3b0f48a43177be9b2b0a51e3f7a4f1c5ccf55a84356b4ba36ef447508f1d8e6b

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe
Size

204KB
MD5

d7a33e79f877edb232f06cfc6078690c
SHA1

ca8b1dd1b57771a34ddb73917ad9c132fa6f0d70
SHA256

3b0f48a43177be9b2b0a51e3f7a4f1c5ccf55a84356b4ba36ef447508f1d8e6b
SHA512

64ea2f2ae89b15be2ed4b15145d1876d66cf0ff556a3a76404d38cd56cb5374c85ff6f5268e4429534fbce60de0222302eccd757732a05e4a277db752e33cd08
SSDEEP

6144:aBs27fMLyXY7XXXD4gXXXDeXXXkjXXX4dN9KnIIIYXXX5XXXDsXXXxXXXLIIIono:aK2SXXXdXXXKXXXQXXX4xKnIIIYXXX5j

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1936	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qqwhost.exe	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe
File opened for modification	C:\Windows\Debug\qqwhost.exe	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qqwhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qqwhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2408	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1644	2408	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe	29
PID 2408 wrote to memory of 1644	2408	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe	29
PID 2408 wrote to memory of 1644	2408	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe	29
PID 2408 wrote to memory of 1644	2408	NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d7a33e79f877edb232f06cfc6078690cexe_JC.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\NEASD7~1.EXE > nul
  2⤵
  PID:1644

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
204KB

MD5
1c06fe6bf1f8eec37af85f3ad5a0a16f

SHA1
5b2bf4612fbd0893a448e623e962f82dfcff4e4a

SHA256
154ce8debe1d08fd76467232abdbd01eedfaacc5e4fad113f4bfcdcbc961cba1

SHA512
391b4f43974ac1968892c985ac09fb394771213457f8ff95f4854ca4ce1a127785d57c42268adfc9ced63c58d5616b3ef0d7926875231cf7203323d04cec0b60

Download Submit