c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1

General

Target

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
Size

216KB
MD5

25bb8b989cacc4895231e4c151cc596f
SHA1

ae4b164b3157c49d6138b5d243c4a0facc1e3f70
SHA256

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1
SHA512

b926c9d786862babd1b16169cf49813a1cc47845f4fa9be63d75bbb1cec57b76ed64bd1ed016ddd1126fc6ebb788c7a0e8071b9c21601b750924b1b04b093332
SSDEEP

3072:GFvdhkuVoHFGFooobAqzNOEbOKZbtpGPsLx2:GFvH5YPseNmKJtpL2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exequahaz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	quahaz.exe

Executes dropped EXE 1 IoCs

Processes:

quahaz.exe

pid process

1284 quahaz.exe

pid	process
1284	quahaz.exe

Loads dropped DLL 2 IoCs

Processes:

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe

pid	process
1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

quahaz.exec909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /q"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /P"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /H"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /Z"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /t"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /Y"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /Q"	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /U"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /m"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /s"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /k"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /T"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /K"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /b"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /h"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /u"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /D"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /L"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /r"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /C"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /J"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /n"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /g"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /R"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /S"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /l"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /j"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /p"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /f"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /N"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /a"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /W"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /w"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /I"	quahaz.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /Q"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /G"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /o"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /i"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /A"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /e"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /d"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /c"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /z"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /O"	quahaz.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /V"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /M"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /E"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /X"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /B"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /F"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /v"	quahaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quahaz = "C:\\Users\\Admin\\quahaz.exe /y"	quahaz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exequahaz.exe

pid	process
1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe
1284	quahaz.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exequahaz.exe

pid process

1784 c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
1284 quahaz.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe

description	pid	process	target process
PID 1784 wrote to memory of 1284	1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe	quahaz.exe
PID 1784 wrote to memory of 1284	1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe	quahaz.exe
PID 1784 wrote to memory of 1284	1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe	quahaz.exe
PID 1784 wrote to memory of 1284	1784	c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe	quahaz.exe

C:\Users\Admin\AppData\Local\Temp\c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe
"C:\Users\Admin\AppData\Local\Temp\c909b1479bd6fcc7781864ec4fed86c77550a001d09e883e11eabe0fbc1240f1.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\quahaz.exe
  "C:\Users\Admin\quahaz.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\quahaz.exe

Filesize
216KB

MD5
5715a4bba3d9886235a51ab4b6cd1e01

SHA1
7c1e5001f0260fc48f855ba93bfd71037cf64c83

SHA256
05b9a01feca473caf313efc7ed47a145bef80bfd58ff079ca7e544c6fa07209f

SHA512
df9a7c2035a7fe8771a8f84a47fbba4107b3dffecf10b9bb52bf5ac39eeefa17d31e03e4466c77bcab68c9188c4291de9ceea655a333e5f1609f530fecfdae7f

Download Submit
C:\Users\Admin\quahaz.exe

Filesize
216KB

MD5
5715a4bba3d9886235a51ab4b6cd1e01

SHA1
7c1e5001f0260fc48f855ba93bfd71037cf64c83

SHA256
05b9a01feca473caf313efc7ed47a145bef80bfd58ff079ca7e544c6fa07209f

SHA512
df9a7c2035a7fe8771a8f84a47fbba4107b3dffecf10b9bb52bf5ac39eeefa17d31e03e4466c77bcab68c9188c4291de9ceea655a333e5f1609f530fecfdae7f

Download Submit
\Users\Admin\quahaz.exe

Filesize
216KB

MD5
5715a4bba3d9886235a51ab4b6cd1e01

SHA1
7c1e5001f0260fc48f855ba93bfd71037cf64c83

SHA256
05b9a01feca473caf313efc7ed47a145bef80bfd58ff079ca7e544c6fa07209f

SHA512
df9a7c2035a7fe8771a8f84a47fbba4107b3dffecf10b9bb52bf5ac39eeefa17d31e03e4466c77bcab68c9188c4291de9ceea655a333e5f1609f530fecfdae7f

Download Submit
\Users\Admin\quahaz.exe

Filesize
216KB

MD5
5715a4bba3d9886235a51ab4b6cd1e01

SHA1
7c1e5001f0260fc48f855ba93bfd71037cf64c83

SHA256
05b9a01feca473caf313efc7ed47a145bef80bfd58ff079ca7e544c6fa07209f

SHA512
df9a7c2035a7fe8771a8f84a47fbba4107b3dffecf10b9bb52bf5ac39eeefa17d31e03e4466c77bcab68c9188c4291de9ceea655a333e5f1609f530fecfdae7f

Download Submit
memory/1284-59-0x0000000000000000-mapping.dmp

Download
memory/1784-56-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads