Analysis
-
max time kernel
207s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 17:52
Static task
static1
Behavioral task
behavioral1
Sample
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe
Resource
win10v2004-20221111-en
General
-
Target
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe
-
Size
366KB
-
MD5
b8db5c8ec77ed7c230b370c7d13cf9c9
-
SHA1
d1aaabc0da38a38f8489672435946fdaa94756b3
-
SHA256
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
-
SHA512
f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
SSDEEP
6144:ushDi0yVamQKqcnfsuSLY/CkHkh3t8E8vxsKlskH:usEVVanZceCeh3tmTH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qqtnhasj.exepid process 1340 qqtnhasj.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1164 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeqqtnhasj.exepid process 1164 cmd.exe 1164 cmd.exe 1340 qqtnhasj.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 568 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
qqtnhasj.exepid process 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 568 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
qqtnhasj.exepid process 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
qqtnhasj.exepid process 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe 1340 qqtnhasj.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.execmd.exedescription pid process target process PID 1384 wrote to memory of 1164 1384 d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe cmd.exe PID 1384 wrote to memory of 1164 1384 d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe cmd.exe PID 1384 wrote to memory of 1164 1384 d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe cmd.exe PID 1384 wrote to memory of 1164 1384 d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe cmd.exe PID 1164 wrote to memory of 568 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 568 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 568 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 568 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 284 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 284 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 284 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 284 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 1340 1164 cmd.exe qqtnhasj.exe PID 1164 wrote to memory of 1340 1164 cmd.exe qqtnhasj.exe PID 1164 wrote to memory of 1340 1164 cmd.exe qqtnhasj.exe PID 1164 wrote to memory of 1340 1164 cmd.exe qqtnhasj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe"C:\Users\Admin\AppData\Local\Temp\d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1384 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7.exe" & start C:\Users\Admin\AppData\Local\qqtnhasj.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 13843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\qqtnhasj.exeC:\Users\Admin\AppData\Local\qqtnhasj.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\qqtnhasj.exeFilesize
366KB
MD5b8db5c8ec77ed7c230b370c7d13cf9c9
SHA1d1aaabc0da38a38f8489672435946fdaa94756b3
SHA256d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
SHA512f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
C:\Users\Admin\AppData\Local\qqtnhasj.exeFilesize
366KB
MD5b8db5c8ec77ed7c230b370c7d13cf9c9
SHA1d1aaabc0da38a38f8489672435946fdaa94756b3
SHA256d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
SHA512f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
\Users\Admin\AppData\Local\qqtnhasj.exeFilesize
366KB
MD5b8db5c8ec77ed7c230b370c7d13cf9c9
SHA1d1aaabc0da38a38f8489672435946fdaa94756b3
SHA256d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
SHA512f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
\Users\Admin\AppData\Local\qqtnhasj.exeFilesize
366KB
MD5b8db5c8ec77ed7c230b370c7d13cf9c9
SHA1d1aaabc0da38a38f8489672435946fdaa94756b3
SHA256d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
SHA512f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
\Users\Admin\AppData\Local\qqtnhasj.exeFilesize
366KB
MD5b8db5c8ec77ed7c230b370c7d13cf9c9
SHA1d1aaabc0da38a38f8489672435946fdaa94756b3
SHA256d7c752f5cafc59b3a182256267d60097f7711b5a80e77b34471fb2c810c3c1c7
SHA512f9d32d35335623a5482eb41627313ddae9cddef233976661902cdf7f04b5a63ae071107dbd5f4526761bb49f69eb62df382483e35e772efdc8d4c09711afe9b2
-
memory/284-61-0x0000000000000000-mapping.dmp
-
memory/568-60-0x0000000000000000-mapping.dmp
-
memory/1164-58-0x0000000000000000-mapping.dmp
-
memory/1340-70-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1340-69-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1340-65-0x0000000000000000-mapping.dmp
-
memory/1384-56-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1384-55-0x0000000000270000-0x0000000000273000-memory.dmpFilesize
12KB
-
memory/1384-57-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB
-
memory/1384-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1384-59-0x0000000001000000-0x00000000010A6000-memory.dmpFilesize
664KB