Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 11:08
Behavioral task
behavioral1
Sample
7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe
Resource
win10v2004-20230703-en
General
-
Target
7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe
-
Size
652KB
-
MD5
d793918f5dd516e211be5e6a14fdb607
-
SHA1
00e9f5c14895bc5d8dad8eabb5d39da6c425006a
-
SHA256
7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357
-
SHA512
58f587433ce5f9271c49eee3de25efd7a52e76a01d99f535deabeef4697ba4715b6da561d9084c125e5076193c438cb8ba417a6997e7d5c63891079276611f8e
-
SSDEEP
12288:zm76zbLa+EuyokRmwdB9R5zxI2anAo+zciYototNWd1DWf3/jwuiUy6YYG:S76ra1uyokEN2anAobbototNWd1DWfby
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/536-1-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral2/memory/2288-12-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral2/memory/536-19-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral2/memory/2288-22-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral2/memory/4660-23-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral2/memory/4660-40-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Aqiyq.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Aqiyq.exe -
Executes dropped EXE 2 IoCs
pid Process 2288 Aqiyq.exe 4660 Aqiyq.exe -
resource yara_rule behavioral2/memory/536-0-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral2/files/0x0006000000023232-10.dat upx behavioral2/files/0x0006000000023232-11.dat upx behavioral2/memory/536-19-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral2/files/0x0006000000023232-20.dat upx behavioral2/memory/2288-22-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral2/memory/4660-21-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral2/memory/4660-40-0x0000000000400000-0x0000000000591000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Aqiyq.exe File opened (read-only) \??\K: Aqiyq.exe File opened (read-only) \??\U: Aqiyq.exe File opened (read-only) \??\X: Aqiyq.exe File opened (read-only) \??\G: Aqiyq.exe File opened (read-only) \??\H: Aqiyq.exe File opened (read-only) \??\P: Aqiyq.exe File opened (read-only) \??\M: Aqiyq.exe File opened (read-only) \??\O: Aqiyq.exe File opened (read-only) \??\Q: Aqiyq.exe File opened (read-only) \??\S: Aqiyq.exe File opened (read-only) \??\V: Aqiyq.exe File opened (read-only) \??\E: Aqiyq.exe File opened (read-only) \??\J: Aqiyq.exe File opened (read-only) \??\N: Aqiyq.exe File opened (read-only) \??\R: Aqiyq.exe File opened (read-only) \??\T: Aqiyq.exe File opened (read-only) \??\W: Aqiyq.exe File opened (read-only) \??\Y: Aqiyq.exe File opened (read-only) \??\Z: Aqiyq.exe File opened (read-only) \??\B: Aqiyq.exe File opened (read-only) \??\L: Aqiyq.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Aqiyq.exe 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe File opened for modification C:\Windows\Aqiyq.exe 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Aqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Aqiyq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3432 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe 4660 Aqiyq.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4660 Aqiyq.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 536 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe Token: SeLoadDriverPrivilege 4660 Aqiyq.exe Token: 33 4660 Aqiyq.exe Token: SeIncBasePriorityPrivilege 4660 Aqiyq.exe Token: 33 4660 Aqiyq.exe Token: SeIncBasePriorityPrivilege 4660 Aqiyq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 536 wrote to memory of 4212 536 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe 84 PID 536 wrote to memory of 4212 536 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe 84 PID 536 wrote to memory of 4212 536 7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe 84 PID 2288 wrote to memory of 4660 2288 Aqiyq.exe 85 PID 2288 wrote to memory of 4660 2288 Aqiyq.exe 85 PID 2288 wrote to memory of 4660 2288 Aqiyq.exe 85 PID 4212 wrote to memory of 3432 4212 cmd.exe 87 PID 4212 wrote to memory of 3432 4212 cmd.exe 87 PID 4212 wrote to memory of 3432 4212 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe"C:\Users\Admin\AppData\Local\Temp\7a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\7A27DC~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3432
-
-
-
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652KB
MD5d793918f5dd516e211be5e6a14fdb607
SHA100e9f5c14895bc5d8dad8eabb5d39da6c425006a
SHA2567a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357
SHA51258f587433ce5f9271c49eee3de25efd7a52e76a01d99f535deabeef4697ba4715b6da561d9084c125e5076193c438cb8ba417a6997e7d5c63891079276611f8e
-
Filesize
652KB
MD5d793918f5dd516e211be5e6a14fdb607
SHA100e9f5c14895bc5d8dad8eabb5d39da6c425006a
SHA2567a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357
SHA51258f587433ce5f9271c49eee3de25efd7a52e76a01d99f535deabeef4697ba4715b6da561d9084c125e5076193c438cb8ba417a6997e7d5c63891079276611f8e
-
Filesize
652KB
MD5d793918f5dd516e211be5e6a14fdb607
SHA100e9f5c14895bc5d8dad8eabb5d39da6c425006a
SHA2567a27dc2baf775a5e5c3fcd21dbf30708a9af444246caac78bd863ad1a8400357
SHA51258f587433ce5f9271c49eee3de25efd7a52e76a01d99f535deabeef4697ba4715b6da561d9084c125e5076193c438cb8ba417a6997e7d5c63891079276611f8e