Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4aa76b2fc85ed3c123f14e04317b627a.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4aa76b2fc85ed3c123f14e04317b627a.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4aa76b2fc85ed3c123f14e04317b627a.exe
-
Size
96KB
-
MD5
4aa76b2fc85ed3c123f14e04317b627a
-
SHA1
1d93602c0d670b59be894669a7a711515b017531
-
SHA256
33da47017dcdfa6956213e45e4dd4d79f2e7f90a66a834afc4a34be7a41219f5
-
SHA512
8d9dcb0d74b82b0e673c4c87db2481cb4e8773fc2028802898d93ee0fb9259645328cd7f2eb795e336bafd3138667761e6079bc168e853268e765d5b180e889c
-
SSDEEP
1536:vWQccdJEsTCfNEHYkJouJjcXCSuyAn7ZtOq13i6E:6sckJouJjcg9t
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4aa76b2fc85ed3c123f14e04317b627a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qaaufa.exe -
Executes dropped EXE 1 IoCs
pid Process 1048 qaaufa.exe -
Loads dropped DLL 2 IoCs
pid Process 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 2172 4aa76b2fc85ed3c123f14e04317b627a.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /l" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /y" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /v" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /g" 4aa76b2fc85ed3c123f14e04317b627a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /q" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /h" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /k" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /i" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /m" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /w" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /c" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /a" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /s" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /j" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /g" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /p" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /t" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /z" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /u" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /o" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /f" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /d" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /r" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /n" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /x" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /b" qaaufa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaufa = "C:\\Users\\Admin\\qaaufa.exe /e" qaaufa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe 1048 qaaufa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 1048 qaaufa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1048 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 28 PID 2172 wrote to memory of 1048 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 28 PID 2172 wrote to memory of 1048 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 28 PID 2172 wrote to memory of 1048 2172 4aa76b2fc85ed3c123f14e04317b627a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aa76b2fc85ed3c123f14e04317b627a.exe"C:\Users\Admin\AppData\Local\Temp\4aa76b2fc85ed3c123f14e04317b627a.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\qaaufa.exe"C:\Users\Admin\qaaufa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD58842c7aa4931557bffc8b84d5e260163
SHA1b4cbb426d8066813483ac056ece843a5ae54bb3d
SHA25646aace9f568159693e9e4b391467f922a2c32311dd6f4f64d945b076f75f354f
SHA512dc2de4656790c9b6f63556018b47c66423c1ee4a8a59e643c05788f16a8ed38bb7e91195d0e5e16505799209eaeb2783e872e8569e5f018270391be61ebb21b2
-
Filesize
96KB
MD5523172a61d98229ce77f705c7de6ee3d
SHA12674d74b7e401dbe131e385660f31df96efec0a0
SHA25677d7a86e411885363ac1c3e765b774332e0c249dde073aaa66b11a452cfeff08
SHA512cf300a41a0b3453d4bbdb0426af19e9b97c9521b179119c144351041af5ed4fea7b476e92dde09a9bbe9ac31ab345612829cd05b3a638322bbd54af6a916a266