9b1becaae353cfed426aac596fdaee9a343dffbdae42e3be55f245cd16be4b6a

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IPQQ2006.exe
Size

17.5MB
MD5

a0ffb976b7ecc959414a6056925e3812
SHA1

804fdff524097ae52fa81529e59a2264164707b4
SHA256

53adc084ab2b8525296e23a499724c1163589d76ceacad295868a31d9ae91d5d
SHA512

1489bb6b2894c58122374b73cf10bc3df45f1e96e65bd3cce21cc103c8d214efa05e0a9a288eee1203f1858075384577cbdd3f91819d7190b6e39a4b5f2eab5b
SSDEEP

393216:IAkGP1+VOuZokVLUSVDYZp0QIe3wxDHONSW0NZ3nw3:I5aoVFGSVkgxDO2Zg3

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

IPQQ2006.exe

pid process

4184 IPQQ2006.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4184	IPQQ2006.exe

C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe
"C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe"
1⤵
- Loads dropped DLL
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst416B.tmp\InstallOptions.dll
Filesize
12KB

MD5
cce5450725a9429a1d3c7aa851d40e8d

SHA1
05722500e42757ac03f2558452a064b906e31937

SHA256
d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

SHA512
3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst416B.tmp\ioSpecial.ini
Filesize
635B

MD5
b20b80b86f4a3b1b5ff8b43e38febc37

SHA1
ba4a59e98b5ccd266dd5b9f7d410b8d12a2c5273

SHA256
34ce725127e43519e562a47096f8623a62796c768abb0253061227950a834a41

SHA512
f91fa0c034d3a37c8251314279d050e7df0f2925d5e9b715d60f0b3e6ce75dbd62ead1b27e8e4c34e63585c1b2d440a29fc0ede45c66a737858c2d22dae3cba2

Download Submit