Analysis
-
max time kernel
91s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09/06/2022, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
kvadngch.exe
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
kvadngch.exe
Resource
win10-20220414-en
windows10_x64
Behavioral task
behavioral3
Sample
kvadngch.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral4
Sample
kvadngch.exe
Resource
win11-20220223-en
windows11_x64
General
-
Target
kvadngch.exe
-
Size
1.6MB
-
MD5
b2388b2e7884b8e641185d6246c4a8f4
-
SHA1
22ed93eb2100426ec41014b308a5816959b1b42d
-
SHA256
f625b23ab45afbb97b8bdd54a301c375b3b9af4eabf7f779edc2d35e7f2eb862
-
SHA512
2958796c0f5177934e6d7bda68eb57aae115177a6e71a704526246d3867c86036af123c0c14e111f86c1d04f472d67e9cede7e4353b06dec8cafe10e23dfa599
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 672 1356 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe 1356 kvadngch.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1356 wrote to memory of 672 1356 kvadngch.exe 30 PID 1356 wrote to memory of 672 1356 kvadngch.exe 30 PID 1356 wrote to memory of 672 1356 kvadngch.exe 30 PID 1356 wrote to memory of 672 1356 kvadngch.exe 30