4c74312fcc5b8c76b6b3067565eadd506cd72ddebbbf841a50dd2dc38ddeeca9

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffc209d48da74cc46732213fc7fdd64e.exe
Size

124KB
MD5

ffc209d48da74cc46732213fc7fdd64e
SHA1

de9d9da01b940bb0b1972d6a0012ccb81616e3eb
SHA256

4c74312fcc5b8c76b6b3067565eadd506cd72ddebbbf841a50dd2dc38ddeeca9
SHA512

42434bc76be199f2ede78cfeb65f3d83bd7c7d0c197b9de2b14f6e1a4202e900c6b94a80f9a54735401b154100e75fc0b62f915c29d3710a755849710cb539da
SSDEEP

1536:7mE3hwRGuBxeDtMYHa27J14ltxporZ45igkNeG0h3:KE3hwRGkeV6gJ1uCt45Vz3

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qooto.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ffc209d48da74cc46732213fc7fdd64e.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	qooto.exe

Loads dropped DLL 2 IoCs

pid	Process
3040	ffc209d48da74cc46732213fc7fdd64e.exe
3040	ffc209d48da74cc46732213fc7fdd64e.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /b"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /u"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /N"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /R"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /V"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /l"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /n"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /H"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /j"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /f"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /e"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /c"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /P"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /i"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /I"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /x"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /W"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /z"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /C"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /p"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /a"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /y"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /g"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /X"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /O"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /B"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /U"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /h"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /A"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /o"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /t"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /F"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /Z"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /D"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /G"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /Q"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /m"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /Y"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /J"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /d"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /O"	ffc209d48da74cc46732213fc7fdd64e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /k"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /K"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /q"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /M"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /S"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /T"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /L"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /r"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /E"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /w"	qooto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\qooto = "C:\\Users\\Admin\\qooto.exe /v"	qooto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3040	ffc209d48da74cc46732213fc7fdd64e.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe
2844	qooto.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	ffc209d48da74cc46732213fc7fdd64e.exe
2844	qooto.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2844	3040	ffc209d48da74cc46732213fc7fdd64e.exe	28
PID 3040 wrote to memory of 2844	3040	ffc209d48da74cc46732213fc7fdd64e.exe	28
PID 3040 wrote to memory of 2844	3040	ffc209d48da74cc46732213fc7fdd64e.exe	28
PID 3040 wrote to memory of 2844	3040	ffc209d48da74cc46732213fc7fdd64e.exe	28

C:\Users\Admin\AppData\Local\Temp\ffc209d48da74cc46732213fc7fdd64e.exe
"C:\Users\Admin\AppData\Local\Temp\ffc209d48da74cc46732213fc7fdd64e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\qooto.exe
  "C:\Users\Admin\qooto.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\qooto.exe

Filesize
124KB

MD5
90b4701cc93a4e75058affcbd9f1f96a

SHA1
037592a6a2126e9942c3396a59880da8bedb0435

SHA256
5796575f3007f28ab33e2a53e0fa3b4576718513e3973341e0ad2522b48d2142

SHA512
86a6a7fa0dadb7f081955003f27613f8b262b98c3ffa4df1125528b07da6970596dc5a9dcc98ae6c4e7a60646e79c76d97274656000de585fdc44158b61efbc0

Download Submit