Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

QR-Code.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.632121861958046
Filename:	QR-Code.exe
Filesize:	19976
MD5:	be756c115ed27135976e91da8c000aa9
SHA1:	f7411d5a6db308601ebfdb1ce22e5aafd8d6b8cc
SHA256:	56f94ef271a53de2ba0e042e48f6b2449f637c689a15df847d47ee47006c5e39
SHA512:	7bcaba3e14b5e557067d32c4d575bf45a8fed35a39825a3f089b675558af382550143d5f0f3b132fa9aad2f124717aac2818f444b7105432511f580b587e12bb
SSDEEP:	384:9BkB1Mp2u0YnDZfCoxIj/cMHABAM+o/8E9VF0Ny2O:bkBZi8O+EMgBAMxkEF
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$o..........."...0.............2:... ...@....@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
One or more processes crash	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QR-Code.exe_b9f18af12be74e1c59f420cd1792bde82da23_c34d70d2_e652e088-48e5-4024-9b6a-4cd42a0b43a5\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QR-Code.exe_b9f18af12be74e1c59f420cd1792bde82da23_c34d70d2_e652e088-48e5-4024-9b6a-4cd42a0b43a5\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.0476501819935808
Encrypted:	false
Size:	65536
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB81.tmp.dmp

Mini DuMP crash report, 15 streams, Tue Apr 23 12:52:49 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB81.tmp.dmp
Category:	dropped
Dump:	WERDB81.tmp.dmp.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Tue Apr 23 12:52:49 2024, 0x1205a4 type
Entropy:	3.9070976791461858
Encrypted:	false
Size:	250903
Whitelisted:	false

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCE9.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCE9.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERDCE9.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.691277114160846
Encrypted:	false
Size:	8384
Whitelisted:	false

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD19.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD19.tmp.xml
Category:	dropped
Dump:	WERDD19.tmp.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.467654095352944
Encrypted:	false
Size:	4739
Whitelisted:	false

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.310210728337632
Encrypted:	false
Size:	1835008
Whitelisted:	false

IPs

Domain

Country

Malicious

20.42.73.29

unknown

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
QR-Code.exe

Files

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportQR-Code.exe

Files

IPs

IOC Report
QR-Code.exe