Malware Analysis Report

2025-08-10 18:08

Sample ID 240507-j167daah23
Target QI.EXE
SHA256 70d313b32680b46843d8bb85d3c38f60a0907aee88cc5ac7f446e7809375e447
Tags
bootkit execution persistence upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

70d313b32680b46843d8bb85d3c38f60a0907aee88cc5ac7f446e7809375e447

Threat Level: Likely malicious

The file QI.EXE was found to be: Likely malicious.

Malicious Activity Summary

bootkit execution persistence upx

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-07 08:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 08:09

Reported

2024-05-07 08:09

Platform

win7-20240220-en

Max time kernel

14s

Max time network

14s

Command Line

"C:\Users\Admin\AppData\Local\Temp\QI.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\QI = "C:\\0079952\\QI.EXE" C:\Users\Admin\AppData\Local\Temp\QI.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\pizdec.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\schtasks.exe
PID 2360 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\schtasks.exe
PID 2360 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\schtasks.exe
PID 2360 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\0079952\QI.EXE
PID 2360 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\0079952\QI.EXE
PID 2360 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\0079952\QI.EXE
PID 2792 wrote to memory of 2472 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 2792 wrote to memory of 2472 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 2792 wrote to memory of 2472 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 2792 wrote to memory of 2472 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 2792 wrote to memory of 2620 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 2792 wrote to memory of 2620 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 2792 wrote to memory of 2620 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 2792 wrote to memory of 2620 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 2792 wrote to memory of 2460 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 2792 wrote to memory of 2460 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 2792 wrote to memory of 2460 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 2792 wrote to memory of 2460 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 2792 wrote to memory of 2168 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\[email protected]
PID 2792 wrote to memory of 2168 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\[email protected]
PID 2792 wrote to memory of 2168 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\[email protected]
PID 2460 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2460 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2460 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2460 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2792 wrote to memory of 2684 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 2792 wrote to memory of 2684 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 2792 wrote to memory of 2684 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 2792 wrote to memory of 2684 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 2792 wrote to memory of 2008 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 2792 wrote to memory of 2008 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 2792 wrote to memory of 2008 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 2792 wrote to memory of 2008 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 2684 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\start.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\start.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\start.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\start.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 800 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
PID 2792 wrote to memory of 800 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
PID 2792 wrote to memory of 800 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
PID 2792 wrote to memory of 800 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
PID 2008 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\1111.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe
PID 2008 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\1111.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe
PID 2008 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\1111.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe
PID 2008 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\1111.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\QI.exe

"C:\Users\Admin\AppData\Local\Temp\QI.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\0079952\QI.EXE'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /F /TN "QI" /SC ONLOGON /TR "C:\0079952\QI.EXE" /RL HIGHEST

C:\0079952\QI.EXE

"C:\0079952\QI.EXE"

C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe

"C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe"

C:\Users\Admin\AppData\Local\Temp\erroricons.exe

"C:\Users\Admin\AppData\Local\Temp\erroricons.exe"

C:\Users\Admin\AppData\Local\Temp\pizdec.exe

"C:\Users\Admin\AppData\Local\Temp\pizdec.exe"

C:\Users\Admin\AppData\Local\Temp\[email protected]

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Users\Admin\AppData\Local\Temp\start.exe

"C:\Users\Admin\AppData\Local\Temp\start.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Users\Admin\AppData\Local\Temp\1111.exe

"C:\Users\Admin\AppData\Local\Temp\1111.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2414.tmp\2425.tmp\2426.bat C:\Users\Admin\AppData\Local\Temp\start.exe"

C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe

"C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

N/A

Files

memory/2360-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

memory/2360-1-0x0000000000B80000-0x0000000001168000-memory.dmp

memory/1412-6-0x0000000002DB0000-0x0000000002E30000-memory.dmp

memory/1412-7-0x000000001B610000-0x000000001B8F2000-memory.dmp

memory/1412-8-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

C:\0079952\QI.EXE

MD5 6e5e7f2f5ddb3ae96e0b554af23f7d8a
SHA1 1db98b50cd29f1d9b56aad8e1440ba239829e65c
SHA256 cba6b4b8a352174cedc24d216250d3e389ff5c06aa0b063869084bd2a85784d1
SHA512 ac48c21e99aa0e1279d868b98a10d36bc0d3d2150cf88e9e666dcca2d5ccc045a886546f7d0117af5ff34d156cad0ecbe74a97e767e5e6447ef1c4171c7bdab9

memory/2792-15-0x0000000000CA0000-0x0000000001288000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe

MD5 e21bb4749a8b1b6fc26a7bcf57781836
SHA1 89cb0bd80d691ca650ad01551be3acefa2256ebd
SHA256 0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c
SHA512 b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

C:\Users\Admin\AppData\Local\Temp\erroricons.exe

MD5 7f31508d95be3fe50e4e9aa646e86a12
SHA1 c61b439d6e17d630728f48c09b36af2647940748
SHA256 994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15
SHA512 2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

C:\Users\Admin\AppData\Local\Temp\pizdec.exe

MD5 f35633ae6d4ed40fce9b5b62dd575d79
SHA1 df952be90c5447bac8db8a3bb2c31d6820a9e2a0
SHA256 97b09d2780df299384aa0f5d8184b9d5dc5df9d59715320b9afa7bdc93baa95c
SHA512 4b3ec5a372ab6883cf5b7f52010c99a2b7cf787b37b0062cbb542ae3557d8410e6ec2bff07e6d2266cea35885647ca9c5d26acce93fbace884e8fca632869952

memory/2460-37-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 bc1e7d033a999c4fd006109c24599f4d
SHA1 b927f0fc4a4232a023312198b33272e1a6d79cec
SHA256 13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401
SHA512 f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

memory/2460-52-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 1dd43ba56e91654ef01caf1352776b8d
SHA1 507c048cf3cff79355e93d6d84e2cd57d00e1687
SHA256 230539442f6c634c45e17b17baeb9a20e32460f13f430abc484c334025926de5
SHA512 14939d00a494c13dd895cd3a3428e793ca0fe710ad97b97b5867a3ad8aa46119bf07415a492fa6e2b067aae6b74c5dd0ea00c0b0b5b302a1d1b893ae0ba20886

C:\Users\Admin\AppData\Local\Temp\start.exe

MD5 7a6212aaed7b0851de879a270928417d
SHA1 9c896a347ae1e568e045b1061938f0a56728d1c5
SHA256 df3ee675829d7eeb051583b399909a0ac9d0b3e868c6850ecaa5d11a9e563c20
SHA512 6c21ea1cff7dfab081275808a4d3a3e2b081c2bc6a3d58b3b3ddbd714ee5e7091f8edaeb267bc8a887c77ac6de68cdc72dfd5bf1ae16cbe687af450d290adaa9

memory/2684-60-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1111.exe

MD5 d76f5511907522ebe06e829de7b5ed52
SHA1 090abee096762c74879cc64197201011d09a6928
SHA256 248e8e6fe3c0699f347e6651eaf79c2d820848549520850b45ab9b762dbb9776
SHA512 8e7dd01b7bad9a3a3e4af3df76a8f6b3c80a20b3d3f9bd0cef8d1f0a4a6bbb893a8ab0075d0d5329a689a82ee8af2db756c1055d5be5d5417c9e6f33747dcbae

memory/800-73-0x0000000000400000-0x0000000000582000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe

MD5 a44458813e819777013eb3e644d74362
SHA1 2dd0616ca78e22464cf0cf68ef7915358a16f9ee
SHA256 47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999
SHA512 1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

\Users\Admin\AppData\Local\Temp\RarSFX0\project.exe

MD5 fdad1b564558765657cb835752b47e7c
SHA1 3c94e9acc969b66aab45eb8a60a77b27691950b2
SHA256 9b9f847720789d72858a6f25447ca0da4a1918cc2c1bc1e2f15ab462bb9c61e5
SHA512 d04e560bd589b8c2b5f49753fa5d32d55c6978b53320639b65f4ee285154d0a216ff0765260407407e6cc6adc9b1d775c96b6a2dcdd7da1cea8a5fd175afd76e

memory/2212-91-0x0000000000400000-0x0000000000653000-memory.dmp

memory/2684-95-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2620-96-0x0000000000400000-0x0000000000454000-memory.dmp

memory/2472-97-0x0000000000400000-0x0000000000541000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-07 08:09

Reported

2024-05-07 08:09

Platform

win10v2004-20240419-en

Max time kernel

12s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\QI.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\QI.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\0079952\QI.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QI = "C:\\0079952\\QI.EXE" C:\Users\Admin\AppData\Local\Temp\QI.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\pizdec.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "42" C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2192 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2192 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\schtasks.exe
PID 2192 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\Windows\System32\schtasks.exe
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\0079952\QI.EXE
PID 2192 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\QI.exe C:\0079952\QI.EXE
PID 1648 wrote to memory of 4420 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 1648 wrote to memory of 4420 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 1648 wrote to memory of 4420 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
PID 1648 wrote to memory of 2028 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 1648 wrote to memory of 2028 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 1648 wrote to memory of 2028 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\erroricons.exe
PID 1648 wrote to memory of 1912 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 1648 wrote to memory of 1912 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 1648 wrote to memory of 1912 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\pizdec.exe
PID 1648 wrote to memory of 3572 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\[email protected]
PID 1648 wrote to memory of 3572 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\[email protected]
PID 1648 wrote to memory of 3712 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 1648 wrote to memory of 3712 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 1648 wrote to memory of 3712 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\start.exe
PID 1912 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1912 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1912 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\pizdec.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1648 wrote to memory of 4864 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 1648 wrote to memory of 4864 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe
PID 1648 wrote to memory of 4864 N/A C:\0079952\QI.EXE C:\Users\Admin\AppData\Local\Temp\1111.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\QI.exe

"C:\Users\Admin\AppData\Local\Temp\QI.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\0079952\QI.EXE'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /F /TN "QI" /SC ONLOGON /TR "C:\0079952\QI.EXE" /RL HIGHEST

C:\0079952\QI.EXE

"C:\0079952\QI.EXE"

C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe

"C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe"

C:\Users\Admin\AppData\Local\Temp\erroricons.exe

"C:\Users\Admin\AppData\Local\Temp\erroricons.exe"

C:\Users\Admin\AppData\Local\Temp\pizdec.exe

"C:\Users\Admin\AppData\Local\Temp\pizdec.exe"

C:\Users\Admin\AppData\Local\Temp\[email protected]

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Users\Admin\AppData\Local\Temp\start.exe

"C:\Users\Admin\AppData\Local\Temp\start.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39b6055 /state1:0x41c64e6d

C:\Users\Admin\AppData\Local\Temp\1111.exe

"C:\Users\Admin\AppData\Local\Temp\1111.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 147.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/2192-0-0x00007FFE2A0A3000-0x00007FFE2A0A5000-memory.dmp

memory/2192-1-0x0000000000B90000-0x0000000001178000-memory.dmp

memory/1624-2-0x000001E7258D0000-0x000001E7258F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fcifkygd.5qb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1624-12-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

memory/1624-13-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

memory/1624-14-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

memory/1624-15-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

memory/1624-18-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

memory/2192-21-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

C:\0079952\QI.EXE

MD5 6e5e7f2f5ddb3ae96e0b554af23f7d8a
SHA1 1db98b50cd29f1d9b56aad8e1440ba239829e65c
SHA256 cba6b4b8a352174cedc24d216250d3e389ff5c06aa0b063869084bd2a85784d1
SHA512 ac48c21e99aa0e1279d868b98a10d36bc0d3d2150cf88e9e666dcca2d5ccc045a886546f7d0117af5ff34d156cad0ecbe74a97e767e5e6447ef1c4171c7bdab9

memory/2192-34-0x00007FFE2A0A0000-0x00007FFE2AB61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\QI.EXE.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/1648-35-0x0000000000ED0000-0x00000000014B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe

MD5 e21bb4749a8b1b6fc26a7bcf57781836
SHA1 89cb0bd80d691ca650ad01551be3acefa2256ebd
SHA256 0ecbb8099ed1d9a1673165d3c4c9bbde88dd9678540a98b99434ff23b9e6d82c
SHA512 b0ccf421e415f94b6f0497dd041a8e7693d01d72cd577eca771d2049516f7a0c8c7221da642e5c38d5bc95a2335279d36f956314bda442b99a2d244bcc73b47b

C:\Users\Admin\AppData\Local\Temp\erroricons.exe

MD5 7f31508d95be3fe50e4e9aa646e86a12
SHA1 c61b439d6e17d630728f48c09b36af2647940748
SHA256 994efdb644ca1acb029dfd8d8eeba440e1cb74d93841b17f21165b9900730b15
SHA512 2e2b01e84a3476b47a9c703b71ce31887e4a4fa9340780f0cbbd20601be621bf00b9619df8bec0e81b2825550150c477c5071d921104a4c6265ef2d5a9e77eda

C:\Users\Admin\AppData\Local\Temp\pizdec.exe

MD5 f35633ae6d4ed40fce9b5b62dd575d79
SHA1 df952be90c5447bac8db8a3bb2c31d6820a9e2a0
SHA256 97b09d2780df299384aa0f5d8184b9d5dc5df9d59715320b9afa7bdc93baa95c
SHA512 4b3ec5a372ab6883cf5b7f52010c99a2b7cf787b37b0062cbb542ae3557d8410e6ec2bff07e6d2266cea35885647ca9c5d26acce93fbace884e8fca632869952

memory/1912-62-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\[email protected]

MD5 bc1e7d033a999c4fd006109c24599f4d
SHA1 b927f0fc4a4232a023312198b33272e1a6d79cec
SHA256 13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401
SHA512 f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

C:\Users\Admin\AppData\Local\Temp\start.exe

MD5 7a6212aaed7b0851de879a270928417d
SHA1 9c896a347ae1e568e045b1061938f0a56728d1c5
SHA256 df3ee675829d7eeb051583b399909a0ac9d0b3e868c6850ecaa5d11a9e563c20
SHA512 6c21ea1cff7dfab081275808a4d3a3e2b081c2bc6a3d58b3b3ddbd714ee5e7091f8edaeb267bc8a887c77ac6de68cdc72dfd5bf1ae16cbe687af450d290adaa9

memory/3712-82-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1912-90-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 1dd43ba56e91654ef01caf1352776b8d
SHA1 507c048cf3cff79355e93d6d84e2cd57d00e1687
SHA256 230539442f6c634c45e17b17baeb9a20e32460f13f430abc484c334025926de5
SHA512 14939d00a494c13dd895cd3a3428e793ca0fe710ad97b97b5867a3ad8aa46119bf07415a492fa6e2b067aae6b74c5dd0ea00c0b0b5b302a1d1b893ae0ba20886

C:\Users\Admin\AppData\Local\Temp\1111.exe

MD5 d76f5511907522ebe06e829de7b5ed52
SHA1 090abee096762c74879cc64197201011d09a6928
SHA256 248e8e6fe3c0699f347e6651eaf79c2d820848549520850b45ab9b762dbb9776
SHA512 8e7dd01b7bad9a3a3e4af3df76a8f6b3c80a20b3d3f9bd0cef8d1f0a4a6bbb893a8ab0075d0d5329a689a82ee8af2db756c1055d5be5d5417c9e6f33747dcbae

C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe

MD5 a44458813e819777013eb3e644d74362
SHA1 2dd0616ca78e22464cf0cf68ef7915358a16f9ee
SHA256 47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999
SHA512 1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215

memory/3712-104-0x0000000000400000-0x000000000041D000-memory.dmp

memory/4420-102-0x0000000000400000-0x0000000000541000-memory.dmp

memory/2028-101-0x0000000000400000-0x0000000000454000-memory.dmp