Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
Resource
win10v2004-20230703-en
General
-
Target
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe
-
Size
1.5MB
-
MD5
c90ab34fbac37c0b09dc5dea5818d803
-
SHA1
028394346e783de10ea614d9d07cad27b75188f3
-
SHA256
f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
-
SHA512
8e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
SSDEEP
24576:LVK2zY2X82tmkWCIF2S3bwLuRYbFIEmJWq83GPG0URj:LY6p3W5HxGFIE66V
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2672-0-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Aqiyq.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Aqiyq.exe -
Deletes itself 1 IoCs
pid Process 2452 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1240 Aqiyq.exe 2476 Aqiyq.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Aqiyq.exe File opened (read-only) \??\N: Aqiyq.exe File opened (read-only) \??\S: Aqiyq.exe File opened (read-only) \??\V: Aqiyq.exe File opened (read-only) \??\W: Aqiyq.exe File opened (read-only) \??\B: Aqiyq.exe File opened (read-only) \??\I: Aqiyq.exe File opened (read-only) \??\T: Aqiyq.exe File opened (read-only) \??\X: Aqiyq.exe File opened (read-only) \??\E: Aqiyq.exe File opened (read-only) \??\K: Aqiyq.exe File opened (read-only) \??\O: Aqiyq.exe File opened (read-only) \??\P: Aqiyq.exe File opened (read-only) \??\Q: Aqiyq.exe File opened (read-only) \??\R: Aqiyq.exe File opened (read-only) \??\Z: Aqiyq.exe File opened (read-only) \??\H: Aqiyq.exe File opened (read-only) \??\M: Aqiyq.exe File opened (read-only) \??\U: Aqiyq.exe File opened (read-only) \??\Y: Aqiyq.exe File opened (read-only) \??\G: Aqiyq.exe File opened (read-only) \??\L: Aqiyq.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Aqiyq.exe f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe File opened for modification C:\Windows\Aqiyq.exe f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe -
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Aqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Aqiyq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Aqiyq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Aqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Aqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software Aqiyq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 984 PING.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe 2476 Aqiyq.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2476 Aqiyq.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2672 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe Token: SeLoadDriverPrivilege 2476 Aqiyq.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2476 1240 Aqiyq.exe 30 PID 1240 wrote to memory of 2476 1240 Aqiyq.exe 30 PID 1240 wrote to memory of 2476 1240 Aqiyq.exe 30 PID 1240 wrote to memory of 2476 1240 Aqiyq.exe 30 PID 2672 wrote to memory of 2452 2672 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 29 PID 2672 wrote to memory of 2452 2672 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 29 PID 2672 wrote to memory of 2452 2672 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 29 PID 2672 wrote to memory of 2452 2672 f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe 29 PID 2452 wrote to memory of 984 2452 cmd.exe 32 PID 2452 wrote to memory of 984 2452 cmd.exe 32 PID 2452 wrote to memory of 984 2452 cmd.exe 32 PID 2452 wrote to memory of 984 2452 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe"C:\Users\Admin\AppData\Local\Temp\f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F25114~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:984
-
-
-
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\Aqiyq.exeC:\Windows\Aqiyq.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49
-
Filesize
1.5MB
MD5c90ab34fbac37c0b09dc5dea5818d803
SHA1028394346e783de10ea614d9d07cad27b75188f3
SHA256f25114b40c3e55e9bd38866e50aba6622ee140fff1e616010c5e48527d140f90
SHA5128e83bd188a4f1e5eb783b99545d1c26fda557ac167c5b2c0fecb2d01c198e44ffd3938215c692a71ee3a3f6d0a327f929eed0b93a2ce578d8a3a946c56c0ee49