5e5bb6ddf3de647147535d087e9e494f322ed0d7efc681883bd835c5e9efaa67

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4.4.1105.400/QQPYConfig.exe
Size

3.3MB
MD5

fa81c01cbbcc8aecd8b3e8618d2fa46c
SHA1

f3f90478e1098dedcdd7749767a9452babc4c785
SHA256

da58b6dc83d6fc31826e26d38c3640844fcf72b317a0ae0e5dff7fe8e48e9e71
SHA512

19a5b475ec08b4cd0865a8e27d75ab5c9fc3b65797505114b62e0d59381331bc3e95862007bbd8c71c17af1aab69054b6c38fd4299e131bf47dbd4b58f555388
SSDEEP

24576:2nOEP/nh9Rh3XgiZs49U6kQ6dwhzem5DXHpudb/jCi+jfatlT4XWRkcmYcj3BahD:w9vJClT5wPBtYpeqwoKm0e3TU153xyyk

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQPYConfig.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\ = ":-) SSOLUIEventSinkLib 1.0 Type Library"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\FLAGS	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4.4.1105.400\\QQPYConfig.exe"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\HELPDIR	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ = "ISSOLUIEventSink"	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ = "ISSOLUIEventSink"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\FLAGS\ = "0"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\0\win32	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\HELPDIR\	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ProxyStubClsid32	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib\ = "{907CBB30-EE92-49CC-9429-05CC718EFD62}"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib\ = "{907CBB30-EE92-49CC-9429-05CC718EFD62}"	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib\Version = "1.0"	QQPYConfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\TypeLib\Version = "1.0"	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{907CBB30-EE92-49CC-9429-05CC718EFD62}\1.0\0	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F362750F-F335-4300-9D7D-7213945AF784}	QQPYConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F362750F-F335-4300-9D7D-7213945AF784}\ProxyStubClsid32	QQPYConfig.exe

C:\Users\Admin\AppData\Local\Temp\4.4.1105.400\QQPYConfig.exe
"C:\Users\Admin\AppData\Local\Temp\4.4.1105.400\QQPYConfig.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC\OPTIONS.INI

Filesize
340B

MD5
1a2c45da01812dd365e463d8491ae13b

SHA1
5f0a62d61b50a4a61a8cc7559a9bc8519249681d

SHA256
422fbb77480e099665e7e758566ab0fd12a6a0f13d41f4b7d02762cb7df5d10a

SHA512
40ef8850561cdb2af2ab01f682bf44e85c832197de17ff0a8d0bbbaad72a53ac54da8b360b98d7749d4a376776173f5a932ea0f11f03e388a6a6c2f21c4ac91d

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\EUDCBIHUA.DAT

Filesize
10KB

MD5
e45d2f5528a0469ce12b4ed6dc74ba1c

SHA1
93eb9ffda2556aea695f463037e8e90c08d55f68

SHA256
e88e06755e0b8e88bf5f24c542396d648d6980177957339410b1c8ccd913a8f5

SHA512
702d0b3b5a6cea75b539f40c396ee6bd9cf52098619e6ac2f0fdd89239b44b03952c3cf0916e4a41ed3b198ab5fcc6e05a27fbae80ae457c7798adc27d85e253

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\EUDCCHAIZI.DICT

Filesize
5KB

MD5
0f91cf3745181dd131e8733db7d83503

SHA1
5f576872862296a2dce9886fa2995843cc7da5c0

SHA256
2513cd608d29b3f10cb4d93b718ce623e04fe02d925b2579e69007a12577fa6e

SHA512
0337569e3797c998a355bee3fbbe9d0a25f4534dccc2fcac17c4e25ed385713400a02f1d7a31930dc909c4cee0a6aeb3438ce83102f3d2586e69935c47452e00

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\EUDCDICT.DICT

Filesize
7KB

MD5
41da59e4ee9b8e533aa91e71b6f38dc1

SHA1
8f177a0265b7bb16538e668462fe2048b0c432b1

SHA256
ab8f13736b250acb8872d55c64fa43665c8947e14e2ccd31c6a1df210621df7c

SHA512
7b92131968a37f5074545d0d1a5f1229840374ec0d49e51243de87cc2426a47a66101a297c41d4fbf71dc5205ce0105cc6fbc46626fcdd6ea643a657407239a0

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\OPTIONS.INI

Filesize
54B

MD5
b075546126a836cc62a79cff9f2970e0

SHA1
37b63c682b411354347d4970a14ff62f672e2e10

SHA256
f88e231625661d2715a9d508f7ea8b4c4f3f3428e61779e8ced63b79a19d69e5

SHA512
2c70a23b56b275a2441acc0c2b8ff97645cb77f2e7e623420d755335f62f04d1e2125f7c981aca1657bbd39c3b731e726aed987f43e59d5d68d83dd497833c66

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\QQPYEUDC.EUF

Filesize
275KB

MD5
9ab24530d53167421edfe672fd5dd218

SHA1
14b1da42f6097cc0391fbdf40f0b2d7f1ea926ad

SHA256
3f3ecae6fccd7983e95d6fd63799bbad9b0579e19ffa0fe19e5420e6eb8631ec

SHA512
75214d71eb25c1d806d11286b054e3ca4daf56e882c7a6980904bc7260b2a2e6d09ff899b568a667d38e817f3cd7de982695f76bd4267051bde466de40decc6a

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\EUDC_temp\QQPYEUDC.TTE

Filesize
233KB

MD5
ff3a4e33e2d5693cbb9239bda10d9969

SHA1
fb7998fdf7afc75a7e14862baa095f58ba5efc59

SHA256
bc9be652638bfd5d9016ab5f6c08cd6b5e21ef609a1516a212280ad268041bd8

SHA512
aeee2b55f813cc556cadcf142495814fb554da5de09cf2b2acf05cad59cbd9dbc71d69816354ee5aab38b6629ef14097966485c85a45939678777d717e57e2ea

Download Submit
C:\Users\Admin\AppData\Roaming\Tencent\QQPinyin\Skin\ProgramSkin.xml

Filesize
66B

MD5
15d3bfdba9b44c61ea40b72fdff2db1c

SHA1
3ff6f559cec9b4aef92ccc33039c0c662401a50b

SHA256
a670997bc42f645aae7a80b9ce71fdfed1d4b82804c98b68de62eb2ff41fe11f

SHA512
532836435317934e50a79b5c93ea1bc3b9b880cec120e1b1be81a0509cd2f32ab68d97d1aec810edcdc354f0007f4d2c63e2af32204cd3b19c170e5b7201c52c

Download Submit
memory/3740-1-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3740-67-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download