ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db

Analysis

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
Size

198KB
MD5

2a7adc9e6476edf358ddd730961f7b38
SHA1

d0dbf372b11487d420887e1ec1e341f9b76f6ca8
SHA256

ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db
SHA512

ba3a7cd13da855b5e890732aee71935d21e09b7181e7d8f853c2da0dbcdbf254dda9cf14e84a7038e346d61ec912ff2edb3474fb165978115d6f73278a1f32ec
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCON:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXc

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2636	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2024	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qqwhost.exe	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
File opened for modification	C:\Windows\Debug\qqwhost.exe	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qqwhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qqwhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2936	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2636	2936	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe	31
PID 2936 wrote to memory of 2636	2936	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe	31
PID 2936 wrote to memory of 2636	2936	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe	31
PID 2936 wrote to memory of 2636	2936	ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe	31

C:\Users\Admin\AppData\Local\Temp\ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe
"C:\Users\Admin\AppData\Local\Temp\ddfd5e5ad9b334dc49ac82df4752fb6b722d0e4e8905f4155108d4b2e597e0db.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DDFD5E~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2636

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
198KB

MD5
168ad5e4b62a6aa77907044d4bc37ae6

SHA1
0360863695326b0fbccd6f1a26bbe2cc86b7a505

SHA256
fd3ff06f56c5d7c717ac41029e00bc655a62263a3e1536b07ea27ef6ed0d63e7

SHA512
3077949116d1ae5d7cfa8a56fd1d7bc35d8103928fff5b1789fc08b7b1864965997d0e31834b6b514da91684ee0078ceefcf87c1dcfad807cf41dfc24b1f0dc1

Download Submit