Analysis
-
max time kernel
92s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
ce7bac9352e853f66edc78dc84c2004f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ce7bac9352e853f66edc78dc84c2004f.exe
Resource
win10v2004-20231215-en
General
-
Target
ce7bac9352e853f66edc78dc84c2004f.exe
-
Size
156KB
-
MD5
ce7bac9352e853f66edc78dc84c2004f
-
SHA1
86b8d8f38694836e626bebc0f38f409dde272ebe
-
SHA256
bd93a5c9004d83ffce8ba62ccd5c84cd730aaba7374e30c4dd9ecf0ae2064dee
-
SHA512
a7d1af49fd967e49816b492e3cfd9cd2ed0f309464df35a325cbc3ba84a3c013ca625be63980d722668e1d1b7f921fa61a2535c4f8d091ed5ed31e8a9e1532df
-
SSDEEP
3072:vAl50czSf2PEpfI9ZfEoA2Rz1IC1eo9O9:vAU1eomZpWueoE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Hiqfqm.exeHiqfqm.exepid process 1572 Hiqfqm.exe 1260 Hiqfqm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ce7bac9352e853f66edc78dc84c2004f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hiqfqm = "C:\\Users\\Admin\\AppData\\Roaming\\Hiqfqm.exe" ce7bac9352e853f66edc78dc84c2004f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ce7bac9352e853f66edc78dc84c2004f.exeHiqfqm.exedescription pid process target process PID 1080 set thread context of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1572 set thread context of 1260 1572 Hiqfqm.exe Hiqfqm.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417370533" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094716" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3677988359" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094716" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0179F679-E3B0-11EE-BD28-527BFEDB591A} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094716" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094716" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3597206789" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3677988359" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3597206789" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ce7bac9352e853f66edc78dc84c2004f.exepid process 3372 ce7bac9352e853f66edc78dc84c2004f.exe 3372 ce7bac9352e853f66edc78dc84c2004f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Hiqfqm.exeIEXPLORE.EXEdescription pid process Token: SeDebugPrivilege 1260 Hiqfqm.exe Token: SeDebugPrivilege 4320 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 3172 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
ce7bac9352e853f66edc78dc84c2004f.exeHiqfqm.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1080 ce7bac9352e853f66edc78dc84c2004f.exe 1572 Hiqfqm.exe 3172 IEXPLORE.EXE 3172 IEXPLORE.EXE 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
ce7bac9352e853f66edc78dc84c2004f.exece7bac9352e853f66edc78dc84c2004f.exeHiqfqm.exeHiqfqm.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 1080 wrote to memory of 3372 1080 ce7bac9352e853f66edc78dc84c2004f.exe ce7bac9352e853f66edc78dc84c2004f.exe PID 3372 wrote to memory of 1572 3372 ce7bac9352e853f66edc78dc84c2004f.exe Hiqfqm.exe PID 3372 wrote to memory of 1572 3372 ce7bac9352e853f66edc78dc84c2004f.exe Hiqfqm.exe PID 3372 wrote to memory of 1572 3372 ce7bac9352e853f66edc78dc84c2004f.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1572 wrote to memory of 1260 1572 Hiqfqm.exe Hiqfqm.exe PID 1260 wrote to memory of 2012 1260 Hiqfqm.exe iexplore.exe PID 1260 wrote to memory of 2012 1260 Hiqfqm.exe iexplore.exe PID 1260 wrote to memory of 2012 1260 Hiqfqm.exe iexplore.exe PID 2012 wrote to memory of 3172 2012 iexplore.exe IEXPLORE.EXE PID 2012 wrote to memory of 3172 2012 iexplore.exe IEXPLORE.EXE PID 3172 wrote to memory of 4320 3172 IEXPLORE.EXE IEXPLORE.EXE PID 3172 wrote to memory of 4320 3172 IEXPLORE.EXE IEXPLORE.EXE PID 3172 wrote to memory of 4320 3172 IEXPLORE.EXE IEXPLORE.EXE PID 1260 wrote to memory of 4320 1260 Hiqfqm.exe IEXPLORE.EXE PID 1260 wrote to memory of 4320 1260 Hiqfqm.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce7bac9352e853f66edc78dc84c2004f.exe"C:\Users\Admin\AppData\Local\Temp\ce7bac9352e853f66edc78dc84c2004f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ce7bac9352e853f66edc78dc84c2004f.exeC:\Users\Admin\AppData\Local\Temp\ce7bac9352e853f66edc78dc84c2004f.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Hiqfqm.exe"C:\Users\Admin\AppData\Roaming\Hiqfqm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Hiqfqm.exeC:\Users\Admin\AppData\Roaming\Hiqfqm.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3172 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD507e4e0923c1ce414f054bae6177d1049
SHA1dc0bac11f7ba7f320a87f8e24608c67774da0ed8
SHA2563dcc2cf2c6b2020c5ea9794b9ac798c9ce174811cd66ede84c972088c2837fa2
SHA5125a0f9afcfef2302ce78fd5f9a9545a14d0aff0ae31d63c9cb5820ef4612755b95878fd9b7bc7e1578dbadbb30b116eee3e784118ca26a43e9c8e1ba5d9d5134b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD52530a4328e7dc4624e103396425a579e
SHA1a87a9c98d916a9e6dbd54f1c1ffffa81ee4af3a1
SHA256c4a148e8b393557cb9ed4488f1ce97e699cd37b46075d811386cbf157bc353e5
SHA512544bd68982e12598631718ca18216b56a983b063573e7c391fcc7b878fc2c403ee1b7a876752c1368543ca82bc9916661059bf8d60417a0c1ad7ee3aa73569dc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD78.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Roaming\Hiqfqm.exeFilesize
156KB
MD5ce7bac9352e853f66edc78dc84c2004f
SHA186b8d8f38694836e626bebc0f38f409dde272ebe
SHA256bd93a5c9004d83ffce8ba62ccd5c84cd730aaba7374e30c4dd9ecf0ae2064dee
SHA512a7d1af49fd967e49816b492e3cfd9cd2ed0f309464df35a325cbc3ba84a3c013ca625be63980d722668e1d1b7f921fa61a2535c4f8d091ed5ed31e8a9e1532df
-
memory/1260-18-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1260-19-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1260-20-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3372-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3372-4-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3372-5-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3372-10-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB