71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe
Size

196KB
MD5

4f737b883e992de7d5532ce96c7199da
SHA1

ed0278aa29553155047ee9089e8350afe0c99284
SHA256

71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc
SHA512

b0db56cd659b30f845ea7233128cc8ab86b6babc941fef022a2132248213f5141a704786edc04c963a29de5a3713350c425c7b8cfd85d9325ec4b95d60b97026
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOy:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2044	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qqwhost.exe	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe
File opened for modification	C:\Windows\Debug\qqwhost.exe	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qqwhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qqwhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1760	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3032	1760	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe	29
PID 1760 wrote to memory of 3032	1760	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe	29
PID 1760 wrote to memory of 3032	1760	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe	29
PID 1760 wrote to memory of 3032	1760	71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe	29

C:\Users\Admin\AppData\Local\Temp\71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe
"C:\Users\Admin\AppData\Local\Temp\71fcf5542331df2bc4258b8332423daf712754079de277f5a5903a54707893fc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\71FCF5~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3032

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
196KB

MD5
d3f84bd641ef552cd3e2f02646020ca5

SHA1
6d0e4ad932726687769b5ee6f3d8f99d6fedcc3e

SHA256
c33c897dfe32fec375d4c80a38b93c63be56e88e5113f6f82674f9a8630e5b25

SHA512
0a4906e6a87486721524a2911569706954ccf35606603e8184577c51a493aef7e56e8c9256e029d8c8417afa51df24ff96dbbffdf104830a6ec97526d4c9d1e9

Download Submit