a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/05/2023, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Size

312KB
MD5

3c1228d714eeda8f94ebbcdb1d75a284
SHA1

1728dfe3e2378b6c88e859e6af79c32b612aefc6
SHA256

a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215
SHA512

b3b6e81b9588fbbf42a96e4ce71e7428b52dd9b59a01ac934e63f1bce309609f507ae6f827c776a3eedc0afe45521466c4ddb76b851476fc774c8e3edcf713e4
SSDEEP

6144:eaXnROjLTs0Yb+AjEk+9x94SsWLkBPR3T7IrRAFoFc3WUk:1hOjXjY9tKxu3WwPRj0eoFc3WR

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1160	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
656	baqo.exe
564	baqo.exe

Loads dropped DLL 2 IoCs

pid	Process
1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\Currentversion\Run	baqo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run	baqo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Reemlolu = "C:\\Users\\Admin\\AppData\\Roaming\\Lyita\\baqo.exe"	baqo.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 656 set thread context of 564	656	baqo.exe	30

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Privacy	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe
564	baqo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Token: SeSecurityPrivilege	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
656	baqo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1728 wrote to memory of 1528	1728	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	28
PID 1528 wrote to memory of 656	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	29
PID 1528 wrote to memory of 656	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	29
PID 1528 wrote to memory of 656	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	29
PID 1528 wrote to memory of 656	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	29
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 656 wrote to memory of 564	656	baqo.exe	30
PID 564 wrote to memory of 1168	564	baqo.exe	15
PID 564 wrote to memory of 1168	564	baqo.exe	15
PID 564 wrote to memory of 1168	564	baqo.exe	15
PID 564 wrote to memory of 1168	564	baqo.exe	15
PID 564 wrote to memory of 1168	564	baqo.exe	15
PID 564 wrote to memory of 1276	564	baqo.exe	14
PID 564 wrote to memory of 1276	564	baqo.exe	14
PID 564 wrote to memory of 1276	564	baqo.exe	14
PID 564 wrote to memory of 1276	564	baqo.exe	14
PID 564 wrote to memory of 1276	564	baqo.exe	14
PID 564 wrote to memory of 1320	564	baqo.exe	7
PID 564 wrote to memory of 1320	564	baqo.exe	7
PID 564 wrote to memory of 1320	564	baqo.exe	7
PID 564 wrote to memory of 1320	564	baqo.exe	7
PID 564 wrote to memory of 1320	564	baqo.exe	7
PID 564 wrote to memory of 1528	564	baqo.exe	28
PID 564 wrote to memory of 1528	564	baqo.exe	28
PID 564 wrote to memory of 1528	564	baqo.exe	28
PID 564 wrote to memory of 1528	564	baqo.exe	28
PID 564 wrote to memory of 1528	564	baqo.exe	28
PID 1528 wrote to memory of 1160	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	31
PID 1528 wrote to memory of 1160	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	31
PID 1528 wrote to memory of 1160	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	31
PID 1528 wrote to memory of 1160	1528	a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe	31
PID 564 wrote to memory of 1160	564	baqo.exe	31
PID 564 wrote to memory of 1160	564	baqo.exe	31
PID 564 wrote to memory of 1160	564	baqo.exe	31
PID 564 wrote to memory of 1160	564	baqo.exe	31
PID 564 wrote to memory of 1228	564	baqo.exe	33
PID 564 wrote to memory of 1228	564	baqo.exe	33
PID 564 wrote to memory of 1228	564	baqo.exe	33
PID 564 wrote to memory of 1228	564	baqo.exe	33
PID 564 wrote to memory of 1228	564	baqo.exe	33
PID 564 wrote to memory of 1604	564	baqo.exe	34
PID 564 wrote to memory of 1604	564	baqo.exe	34
PID 564 wrote to memory of 1604	564	baqo.exe	34
PID 564 wrote to memory of 1604	564	baqo.exe	34
PID 564 wrote to memory of 1604	564	baqo.exe	34
PID 564 wrote to memory of 1204	564	baqo.exe	35
PID 564 wrote to memory of 1204	564	baqo.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1320
- C:\Users\Admin\AppData\Local\Temp\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
  "C:\Users\Admin\AppData\Local\Temp\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
    "C:\Users\Admin\AppData\Local\Temp\a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe"
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe
      "C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:656
    - - C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe
        
        "C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:564
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd18d530a.bat"
      4⤵
      Deletes itself
      PID:1160

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1276

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1168

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1228

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1204

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1444

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpd18d530a.bat

Filesize
307B

MD5
012db1dec8b1d64d6508ca7a0eeb579c

SHA1
e54d0a3f04df73971c8c6e750fcc2b3b28d8d282

SHA256
87fae78db02bcca85af9f6f897d2cdb50050bcd4b5f38ce79948b17fe9117620

SHA512
12ccb78406c5e14c5d218a4f396731addbcb9dacaad8ce7f683fbb1e62d926c0993792e1d108948cfe178a7766d48ccc94839a902b658a65723540c72541b494

Download Submit
C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
C:\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
\Users\Admin\AppData\Roaming\Lyita\baqo.exe

Filesize
312KB

MD5
9a6ee03d392265efa12a34ed9d984665

SHA1
9c260f176e7ce79b5ad73a4d9411d9354030446b

SHA256
46137f607dd3cf09f4035cd4e834151e04679e090dd82af4c12c4a86a42868de

SHA512
de54229f19bad207e043f5c53d2c7bcdad61ab04f3e551085251ea2de35ec8fd8fc1fb17970243821597f611e21ca8445cadf76d58122505a9432750cfbd21bc

Download Submit
memory/564-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-91-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-131-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-111-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-138-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-152-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-88-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/564-132-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1160-128-0x00000000000F0000-0x000000000012B000-memory.dmp

Filesize
236KB

Download
memory/1160-126-0x00000000000F0000-0x000000000012B000-memory.dmp

Filesize
236KB

Download
memory/1168-95-0x0000000000210000-0x000000000024B000-memory.dmp

Filesize
236KB

Download
memory/1168-96-0x0000000000210000-0x000000000024B000-memory.dmp

Filesize
236KB

Download
memory/1168-94-0x0000000000210000-0x000000000024B000-memory.dmp

Filesize
236KB

Download
memory/1168-97-0x0000000000210000-0x000000000024B000-memory.dmp

Filesize
236KB

Download
memory/1168-93-0x0000000000210000-0x000000000024B000-memory.dmp

Filesize
236KB

Download
memory/1276-99-0x0000000001CB0000-0x0000000001CEB000-memory.dmp

Filesize
236KB

Download
memory/1276-101-0x0000000001CB0000-0x0000000001CEB000-memory.dmp

Filesize
236KB

Download
memory/1276-102-0x0000000001CB0000-0x0000000001CEB000-memory.dmp

Filesize
236KB

Download
memory/1276-100-0x0000000001CB0000-0x0000000001CEB000-memory.dmp

Filesize
236KB

Download
memory/1320-104-0x0000000002550000-0x000000000258B000-memory.dmp

Filesize
236KB

Download
memory/1320-107-0x0000000002550000-0x000000000258B000-memory.dmp

Filesize
236KB

Download
memory/1320-106-0x0000000002550000-0x000000000258B000-memory.dmp

Filesize
236KB

Download
memory/1320-105-0x0000000002550000-0x000000000258B000-memory.dmp

Filesize
236KB

Download
memory/1528-121-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-109-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-114-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-117-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1528-116-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1528-118-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-120-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1528-122-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-112-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-113-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-80-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-68-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-67-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-110-0x00000000001B0000-0x00000000001EB000-memory.dmp

Filesize
236KB

Download
memory/1528-63-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1528-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-60-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1528-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1728-56-0x0000000000380000-0x00000000003A0000-memory.dmp

Filesize
128KB

Download