Analysis
-
max time kernel
152s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe
-
Size
100KB
-
MD5
603f22e09c68ebb653a2acf241d9ed80
-
SHA1
e73e1ccce0a0dd583e82ba44360bcd6b08d342fd
-
SHA256
75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa
-
SHA512
1ecb1beb7077cdde1a47ccdf822699ba73772874396da32b29c68e606ae22de80b9676d120214ea62b34d32e189aa544e0bc59311034fbdab692d7a1045265e9
-
SSDEEP
1536:hSH0cLOBn6zgO9+dGrNsjmJzNuKuFr1u5BRQbCcImv:AOB6MO9+VjO+7v
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeaiqez.exe -
Executes dropped EXE 1 IoCs
pid Process 1104 qeaiqez.exe -
Loads dropped DLL 2 IoCs
pid Process 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /Z" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /x" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /i" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /j" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /E" qeaiqez.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /z" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /k" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /a" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /A" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /o" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /T" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /n" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /p" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /h" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /c" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /e" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /P" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /D" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /W" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /Y" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /y" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /b" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /m" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /v" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /d" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /J" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /r" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /N" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /f" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /H" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /L" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /C" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /S" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /G" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /X" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /l" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /s" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /K" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /F" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /L" 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /R" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /Q" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /t" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /I" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /M" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /O" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /V" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /w" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /u" qeaiqez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaiqez = "C:\\Users\\Admin\\qeaiqez.exe /q" qeaiqez.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe 1104 qeaiqez.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 1104 qeaiqez.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 656 wrote to memory of 1104 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 27 PID 656 wrote to memory of 1104 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 27 PID 656 wrote to memory of 1104 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 27 PID 656 wrote to memory of 1104 656 75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe"C:\Users\Admin\AppData\Local\Temp\75c3b8e8b0cf42f020c093329c092c628d7e45d2afba2024c44966800bf292aa.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\qeaiqez.exe"C:\Users\Admin\qeaiqez.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1104
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5be4eecfa82b0ea8632ab8f976b8f746a
SHA125c8e018fc47475b07c5c8582755b15bbf411cac
SHA2561cc58117230f846c881618b87eebb2a8fb1f8fb6883cf49044946f38b3edc2a3
SHA51263e1c77eb61080e45290cb1fd4fdc081075e34cb7dcbafc42452da10fa394286325fa0e707133160f8cd7993818a7bf287002eb925ebf5c99767b6881ed5ba4b
-
Filesize
100KB
MD5be4eecfa82b0ea8632ab8f976b8f746a
SHA125c8e018fc47475b07c5c8582755b15bbf411cac
SHA2561cc58117230f846c881618b87eebb2a8fb1f8fb6883cf49044946f38b3edc2a3
SHA51263e1c77eb61080e45290cb1fd4fdc081075e34cb7dcbafc42452da10fa394286325fa0e707133160f8cd7993818a7bf287002eb925ebf5c99767b6881ed5ba4b
-
Filesize
100KB
MD5be4eecfa82b0ea8632ab8f976b8f746a
SHA125c8e018fc47475b07c5c8582755b15bbf411cac
SHA2561cc58117230f846c881618b87eebb2a8fb1f8fb6883cf49044946f38b3edc2a3
SHA51263e1c77eb61080e45290cb1fd4fdc081075e34cb7dcbafc42452da10fa394286325fa0e707133160f8cd7993818a7bf287002eb925ebf5c99767b6881ed5ba4b
-
Filesize
100KB
MD5be4eecfa82b0ea8632ab8f976b8f746a
SHA125c8e018fc47475b07c5c8582755b15bbf411cac
SHA2561cc58117230f846c881618b87eebb2a8fb1f8fb6883cf49044946f38b3edc2a3
SHA51263e1c77eb61080e45290cb1fd4fdc081075e34cb7dcbafc42452da10fa394286325fa0e707133160f8cd7993818a7bf287002eb925ebf5c99767b6881ed5ba4b