Analysis date (UTC): 24 January 2020, 12:23Analysis environment: Windows 7 Pro, build 7601, x86

http://bhatner.com/wp-content/uploads/2020/01/ahead/9312.zip

MD5:9C3584BC27F28C32B1530F04C5960BF7

SHA1:790DDF9F05FB64ADB643741F8BA4F9592CB4287D

SHA256:C483C9D30F122C6675B6D61656C27D51F6A3966DC547FF4F64D38E440278030C

Analysis result

Threat level:Malicious activity

Tags:

opendirloaderqbottrojan

Full analysis:Analysis http://bhatner.com/wp-content/uploads/2020/01/ahead/9312.zip Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

ColorPick.exe (PID: 2668)
ColorPick.exe (PID: 3196)
ytfovlym.exe (PID: 2864)
ytfovlym.exe (PID: 3828)

Downloads executable files from the Internet

WScript.exe (PID: 3148)

Downloads executable files with a strange extension

WScript.exe (PID: 3148)

QBOT was detected

ColorPick.exe (PID: 2668)

Runs PING.EXE for delay simulation

cmd.exe (PID: 1860)

SUSPICIOUS

Executable content was dropped or overwritten

WScript.exe (PID: 3148)
ColorPick.exe (PID: 2668)
cmd.exe (PID: 1860)

Application launched itself

ColorPick.exe (PID: 2668)
ytfovlym.exe (PID: 2864)

Creates files in the user directory

ColorPick.exe (PID: 2668)

Starts itself from another location

ColorPick.exe (PID: 2668)

Starts CMD.EXE for commands execution

ColorPick.exe (PID: 2668)

INFO

Reads Internet Cache Settings

iexplore.exe (PID: 628)
iexplore.exe (PID: 2808)

Changes internet zones settings

iexplore.exe (PID: 628)

Reads internet explorer settings

iexplore.exe (PID: 2808)

Manual execution by user

WScript.exe (PID: 3148)

Modifies the phishing filter of IE

iexplore.exe (PID: 628)

Dropped object may contain Bitcoin addresses

cmd.exe (PID: 1860)

Reads settings of System Certificates

iexplore.exe (PID: 628)

Adds / modifies Windows certificates

iexplore.exe (PID: 628)

Changes settings of System certificates

iexplore.exe (PID: 628)

Threats

PID	Process	Class	Message
3148	WScript.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3148	WScript.exe	A Network Trojan was detected	AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
3148	WScript.exe	Misc activity	ET INFO EXE - Served Attached HTTP
3148	WScript.exe	Misc activity	SUSPICIOUS [PTsecurity] PE as Image Content type mismatch