4566557f5412991a56ebd8c600319e6f3494067b31b430174e40023fcc77621e

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qq.exe
Size

172KB
MD5

45388d14ba00ba14398d44489c3f5579
SHA1

4671e55a78cebf231fafa537e12b8fe563ae57a2
SHA256

3beb46ec52628033d938f889851e9a4c28f873fc77122f7277ad04256611f316
SHA512

91709f10a5eeb61da8f2ebf900ed7487078a80a737f28923a5fdac13d2f6af20703ff09fee14b2971fb64fe4e2d67b61e5a39870bfaf8dbdb5643a866e840c93
SSDEEP

3072:/dUWdtM90P6NF0SoFzv/Cuq5bodpTUNumPmDog4agAcwm:E90P6NeSoRyH58aHmEZaDcN

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wind0ws\Parameters\ServiceDll = "C:\\Program Files\\Windows Media Player\\pptvdata.dll"	Oath.exe

Executes dropped EXE 1 IoCs

pid	Process
2208	Oath.exe

Loads dropped DLL 1 IoCs

pid	Process
4760	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\pptvdata.dll	Oath.exe
File opened for modification	C:\Program Files\Windows Media Player	Oath.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ThankU.txt	Oath.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5024	taskkill.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2208	Oath.exe
2208	Oath.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe
4760	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4760	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2208	Oath.exe
Token: SeRestorePrivilege	2208	Oath.exe
Token: SeDebugPrivilege	5024	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2208	1352	qq.exe	81
PID 1352 wrote to memory of 2208	1352	qq.exe	81
PID 1352 wrote to memory of 2208	1352	qq.exe	81
PID 2208 wrote to memory of 5024	2208	Oath.exe	82
PID 2208 wrote to memory of 5024	2208	Oath.exe	82
PID 2208 wrote to memory of 5024	2208	Oath.exe	82

C:\Users\Admin\AppData\Local\Temp\qq.exe
"C:\Users\Admin\AppData\Local\Temp\qq.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\windows\temp\Oath.exe
  C:\windows\temp\Oath.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im KSafeTray.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\Oath.exe

Filesize
132KB

MD5
981b26c77351163887cbe84b531c3c40

SHA1
013a57e8bb612365bee8c49315d68fed0287d600

SHA256
000a0b8c206f9223faab9fc3ae2712aacddc4290ab7024bcc8c9f8ac420acc78

SHA512
bed9c0095586a256b4f75a60f46bc8a3d04c46b79dbefa0a8065f81219d60cc82d8afd2270f19977147ec02a8406452419a6d81b773eaa420a1622c301da14b9

Download Submit
\??\c:\program files\windows media player\pptvdata.dll

Filesize
20.2MB

MD5
f9f1fec05682f1a094a90d5a34ecf28c

SHA1
1d3d8d6262185174a76c0268a72d533e551a27b7

SHA256
dcebc633f2b4dc2c001d9952f422128d69ecaa9018bd2e32cc368fc8bbde4b68

SHA512
73df08effb6fa2f6872a3ddf2a5703908740da0dd362bd3a4f32af6423d4d07f6bdc47b8c4e6258a2ef2d8934e981974c146e4d484cd0d25e5eb6c8a2febdfeb

Download Submit
memory/2208-6-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2208-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4760-11-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download