630eb78bc7011767495a276f198d5a9257835061bab907dde5a01ab2a11a3af26
SHA512aaca117b399fc08087d8f7859742c31a01d33d44d973d40e49d26af96e813d97932b342e256dd195d1363491f807a2bf92bcde42ffd000eb4838e018d1eebe76
-
Filesize
156KB
MD54d884665d53436189e91be5b5a053e77
SHA1ccc2493325ce3d00e4b2197883438688932581b3
SHA25630eb78bc7011767495a276f198d5a9257835061bab907dde5a01ab2a11a3af26
SHA512aaca117b399fc08087d8f7859742c31a01d33d44d973d40e49d26af96e813d97932b342e256dd195d1363491f807a2bf92bcde42ffd000eb4838e018d1eebe76