38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a

General

Target

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Size

320KB
MD5

273452cebea874b621804a48be0e05a0
SHA1

904e0880313cab25e09f90ebdfb4e43bd100f9aa
SHA256

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a
SHA512

c6cfe7c24da8805d3a518b1d84325e62d2cc4a1fedcb73ec9b3eaece642d8b08201121e3bf1a668b9f8d1c840923ec0e15487d1db5d21c7b332bcd89efb12830
SSDEEP

6144:mIIcFeEK/fObT/bGibErxUyF+fmYYdPMAaiSn:mIIcFeEK/fObT/bGiPo+eYYt/LSn

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

quuigit.exe38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	quuigit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

Executes dropped EXE 1 IoCs

Processes:

quuigit.exe

pid process

4984 quuigit.exe

pid	process
4984	quuigit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

quuigit.exe38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /t"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /R"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /S"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /s"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /g"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /d"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /L"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /r"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /B"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /q"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /Y"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /F"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /m"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /a"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /Q"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /A"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /J"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /T"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /X"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /i"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /y"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /l"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /e"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /p"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /z"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /u"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /D"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /x"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /U"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /I"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /O"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /K"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /c"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /N"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /P"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /j"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /W"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /V"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /H"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /G"	quuigit.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /o"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /E"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /f"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /w"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /n"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /h"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /X"	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /b"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /v"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /Z"	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /k"	quuigit.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	quuigit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quuigit = "C:\\Users\\Admin\\quuigit.exe /C"	quuigit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exequuigit.exe

pid	process
956	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
956	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe
4984	quuigit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exequuigit.exe

pid process

956 38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
4984 quuigit.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe

description	pid	process	target process
PID 956 wrote to memory of 4984	956	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	quuigit.exe
PID 956 wrote to memory of 4984	956	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	quuigit.exe
PID 956 wrote to memory of 4984	956	38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe	quuigit.exe

C:\Users\Admin\AppData\Local\Temp\38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe
"C:\Users\Admin\AppData\Local\Temp\38992dee2e5733461ac445547dd7900d32b251b7030018448a5c06d6c8ac689a.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\quuigit.exe
"C:\Users\Admin\quuigit.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\quuigit.exe

Filesize
320KB

MD5
d1f883b8b5c5e3910dd3297791265447

SHA1
ea32c5aa521d8fa558466f5204ad859dba20d8b4

SHA256
f02eba617a3c77232093333aa975aa4ce9705857f10bd74564ab156bbe8022d0

SHA512
d425efbea258f764a7aea87f65cc65595a4b8eb02bb5626f39234091f676798466dce34080ac76469d5a1151880bc5f297b25e1244b1e97f6353ccafa32d8bf2

Download Submit
C:\Users\Admin\quuigit.exe

Filesize
320KB

MD5
d1f883b8b5c5e3910dd3297791265447

SHA1
ea32c5aa521d8fa558466f5204ad859dba20d8b4

SHA256
f02eba617a3c77232093333aa975aa4ce9705857f10bd74564ab156bbe8022d0

SHA512
d425efbea258f764a7aea87f65cc65595a4b8eb02bb5626f39234091f676798466dce34080ac76469d5a1151880bc5f297b25e1244b1e97f6353ccafa32d8bf2

Download Submit
memory/956-132-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/956-141-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4984-135-0x0000000000000000-mapping.dmp

Download
memory/4984-140-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4984-142-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads