b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe
Size

196KB
MD5

de1e032242652b182a577f922cb16250
SHA1

b8f527109253e713bce8b9d129d81d0227f91e94
SHA256

b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d
SHA512

9435ca029ac00d771749361bd3d0e309082589c5b398687e719c4b94e3bdf394a003843951591d479004dc551e80eb495ce361fef2cb2d8c5b10498ec1d32245
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOK:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2284	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
320	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qqwhost.exe	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe
File opened for modification	C:\Windows\Debug\qqwhost.exe	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qqwhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qqwhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2228	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2284	2228	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe	29
PID 2228 wrote to memory of 2284	2228	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe	29
PID 2228 wrote to memory of 2284	2228	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe	29
PID 2228 wrote to memory of 2284	2228	b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe	29

C:\Users\Admin\AppData\Local\Temp\b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe
"C:\Users\Admin\AppData\Local\Temp\b9a3962234b9ee58c282d625cc5198523b4a45eee29ac95c7ab1811f8f18563d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B9A396~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2284

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
196KB

MD5
b8d6590302179346f7f5cf34937127ab

SHA1
feed85df0c4d407f6a1de9140be123697f925098

SHA256
63f56a2660bf6c3a9f8e601f2ca38eb7fdb90df10025c104469a1d3724b57506

SHA512
b16d46a62e4750468a5dc4bf00c672cb7006b9fe8b58ef78cc453098965f3523acce4cbccd6b87240bcbcebdb2218bf084bdef1df260d9448f011638e4544535

Download Submit