25fa9d230c114a64181127df03fb38e48e1a0bb995149877e56b8f7f8d72675a

Analysis

max time kernel
187s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Draft copy (2).exe
Size 279KB
Sample230211-npfbqsba92
SHA256 c03d796c8b75c36e92aa53d1fb21d89fb0fc6aa57df540ca0074c43661a6cec0
MD5 081e782e1fa08dc8aba10cb884c28dfd
SHA1 c29170608c293c89db0fdd51d5e79bbd6c90e644
SHA512 5445a8dc70c27874e9369c059a0675e17c45348175971d63888560942800b8b4e48749de838ebe3cefeb355cacfa6230bd65ae9ccaa684d9674704dd32c1e3b5
SSDEEP 6144:DYa6gaQ4zIKz5/OTQOf9BDqN7V5yZuwtFqSK5R1Zpkbcp/Srx:DY+aJIqdEQOf9ZqRVuDiSK5LZscpsx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	qzkhed.exe

Executes dropped EXE 2 IoCs

pid	Process
4760	qzkhed.exe
5108	qzkhed.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 5108	4760	qzkhed.exe	85
PID 5108 set thread context of 2348	5108	qzkhed.exe	32
PID 4196 set thread context of 2348	4196	WWAHost.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	WWAHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
4760	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
5108	qzkhed.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe
4196	WWAHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	qzkhed.exe
Token: SeDebugPrivilege	4196	WWAHost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4760	4564	Draft copy (2).exe	83
PID 4564 wrote to memory of 4760	4564	Draft copy (2).exe	83
PID 4564 wrote to memory of 4760	4564	Draft copy (2).exe	83
PID 4760 wrote to memory of 5108	4760	qzkhed.exe	85
PID 4760 wrote to memory of 5108	4760	qzkhed.exe	85
PID 4760 wrote to memory of 5108	4760	qzkhed.exe	85
PID 4760 wrote to memory of 5108	4760	qzkhed.exe	85
PID 2348 wrote to memory of 4196	2348	Explorer.EXE	86
PID 2348 wrote to memory of 4196	2348	Explorer.EXE	86
PID 2348 wrote to memory of 4196	2348	Explorer.EXE	86
PID 4196 wrote to memory of 3264	4196	WWAHost.exe	90
PID 4196 wrote to memory of 3264	4196	WWAHost.exe	90
PID 4196 wrote to memory of 3264	4196	WWAHost.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\Draft copy (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Draft copy (2).exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
    "C:\Users\Admin\AppData\Local\Temp\qzkhed.exe" C:\Users\Admin\AppData\Local\Temp\qhhbtfpcid.eps
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
      "C:\Users\Admin\AppData\Local\Temp\qzkhed.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- C:\Windows\SysWOW64\WWAHost.exe
  "C:\Windows\SysWOW64\WWAHost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qhhbtfpcid.eps

Path C:\Users\Admin\AppData\Local\Temp\qhhbtfpcid.eps
Size 5KB
SHA256 89ec324ea699746cddad4ec23241b246fce30a645cf7df2d8676dbae91583adc
MD5 be447c567ca296b183694ecb87ded711
SHA1 9231ba16733423bf7eeee5b3efd6db5353314e95
SHA512 cf9c34c77c279f010b016595c887fbfe9ae53ad0223f3822eb5575318fe1ee3e8274380c0e2007e4e51818348b9ea558dd8971073dde85785618f776a46f552e
SSDEEP 96:Farc6oYbg/DrYu/7k2XO5oSwYbc1V6xaUyFYegxv2v81dXrdVKkwKOo8CF1/4D8d:FarcRP37hX1S9eAkRYPOEXZ4kw5Bw1D7
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzkhed.exe

Path C:\Users\Admin\AppData\Local\Temp\qzkhed.exe
Size 67KB
SHA256 e8261c53746dbeb839878e96c4c6656a301caad1bd7d636cb351c0d98e3601f2
MD5 ad32cbaa431414ca6d1b6c394b9692a6
SHA1 54b8ce3ea18fee477a6841b44528fde25d9ade0e
SHA512 3a5f4cec40551f2317a363d7ecec726b18b21901af8c612f5caa686664f816ab633cdc31e3355d44a7cb46a441759420d9852a72c7a54afd9f013c97f5fc15e4
SSDEEP 1536:76/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:m/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeoerosx.m

Path C:\Users\Admin\AppData\Local\Temp\yeoerosx.m
Size 206KB
SHA256 39f318e0501b41f6f0b072687aa3f129f8c22f8d2a76809677ffa52d48f21ea8
MD5 f612b0a1c50e50faa249cbaad8b34655
SHA1 c21a8b5b915187d9b8663ff3c818bf3dfdaa09b6
SHA512 e554a321a6bd226233ef125759cbef99b4b9dd83486e7468f607fbd5fcb629e808ea288d0a0addfe16a1d57bd26d7c4c80731c336ff41cdf4b949ead39d39a54
SSDEEP 6144:TA2sfB1Sk438isJVz9pT43lgtHDNSIBE65XvSu:c9M3QrzE4HDlB9X7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2348-142-0x0000000008250000-0x0000000008331000-memory.dmp

Download

memory/2348-149-0x0000000008400000-0x0000000008505000-memory.dmp

Download

memory/2348-148-0x0000000008400000-0x0000000008505000-memory.dmp

Download

memory/4196-144-0x0000000000F70000-0x000000000104C000-memory.dmp

Download

memory/4196-145-0x0000000000EC0000-0x0000000000EED000-memory.dmp

Download

memory/4196-146-0x0000000002110000-0x000000000245A000-memory.dmp

Download

memory/4196-147-0x0000000001CD0000-0x0000000001D5F000-memory.dmp

Download

memory/5108-141-0x00000000005B0000-0x00000000005C0000-memory.dmp

Download

memory/5108-140-0x0000000000A40000-0x0000000000D8A000-memory.dmp

Download

memory/5108-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download