b1a4009227c637be6e49ee9153ebf5db2c14b9386b87c610b8f7d85953449df7

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Q宠大乐斗助手 - 最新Q宠大乐斗外挂/qcdaledou.exe
Size

1.1MB
MD5

f9432604976263ac7a59e92353da2169
SHA1

728efc69929c7c356d999837e4815ae49f3894ab
SHA256

d40f473cb5b175fccc1ca1d7585bb0b24e5ff2eeea7496305d7752aea2cd20ea
SHA512

64d40b6ab74610b30ac04ecbef274d979c8d6624475b17021ea5a8cc3cc4d90e8244886b1295251277cff6b730fb220a4cdd110e79e85716aa10d6cdff38868c
SSDEEP

24576:Kd82EL3YE0Sjr2zfcmyoCUuUp5ufSV8EXRRYhG3Jsj:KxuoOdRC5YSV8d5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	qcdaledou.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\IESettingSync	qcdaledou.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	qcdaledou.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	qcdaledou.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4708	qcdaledou.exe
4708	qcdaledou.exe
4708	qcdaledou.exe
4708	qcdaledou.exe

C:\Users\Admin\AppData\Local\Temp\Q宠大乐斗助手 - 最新Q宠大乐斗外挂\qcdaledou.exe
"C:\Users\Admin\AppData\Local\Temp\Q宠大乐斗助手 - 最新Q宠大乐斗外挂\qcdaledou.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads