9b1becaae353cfed426aac596fdaee9a343dffbdae42e3be55f245cd16be4b6a

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IPQQ2006.exe
Size

17.5MB
MD5

a0ffb976b7ecc959414a6056925e3812
SHA1

804fdff524097ae52fa81529e59a2264164707b4
SHA256

53adc084ab2b8525296e23a499724c1163589d76ceacad295868a31d9ae91d5d
SHA512

1489bb6b2894c58122374b73cf10bc3df45f1e96e65bd3cce21cc103c8d214efa05e0a9a288eee1203f1858075384577cbdd3f91819d7190b6e39a4b5f2eab5b
SSDEEP

393216:IAkGP1+VOuZokVLUSVDYZp0QIe3wxDHONSW0NZ3nw3:I5aoVFGSVkgxDO2Zg3

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1936	IPQQ2006.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1936	IPQQ2006.exe

C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe
"C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst91F5.tmp\ioSpecial.ini

Filesize
635B

MD5
60847141b5bff7491e56af3fadc44d05

SHA1
71d9f31d88c698cf42997e4929c8bb3fda63ace8

SHA256
83a4d534aabdd3c4dd963e6255c2f98cd6e2b384c199c1de0a847256b5b2f36a

SHA512
5c04ad55bf0f156a35078c3657474ff4968a0feb148ad00c54c53c9576895c313d9a8b36e1659f7a51d99925609a56d59e24f84ee8e0b3fc0ca44dabef2204af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst91F5.tmp\ioSpecial.ini

Filesize
674B

MD5
5a992463384adb5083ff5efbeb95e9bc

SHA1
e8f235eac8245ec9402fdffb1d25e3cba6b91ab9

SHA256
4838aa71495110739350b28cdd21a80a80e4ebbf02f5ecc5cd009063c5d96153

SHA512
1f3572031b0f30f599f451c3e0a5ac0951906f994bd19650b66a552b499a97831c2539a691c2c0ce07c0522ddfd5fab1ea73198b1f3be7e1191407770008cd20

Download Submit
\Users\Admin\AppData\Local\Temp\nst91F5.tmp\InstallOptions.dll

Filesize
12KB

MD5
cce5450725a9429a1d3c7aa851d40e8d

SHA1
05722500e42757ac03f2558452a064b906e31937

SHA256
d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

SHA512
3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

Download Submit