ae6aefb36039a1bfd60894e5ed8b819127db325f8e76756755b29da06b224dbb

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

122596d644cfcca331caa8bcdd2d6daf.exe
Size

75KB
MD5

122596d644cfcca331caa8bcdd2d6daf
SHA1

57602bc366804d6978878d80d98bced5b16b9cb0
SHA256

ae6aefb36039a1bfd60894e5ed8b819127db325f8e76756755b29da06b224dbb
SHA512

c7bb77c8b543b182f69ae2a994898c4018a2b6a5e659e1f70f8f102f509211f5ceaa5726cf9b423741d6ad7fdc77bf883d16e272fd0f72010aa9213a1fcf614c
SSDEEP

1536:wYY/S3V/Y1cTl+Iiw0NEGCwQxCdijwthgF:A/Y/ln7GQxCTTi

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	122596d644cfcca331caa8bcdd2d6daf.exe

Executes dropped EXE 1 IoCs

pid	Process
1408	qwrtaw5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zydfwopdmbsiurxzhe = "C:\\ProgramData\\qwrtaw5.exe"	qwrtaw5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	122596d644cfcca331caa8bcdd2d6daf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	122596d644cfcca331caa8bcdd2d6daf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	qwrtaw5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	qwrtaw5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	122596d644cfcca331caa8bcdd2d6daf.exe
Token: SeDebugPrivilege	1408	qwrtaw5.exe
Token: SeDebugPrivilege	1408	qwrtaw5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1408	3240	122596d644cfcca331caa8bcdd2d6daf.exe	93
PID 3240 wrote to memory of 1408	3240	122596d644cfcca331caa8bcdd2d6daf.exe	93
PID 3240 wrote to memory of 1408	3240	122596d644cfcca331caa8bcdd2d6daf.exe	93

C:\Users\Admin\AppData\Local\Temp\122596d644cfcca331caa8bcdd2d6daf.exe
"C:\Users\Admin\AppData\Local\Temp\122596d644cfcca331caa8bcdd2d6daf.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\ProgramData\qwrtaw5.exe
  "C:\ProgramData\qwrtaw5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\qwrtaw5.exe

Filesize
62KB

MD5
f87842822ef501626469a4855293f649

SHA1
31a4ad0c7105c9459f27fb29105769a146765c31

SHA256
4c5f488292380b6585b92627e6a61ee96aa66fb480f98cdf5a8eb22088e97d8b

SHA512
2ab2a3d917145fe600a786c62a2d2e3651f94872a06eaf577bf0c6305f2ada078672f63c5925192a185f45518b20bd9f142bbe9947e619cf8438140e9b8ed903

Download Submit
C:\ProgramData\qwrtaw5.exe

Filesize
75KB

MD5
122596d644cfcca331caa8bcdd2d6daf

SHA1
57602bc366804d6978878d80d98bced5b16b9cb0

SHA256
ae6aefb36039a1bfd60894e5ed8b819127db325f8e76756755b29da06b224dbb

SHA512
c7bb77c8b543b182f69ae2a994898c4018a2b6a5e659e1f70f8f102f509211f5ceaa5726cf9b423741d6ad7fdc77bf883d16e272fd0f72010aa9213a1fcf614c

Download Submit
memory/1408-17-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/1408-16-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/1408-18-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/1408-20-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/1408-19-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3240-0-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3240-2-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/3240-1-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3240-15-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads