Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 15:27
Static task
static1
Behavioral task
behavioral1
Sample
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
-
Size
240KB
-
MD5
0c9a41f12c4e7cfd4bf91b1a98c27d40
-
SHA1
c7c168eaa3a357d5fcae4d2f19096c9ec2ad8acc
-
SHA256
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034
-
SHA512
98521f2adefcaf77d8e1c8dc2a3f9dd04f9041c28bb22b0239c85bb4f16d56c2eadc382664a647ead2dcd88fc5a04fa2b7a4eafc3d2fa5c3244b0e2f1c202bc4
-
SSDEEP
3072:LkBGaT8j6VlpvBd90i/SmWKLi7CjFSivnfu3fbMdozt5cz+Yj:L20UGKGkFRKfeoztO3
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qauun.exe -
Executes dropped EXE 1 IoCs
pid Process 4936 qauun.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /v" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /k" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /h" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /l" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /y" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /t" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /p" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /a" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /z" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /b" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /q" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /c" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /d" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /f" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /o" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /s" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /j" 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /n" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /g" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /w" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /j" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /u" qauun.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /x" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /m" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /i" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /r" qauun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauun = "C:\\Users\\Admin\\qauun.exe /e" qauun.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe 4936 qauun.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 4936 qauun.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2608 wrote to memory of 4936 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 82 PID 2608 wrote to memory of 4936 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 82 PID 2608 wrote to memory of 4936 2608 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe"C:\Users\Admin\AppData\Local\Temp\2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\qauun.exe"C:\Users\Admin\qauun.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4936
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD57ef83c3034d9bf9f54c1fb3aae5cc824
SHA197fcdd93b3d9e77ba0e0df88e48e0417db07ff04
SHA256ee0ea37bec0e4a4bd80d10daa1ded0665081c28610137c02cb1f6ae2cf8391a1
SHA5129a251c9845168fb2fb6c586e51f0570470f29fa0513250689476baddd599aae774363f670f2770bf53dc2f5d418237465b78e50b9b1703df84bd055bfd287fcd
-
Filesize
240KB
MD57ef83c3034d9bf9f54c1fb3aae5cc824
SHA197fcdd93b3d9e77ba0e0df88e48e0417db07ff04
SHA256ee0ea37bec0e4a4bd80d10daa1ded0665081c28610137c02cb1f6ae2cf8391a1
SHA5129a251c9845168fb2fb6c586e51f0570470f29fa0513250689476baddd599aae774363f670f2770bf53dc2f5d418237465b78e50b9b1703df84bd055bfd287fcd