b2775f496f6f120602cf87e9fc339925e8988aabe3a41ac68941bc5d7edb1ae3

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf6d2cadfdd05296495a92d942a2fe2.exe
Size

144KB
MD5

3cf6d2cadfdd05296495a92d942a2fe2
SHA1

fb541e5810730f619c69736a180067fb71673b93
SHA256

b2775f496f6f120602cf87e9fc339925e8988aabe3a41ac68941bc5d7edb1ae3
SHA512

7b77f7b51a8a581136a5123660a5d3a751b5982d6eda4149e805b071332bbf8ba943edf2c83c38ecf526aad3a3ed85d5134f78b8f5a24ae2bb78beea3cebd855
SSDEEP

3072:Rv/q95IBXql2k7xDsL/F3U2AqvpfV71Bzs+:c8677xILd3Mels+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2720	Kdqkqu.exe
2840	Kdqkqu.exe

Loads dropped DLL 3 IoCs

pid	Process
2292	3cf6d2cadfdd05296495a92d942a2fe2.exe
2292	3cf6d2cadfdd05296495a92d942a2fe2.exe
2720	Kdqkqu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kdqkqu = "C:\\Users\\Admin\\AppData\\Roaming\\Kdqkqu.exe"	3cf6d2cadfdd05296495a92d942a2fe2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 2720 set thread context of 2840	2720	Kdqkqu.exe	30

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AF21DA0-AC5A-11EE-A508-CEEF1DCBEAFA} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410683284"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	3cf6d2cadfdd05296495a92d942a2fe2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	Kdqkqu.exe
Token: SeDebugPrivilege	3048	iexplore.exe
Token: SeDebugPrivilege	2020	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1976	3cf6d2cadfdd05296495a92d942a2fe2.exe
2720	Kdqkqu.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 1976 wrote to memory of 2292	1976	3cf6d2cadfdd05296495a92d942a2fe2.exe	28
PID 2292 wrote to memory of 2720	2292	3cf6d2cadfdd05296495a92d942a2fe2.exe	29
PID 2292 wrote to memory of 2720	2292	3cf6d2cadfdd05296495a92d942a2fe2.exe	29
PID 2292 wrote to memory of 2720	2292	3cf6d2cadfdd05296495a92d942a2fe2.exe	29
PID 2292 wrote to memory of 2720	2292	3cf6d2cadfdd05296495a92d942a2fe2.exe	29
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2720 wrote to memory of 2840	2720	Kdqkqu.exe	30
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 3048 wrote to memory of 2696	3048	iexplore.exe	32
PID 3048 wrote to memory of 2696	3048	iexplore.exe	32
PID 3048 wrote to memory of 2696	3048	iexplore.exe	32
PID 3048 wrote to memory of 2696	3048	iexplore.exe	32
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 2840 wrote to memory of 3048	2840	Kdqkqu.exe	31
PID 2696 wrote to memory of 2020	2696	IEXPLORE.EXE	34
PID 2696 wrote to memory of 2020	2696	IEXPLORE.EXE	34
PID 2696 wrote to memory of 2020	2696	IEXPLORE.EXE	34
PID 2696 wrote to memory of 2020	2696	IEXPLORE.EXE	34
PID 3048 wrote to memory of 2020	3048	iexplore.exe	34
PID 3048 wrote to memory of 2020	3048	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\3cf6d2cadfdd05296495a92d942a2fe2.exe
"C:\Users\Admin\AppData\Local\Temp\3cf6d2cadfdd05296495a92d942a2fe2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\3cf6d2cadfdd05296495a92d942a2fe2.exe
  C:\Users\Admin\AppData\Local\Temp\3cf6d2cadfdd05296495a92d942a2fe2.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Roaming\Kdqkqu.exe
    "C:\Users\Admin\AppData\Roaming\Kdqkqu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Roaming\Kdqkqu.exe
      C:\Users\Admin\AppData\Roaming\Kdqkqu.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3048
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eba66568d8e319d06aaf44625b25901

SHA1
cb35fd25310d3966c2ff2887129a8166717485cc

SHA256
037649884b07b6129caa999f778edbc2c2332e0c84a45b08becf53e4890cbd57

SHA512
49489bddbfcbfa8c3fca343766ea6156799173f6fb238c59c3a6adb654e93f1d9eaa5794b85780fc49566d3b70f32d8df2fec25e4ac138c275061d089c1d9927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1758c8d431e1b052cba5ee254f44fbdc

SHA1
bdb5ede05d2ada2b968bad15321b135377282323

SHA256
a2d2fcffdebd8027f14ca98cb29a8cfe49b138ccb0ee5c7bf1371404e7f378eb

SHA512
16674eabe0f403fa03586e9816b27a3a7e72b5fed51724cc5e98ed549878dc4dee45ecf02aa09ddb597e98aa45704d89cd0c614bdcaab4d4417962ee6fb9d06e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fa56f5bc6a0a135277c1891d262cc26

SHA1
01bde25efc12adb4a176838d0efb16dce9288971

SHA256
fc2696983c9fbfddf951ae70447dc8172567475c45538263f77f51d94def8ed3

SHA512
78ba0f5676aa8c24f9b2da880fb93d163523b35077324b6d98e21154e4ac529aa50262bd11259a5096c8eb20777b63c4d287936845fada4438281119ee698192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba5b0af6ef5e7da0b94e7fc2e068742

SHA1
759490e3f1609ec63c804cfb6200c12090aab748

SHA256
791377483a528e1f4228f861223a8f33abd2285b378ba908bc3ab2d605ed32d8

SHA512
0261c5a27b5923a508afb90fd4f12a7b69791672dd2e55cd726a224c9c2002ee73ca4a7240c73a71797618477735ec0c209c5ab2fc3ecc32bae1d580fe4ab12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb288f0d1fbe19cb069e853f6280319

SHA1
ca327101a7578f6e4a05bce5c13fd4f2a63172da

SHA256
105073561d07e0875ee3a340808b29684c4e0645b8b74de43fb9d0c2a722c911

SHA512
c988a6c7c31bb687db8b5a0cb99b06f41ff8b7f1b22b966b50b97c3050715eb7687affd9677a29acc71fbbe91b5be4beda1eca8a148c51a978a5a96c04fbfb84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb783fa094a9e1b08a4d836b47b9e22

SHA1
29da1e6acb397049abe47487b6224f0cfcff8ef2

SHA256
d8e1c1350e4756fb284879d5a30913b7ae3f77438fd83427f293cdb4816f0dc6

SHA512
6ba1439887d23377e478df78beb20ed9f9242ea2720e43abce9e7f6126bc8a57575be69caefc074114e94ae661be389f50498b460de2e800ac62cba277ac02d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bba0f5b6888cd7b0fdfa5a468ba05a7

SHA1
7ecc572820b8a356c6cc48efe46f8ebdf08c79f4

SHA256
e93480b92624a8eb04f5e40b82d838a8122815d2f35c4c70da2cbb923dbaf609

SHA512
feac98dd8b17c0ef534c28f399fe47874bfe2c029151312b5fa6ff64e6d8fc819c9c4597a252fef268f67c77f045072d0275775415e45feb8bf284988fca3ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b2aee8f00d6f3908c21d92679b14a7e

SHA1
d66e26ae817ecbf943c4214a85e23833998f824a

SHA256
917de0030e3a122b9bc6557a1a28e683b6371815b0dce654b98e567c916b3d5f

SHA512
2c077dd3b5c104ad5ba825b284037c7ab4f6f31d4bf25a0334c3186f950b9520453b2518c114315f34eb0a5987c6f37a0501b8aade432f3e894eebe355b247b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3610.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45DC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Kdqkqu.exe

Filesize
144KB

MD5
3cf6d2cadfdd05296495a92d942a2fe2

SHA1
fb541e5810730f619c69736a180067fb71673b93

SHA256
b2775f496f6f120602cf87e9fc339925e8988aabe3a41ac68941bc5d7edb1ae3

SHA512
7b77f7b51a8a581136a5123660a5d3a751b5982d6eda4149e805b071332bbf8ba943edf2c83c38ecf526aad3a3ed85d5134f78b8f5a24ae2bb78beea3cebd855

Download Submit
C:\Users\Admin\AppData\Roaming\Kdqkqu.exe

Filesize
103KB

MD5
741681bf3e503a08892140d04a2d4cca

SHA1
243abb1f4d925fa8f5547358fd91d7300965b721

SHA256
db4a782688c855157ab9aa93fc858ee925e79958fe577aa9a48eb446d28fea45

SHA512
117d37e1852f3f2c4cfcc2ca06aade3d0f8c981ec976039ab20412b07f57fce25860d58abff046481076e30e164ce36f190f1c2c89c288033db0e7928a48579d

Download Submit
memory/2292-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2292-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2292-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2292-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2840-26-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2840-25-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download