de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe
Size

196KB
MD5

3acb45345a9be59f91df175cda012f75
SHA1

2125fd6ffac5e966643e87c7e8d606c35b01a96b
SHA256

de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355
SHA512

e73a41e50b382397d8849bc2fa9d86d1991cd9e0ea446c2865a04ae7c244b0c990ac5af1d28f78318627de29786514c548e1035938c5e0ddc873f010f9fee577
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOn:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2380	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	qqwhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\qqwhost.exe	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe
File opened for modification	C:\Windows\Debug\qqwhost.exe	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qqwhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qqwhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2992	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2380	2992	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe	29
PID 2992 wrote to memory of 2380	2992	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe	29
PID 2992 wrote to memory of 2380	2992	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe	29
PID 2992 wrote to memory of 2380	2992	de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe	29

C:\Users\Admin\AppData\Local\Temp\de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe
"C:\Users\Admin\AppData\Local\Temp\de6e63c8b6fc600615caeefe233298cd4bd4a8e126c1a835bd9de6ae1f33d355.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DE6E63~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2380

C:\Windows\Debug\qqwhost.exe
C:\Windows\Debug\qqwhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\qqwhost.exe

Filesize
196KB

MD5
89b36ba55a4ce9515e3cd320d3145722

SHA1
1ecc7ce638f8f4192c405467cd0327a0aa99f2e9

SHA256
0fd5a61d8ac7597ef197719200337dddab109e650452f4a272e40f6037e466a5

SHA512
2df955ebf40a13783d41f544e670d2234ce1824df07c6b7391b33e32b2071a0b6f8fde4b22471789c7d241989a1a8a703340c827124a2d5b4900848571b1cff4

Download Submit