Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:48
Static task
static1
Behavioral task
behavioral1
Sample
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Resource
win10v2004-20220812-en
General
-
Target
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
-
Size
135KB
-
MD5
041ab83aee312c75d6fae5c8c45ef590
-
SHA1
2bcdc73be4ea53dec47e6805cb11a7f30fb15563
-
SHA256
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866
-
SHA512
f1c89108a18631aac7054f2af4f0d4918b784a3c6aa116acff0fcd163a7acb7bfdc6f1221f5e7e1058932022f99ade126748fd2ce25844c326effb3cfa258c7e
-
SSDEEP
3072:Qm7PefLUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVHLu:tHoIDbByGPMsMP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
quimeew.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quimeew.exe -
Executes dropped EXE 1 IoCs
Processes:
quimeew.exepid process 2220 quimeew.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
quimeew.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ quimeew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quimeew = "C:\\Users\\Admin\\quimeew.exe" quimeew.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
quimeew.exepid process 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe 2220 quimeew.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exequimeew.exepid process 4812 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe 2220 quimeew.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exequimeew.exedescription pid process target process PID 4812 wrote to memory of 2220 4812 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe quimeew.exe PID 4812 wrote to memory of 2220 4812 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe quimeew.exe PID 4812 wrote to memory of 2220 4812 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe quimeew.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe PID 2220 wrote to memory of 4812 2220 quimeew.exe 6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe"C:\Users\Admin\AppData\Local\Temp\6795321acee57d831316d0af76fb9ba52b41575ea0092a835fdae235ca420866.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\quimeew.exe"C:\Users\Admin\quimeew.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\quimeew.exeFilesize
135KB
MD5dd9d3117688204aae3bf3af4993139e0
SHA1d38e385d0b6a7d6739cba78a581c2089d2907b3e
SHA2566b2b8bc9e95bc35559354ad144585c0041de55b8b1f6be1a3e4500b5798cf062
SHA512b1d524ca5441f9ed74fb8aae446391cd26951168e32d1850b69bad10fcc79d70139bfad4b7fd7c51740868d8b929f14f6a843361393c072c83def24d7eed3671
-
C:\Users\Admin\quimeew.exeFilesize
135KB
MD5dd9d3117688204aae3bf3af4993139e0
SHA1d38e385d0b6a7d6739cba78a581c2089d2907b3e
SHA2566b2b8bc9e95bc35559354ad144585c0041de55b8b1f6be1a3e4500b5798cf062
SHA512b1d524ca5441f9ed74fb8aae446391cd26951168e32d1850b69bad10fcc79d70139bfad4b7fd7c51740868d8b929f14f6a843361393c072c83def24d7eed3671
-
memory/2220-134-0x0000000000000000-mapping.dmp