f6a2d28af9b92a8c15d4afeef24e99d1c908787e68602c8bb944b50b3485e31f

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SPEC02781.exe
Size 272KB
Sample230503-m19jaaed67
SHA256 f6a2d28af9b92a8c15d4afeef24e99d1c908787e68602c8bb944b50b3485e31f
MD5 7f8f46c40b2fe1e636a9c1627328f2e1
SHA1 a494146eb403a23fc41cad4bf88c4bc4d600fd20
SHA512 5f22a2283d1491fea1166548e2418fef3a0c1c3050651fa8f9f5b77a9263c20a269670db48bd13aed1465a1ac8cf90224c799df07397ce75fecec9f03e90359b
SSDEEP 6144:o6dLyT7K5sKtRVDLJINxC2koT4VskSFqutDpPN4rhs0Cl:wTqt/LyxTwJSFquN4rW0U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SPEC02781.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SPEC02781.exe

Loads dropped DLL 1 IoCs

pid	Process
1516	SPEC02781.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1516	SPEC02781.exe
676	SPEC02781.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 676	1516	SPEC02781.exe	28

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fralokke\Registerforskrifter\signalren\Programdisketter.ini	SPEC02781.exe
File opened for modification	C:\Windows\resources\0409\Keymen.gib	SPEC02781.exe
File opened for modification	C:\Windows\Fonts\Upbraiding\Ekstremismer\Dbl.Srr	SPEC02781.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1516	SPEC02781.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 676	1516	SPEC02781.exe	28
PID 1516 wrote to memory of 676	1516	SPEC02781.exe	28
PID 1516 wrote to memory of 676	1516	SPEC02781.exe	28
PID 1516 wrote to memory of 676	1516	SPEC02781.exe	28
PID 1516 wrote to memory of 676	1516	SPEC02781.exe	28

C:\Users\Admin\AppData\Local\Temp\SPEC02781.exe
"C:\Users\Admin\AppData\Local\Temp\SPEC02781.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\SPEC02781.exe
  "C:\Users\Admin\AppData\Local\Temp\SPEC02781.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path \Users\Admin\AppData\Local\Temp\nsy4C1F.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/676-71-0x0000000000400000-0x0000000001462000-memory.dmp

Download

memory/676-72-0x0000000000400000-0x0000000001462000-memory.dmp