555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe
Size

199KB
MD5

64cc03959608401fcfc490c5e1ed649c
SHA1

3f6a4e638f8890b17236225d0e162469c4915c7a
SHA256

555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4
SHA512

0a46ce8f89194fe5c41c3abd7a7857f77f9f374b1b057bf777845b681ed9410d648d63ca3aea6e0720d62ca5e1e691ae8f1c510aa163796ef49b4719e3b2782d
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOW:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe

Executes dropped EXE 1 IoCs

pid	Process
1708	qcihost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qcihost.exe	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe
File opened for modification	C:\Windows\Debug\qcihost.exe	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qcihost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qcihost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4660	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3504	4660	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe	84
PID 4660 wrote to memory of 3504	4660	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe	84
PID 4660 wrote to memory of 3504	4660	555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe	84

C:\Users\Admin\AppData\Local\Temp\555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe
"C:\Users\Admin\AppData\Local\Temp\555c44969f961cf7d2bd25cb974ceac4c2c8ee442a52ba2d128e6e9948d357f4.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\555C44~1.EXE > nul
  2⤵
  PID:3504

C:\Windows\Debug\qcihost.exe
C:\Windows\Debug\qcihost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\qcihost.exe

Filesize
199KB

MD5
829e93d6caa441501b59b058da21944f

SHA1
5ff66198caf4dbee832524f4cda3236bfb8e31e1

SHA256
88fa85d3014ba5dd57daffcd2cbe8fd7bddbd363621036e877b07aab6c9969ff

SHA512
d4b1474a2a70ed11382d113ff839be8f37d93f510580d967316368196da42336d872ce95cc44ff3f3cc7de749ced948b058034b93bdf8ecac7c51384fd543059

Download Submit
C:\Windows\debug\qcihost.exe

Filesize
199KB

MD5
829e93d6caa441501b59b058da21944f

SHA1
5ff66198caf4dbee832524f4cda3236bfb8e31e1

SHA256
88fa85d3014ba5dd57daffcd2cbe8fd7bddbd363621036e877b07aab6c9969ff

SHA512
d4b1474a2a70ed11382d113ff839be8f37d93f510580d967316368196da42336d872ce95cc44ff3f3cc7de749ced948b058034b93bdf8ecac7c51384fd543059

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads