0cb9ffbc77206540a648b96e790d884f5662c114e831533e1eb31b63157e3953

General

Target

6cfd66231ad6321329aa7c193b35906f.exe
Size

1.5MB
MD5

6cfd66231ad6321329aa7c193b35906f
SHA1

a49b452f2e230e68903fbde8ffb16f18134f1930
SHA256

0cb9ffbc77206540a648b96e790d884f5662c114e831533e1eb31b63157e3953
SHA512

43f3ec9ae37e79b28266bcdbb0caea41b2e6d07692d893ac87ec9c1f146389f01db07f958a90fdb7fd790e978eefc4cacc73ebc79309a51ec3547f6ea22e5a92
SSDEEP

24576:4BOnnnnnnnnnnnnnkOuQ/AsSvfmSnN51vVpZAxrQwf4J4DDZKJtzG1tUofc4rNnZ:4CIVvfbN5VTZIQ0weKgqeql41

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Quivafe_mef.exe

pid process

1364 Quivafe_mef.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

276 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

6cfd66231ad6321329aa7c193b35906f.exe

pid process

1088 6cfd66231ad6321329aa7c193b35906f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1212 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1928 PING.EXE

pid	process
1364	Quivafe_mef.exe

pid	process
276	cmd.exe

pid	process
1212	schtasks.exe

pid	process
1928	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

6cfd66231ad6321329aa7c193b35906f.exeQuivafe_mef.exe

pid	process
1088	6cfd66231ad6321329aa7c193b35906f.exe
1088	6cfd66231ad6321329aa7c193b35906f.exe
1088	6cfd66231ad6321329aa7c193b35906f.exe
1088	6cfd66231ad6321329aa7c193b35906f.exe
1088	6cfd66231ad6321329aa7c193b35906f.exe
1364	Quivafe_mef.exe
1364	Quivafe_mef.exe
1364	Quivafe_mef.exe
1364	Quivafe_mef.exe
1364	Quivafe_mef.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

6cfd66231ad6321329aa7c193b35906f.execmd.exe

description	pid	process	target process
PID 1088 wrote to memory of 1212	1088	6cfd66231ad6321329aa7c193b35906f.exe	schtasks.exe
PID 1088 wrote to memory of 1212	1088	6cfd66231ad6321329aa7c193b35906f.exe	schtasks.exe
PID 1088 wrote to memory of 1212	1088	6cfd66231ad6321329aa7c193b35906f.exe	schtasks.exe
PID 1088 wrote to memory of 1212	1088	6cfd66231ad6321329aa7c193b35906f.exe	schtasks.exe
PID 1088 wrote to memory of 1364	1088	6cfd66231ad6321329aa7c193b35906f.exe	Quivafe_mef.exe
PID 1088 wrote to memory of 1364	1088	6cfd66231ad6321329aa7c193b35906f.exe	Quivafe_mef.exe
PID 1088 wrote to memory of 1364	1088	6cfd66231ad6321329aa7c193b35906f.exe	Quivafe_mef.exe
PID 1088 wrote to memory of 1364	1088	6cfd66231ad6321329aa7c193b35906f.exe	Quivafe_mef.exe
PID 1088 wrote to memory of 276	1088	6cfd66231ad6321329aa7c193b35906f.exe	cmd.exe
PID 1088 wrote to memory of 276	1088	6cfd66231ad6321329aa7c193b35906f.exe	cmd.exe
PID 1088 wrote to memory of 276	1088	6cfd66231ad6321329aa7c193b35906f.exe	cmd.exe
PID 1088 wrote to memory of 276	1088	6cfd66231ad6321329aa7c193b35906f.exe	cmd.exe
PID 276 wrote to memory of 1200	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1200	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1200	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1200	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1928	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1928	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1928	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1928	276	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\6cfd66231ad6321329aa7c193b35906f.exe
"C:\Users\Admin\AppData\Local\Temp\6cfd66231ad6321329aa7c193b35906f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Libalo rorecime yanem movequew baka pen yof yadequi fequa\Quivafe_mef.exe"
2⤵
- Creates scheduled task(s)
PID:1212

C:\Users\Admin\Libalo rorecime yanem movequew baka pen yof yadequi fequa\Quivafe_mef.exe
"C:\Users\Admin\Libalo rorecime yanem movequew baka pen yof yadequi fequa\Quivafe_mef.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\6cfd66231ad6321329aa7c193b35906f.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:1200

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Libalo rorecime yanem movequew baka pen yof yadequi fequa\Quivafe_mef.exe

Filesize
466.7MB

MD5
a011204c5eb1bc764d13fd3712a8fb77

SHA1
7d8ecde6d303e835b7232569a9f635effb9467a8

SHA256
b0b4e64af22bca51d5e5e796624ccf81dde7b20bcffe0f8c812bda5b54d98656

SHA512
8de6df7f20c06b393f618e16d70dbbe69aff074fab8a81fd87bd2883952688ccc47b388d129ff672bc2247d8d4f0615757c5c86a12f026201f0ba5c6732ff59b

Download Submit
\Users\Admin\Libalo rorecime yanem movequew baka pen yof yadequi fequa\Quivafe_mef.exe

Filesize
465.5MB

MD5
914e87852cd9ecaed84472bd274b203d

SHA1
f1858a2be218d0bb0bf28559afc9361c6a86da5c

SHA256
73e9d5e51d9302f14981ce5fef6597a54eb71e02a9feb6cf26a9e9306c3faa50

SHA512
5be7bdea543ba0ece159292ff6fa2837b551fe4c859c43b4d399bb9c0e2b1a896d36caec2b8aa294ffdeff60d4b9692e213380d54a560c5cc6756b69fe509690

Download Submit
memory/276-63-0x0000000000000000-mapping.dmp

Download
memory/1088-58-0x0000000000AC0000-0x0000000000C2A000-memory.dmp

Filesize
1.4MB

Download
memory/1088-57-0x00000000025D0000-0x0000000002CF0000-memory.dmp

Filesize
7.1MB

Download
memory/1088-54-0x00000000025D0000-0x0000000002CF0000-memory.dmp

Filesize
7.1MB

Download
memory/1088-56-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1088-55-0x0000000000AC0000-0x0000000000C2A000-memory.dmp

Filesize
1.4MB

Download
memory/1088-65-0x0000000000AC0000-0x0000000000C2A000-memory.dmp

Filesize
1.4MB

Download
memory/1200-64-0x0000000000000000-mapping.dmp

Download
memory/1212-59-0x0000000000000000-mapping.dmp

Download
memory/1364-61-0x0000000000000000-mapping.dmp

Download
memory/1364-67-0x0000000001F90000-0x00000000026B0000-memory.dmp

Filesize
7.1MB

Download
memory/1364-69-0x000000000E6B0000-0x000000000EBD1000-memory.dmp

Filesize
5.1MB

Download
memory/1364-70-0x00000000026B0000-0x000000000281A000-memory.dmp

Filesize
1.4MB

Download
memory/1364-71-0x000000000E6B0000-0x000000000EBD1000-memory.dmp

Filesize
5.1MB

Download
memory/1364-72-0x00000000026B0000-0x000000000281A000-memory.dmp

Filesize
1.4MB

Download
memory/1928-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads