25fa9d230c114a64181127df03fb38e48e1a0bb995149877e56b8f7f8d72675a

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/02/2023, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Draft copy (2).exe
Size 279KB
Sample230211-npfbqsba92
SHA256 c03d796c8b75c36e92aa53d1fb21d89fb0fc6aa57df540ca0074c43661a6cec0
MD5 081e782e1fa08dc8aba10cb884c28dfd
SHA1 c29170608c293c89db0fdd51d5e79bbd6c90e644
SHA512 5445a8dc70c27874e9369c059a0675e17c45348175971d63888560942800b8b4e48749de838ebe3cefeb355cacfa6230bd65ae9ccaa684d9674704dd32c1e3b5
SSDEEP 6144:DYa6gaQ4zIKz5/OTQOf9BDqN7V5yZuwtFqSK5R1Zpkbcp/Srx:DY+aJIqdEQOf9ZqRVuDiSK5LZscpsx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	qzkhed.exe

Executes dropped EXE 2 IoCs

pid	Process
2012	qzkhed.exe
580	qzkhed.exe

Loads dropped DLL 3 IoCs

pid	Process
2028	Draft copy (2).exe
2012	qzkhed.exe
1712	wininit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 580	2012	qzkhed.exe	29
PID 580 set thread context of 1284	580	qzkhed.exe	13
PID 1712 set thread context of 1284	1712	wininit.exe	13

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wininit.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
580	qzkhed.exe
580	qzkhed.exe
580	qzkhed.exe
580	qzkhed.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2012	qzkhed.exe
580	qzkhed.exe
580	qzkhed.exe
580	qzkhed.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe
1712	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	qzkhed.exe
Token: SeDebugPrivilege	1712	wininit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2012	2028	Draft copy (2).exe	27
PID 2028 wrote to memory of 2012	2028	Draft copy (2).exe	27
PID 2028 wrote to memory of 2012	2028	Draft copy (2).exe	27
PID 2028 wrote to memory of 2012	2028	Draft copy (2).exe	27
PID 2012 wrote to memory of 580	2012	qzkhed.exe	29
PID 2012 wrote to memory of 580	2012	qzkhed.exe	29
PID 2012 wrote to memory of 580	2012	qzkhed.exe	29
PID 2012 wrote to memory of 580	2012	qzkhed.exe	29
PID 2012 wrote to memory of 580	2012	qzkhed.exe	29
PID 1284 wrote to memory of 1712	1284	Explorer.EXE	30
PID 1284 wrote to memory of 1712	1284	Explorer.EXE	30
PID 1284 wrote to memory of 1712	1284	Explorer.EXE	30
PID 1284 wrote to memory of 1712	1284	Explorer.EXE	30
PID 1712 wrote to memory of 1964	1712	wininit.exe	33
PID 1712 wrote to memory of 1964	1712	wininit.exe	33
PID 1712 wrote to memory of 1964	1712	wininit.exe	33
PID 1712 wrote to memory of 1964	1712	wininit.exe	33
PID 1712 wrote to memory of 1964	1712	wininit.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\Draft copy (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Draft copy (2).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
    "C:\Users\Admin\AppData\Local\Temp\qzkhed.exe" C:\Users\Admin\AppData\Local\Temp\qhhbtfpcid.eps
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
      "C:\Users\Admin\AppData\Local\Temp\qzkhed.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:580
- C:\Windows\SysWOW64\wininit.exe
  "C:\Windows\SysWOW64\wininit.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qhhbtfpcid.eps

Path C:\Users\Admin\AppData\Local\Temp\qhhbtfpcid.eps
Size 5KB
SHA256 89ec324ea699746cddad4ec23241b246fce30a645cf7df2d8676dbae91583adc
MD5 be447c567ca296b183694ecb87ded711
SHA1 9231ba16733423bf7eeee5b3efd6db5353314e95
SHA512 cf9c34c77c279f010b016595c887fbfe9ae53ad0223f3822eb5575318fe1ee3e8274380c0e2007e4e51818348b9ea558dd8971073dde85785618f776a46f552e
SSDEEP 96:Farc6oYbg/DrYu/7k2XO5oSwYbc1V6xaUyFYegxv2v81dXrdVKkwKOo8CF1/4D8d:FarcRP37hX1S9eAkRYPOEXZ4kw5Bw1D7
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeoerosx.m

Path C:\Users\Admin\AppData\Local\Temp\yeoerosx.m
Size 206KB
SHA256 39f318e0501b41f6f0b072687aa3f129f8c22f8d2a76809677ffa52d48f21ea8
MD5 f612b0a1c50e50faa249cbaad8b34655
SHA1 c21a8b5b915187d9b8663ff3c818bf3dfdaa09b6
SHA512 e554a321a6bd226233ef125759cbef99b4b9dd83486e7468f607fbd5fcb629e808ea288d0a0addfe16a1d57bd26d7c4c80731c336ff41cdf4b949ead39d39a54
SSDEEP 6144:TA2sfB1Sk438isJVz9pT43lgtHDNSIBE65XvSu:c9M3QrzE4HDlB9X7
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path \Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path \Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 902KB
SHA256 0815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda
MD5 50338cc1fa2582fa0cad8a8fa7ceb4d2
SHA1 ae697ef05b6bec38fb79ff4512ae50a303dcdbce
SHA512 02a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61
SSDEEP 24576:7q9u+M0agNmXiO2qajLN4X/wts8jdhuMTjw+Q/F0:7qnjJK2LjLN4X/wts8jdcMYk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/580-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/580-66-0x00000000006F0000-0x00000000009F3000-memory.dmp

Download

memory/580-67-0x0000000000370000-0x0000000000380000-memory.dmp

Download

memory/1284-77-0x0000000004DE0000-0x0000000004EDD000-memory.dmp

Download

memory/1284-68-0x0000000004B50000-0x0000000004C36000-memory.dmp

Download

memory/1284-74-0x0000000004DE0000-0x0000000004EDD000-memory.dmp

Download

memory/1712-71-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/1712-70-0x0000000000110000-0x000000000012A000-memory.dmp

Download

memory/1712-72-0x0000000001F50000-0x0000000002253000-memory.dmp

Download

memory/1712-73-0x00000000004F0000-0x000000000057F000-memory.dmp

Download

memory/1712-75-0x0000000000080000-0x00000000000AD000-memory.dmp

Download

memory/2028-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Download