Analysis
-
max time kernel
152s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:22
Static task
static1
Behavioral task
behavioral1
Sample
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe
Resource
win10v2004-20221111-en
General
-
Target
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe
-
Size
184KB
-
MD5
16a93d1b8bc0cf55e4e8048ace33e24f
-
SHA1
899ed268b5c09119ffa8f3e49bdbb8cc3a501493
-
SHA256
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e
-
SHA512
5e90377bffeca100c91455b6865018752d7e45775462df0b161a2494986b2f94691fea20f3b0a030d6b5de384c53eb414fede069dae1cf319a0ab2585f2778b6
-
SSDEEP
3072:EiPyY93+BEF8F+7+w3wrOwo9aDZQNfEq02wfG:EiPyY1+T0fZH
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exequuucur.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quuucur.exe -
Executes dropped EXE 1 IoCs
Processes:
quuucur.exepid process 1780 quuucur.exe -
Loads dropped DLL 2 IoCs
Processes:
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exepid process 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
quuucur.exef5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /e" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /a" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /g" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /f" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /v" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /k" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /l" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /s" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /u" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /o" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /w" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /w" f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /c" quuucur.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /t" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /x" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /j" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /i" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /b" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /d" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /n" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /r" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /q" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /p" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /m" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /z" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /y" quuucur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quuucur = "C:\\Users\\Admin\\quuucur.exe /h" quuucur.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exequuucur.exepid process 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe 1780 quuucur.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exequuucur.exepid process 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe 1780 quuucur.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exedescription pid process target process PID 1160 wrote to memory of 1780 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe quuucur.exe PID 1160 wrote to memory of 1780 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe quuucur.exe PID 1160 wrote to memory of 1780 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe quuucur.exe PID 1160 wrote to memory of 1780 1160 f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe quuucur.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe"C:\Users\Admin\AppData\Local\Temp\f5a17b90c98709ba61afff6e9a01ba679f7ded79480c6447019d5111eca2788e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\quuucur.exe"C:\Users\Admin\quuucur.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD59c3100a9bd5acd2509b20951c5933cdf
SHA15ade718534bead0673190fba9f900d9ab1080a27
SHA256ffcbfbb86153959ea3fb3fbd1849ac9b2b626a7f3d88a3842f70ebc8519e5ae7
SHA5122639c0a1dd4b0ddd7a053eb982a9d99fd6c31433fe5dc53b3808a342482f129a810a6d5d5af2efe0b0d1cfdc3f00ba5e0acbc837f43903f06a14785f670d88e0
-
Filesize
184KB
MD59c3100a9bd5acd2509b20951c5933cdf
SHA15ade718534bead0673190fba9f900d9ab1080a27
SHA256ffcbfbb86153959ea3fb3fbd1849ac9b2b626a7f3d88a3842f70ebc8519e5ae7
SHA5122639c0a1dd4b0ddd7a053eb982a9d99fd6c31433fe5dc53b3808a342482f129a810a6d5d5af2efe0b0d1cfdc3f00ba5e0acbc837f43903f06a14785f670d88e0
-
Filesize
184KB
MD59c3100a9bd5acd2509b20951c5933cdf
SHA15ade718534bead0673190fba9f900d9ab1080a27
SHA256ffcbfbb86153959ea3fb3fbd1849ac9b2b626a7f3d88a3842f70ebc8519e5ae7
SHA5122639c0a1dd4b0ddd7a053eb982a9d99fd6c31433fe5dc53b3808a342482f129a810a6d5d5af2efe0b0d1cfdc3f00ba5e0acbc837f43903f06a14785f670d88e0
-
Filesize
184KB
MD59c3100a9bd5acd2509b20951c5933cdf
SHA15ade718534bead0673190fba9f900d9ab1080a27
SHA256ffcbfbb86153959ea3fb3fbd1849ac9b2b626a7f3d88a3842f70ebc8519e5ae7
SHA5122639c0a1dd4b0ddd7a053eb982a9d99fd6c31433fe5dc53b3808a342482f129a810a6d5d5af2efe0b0d1cfdc3f00ba5e0acbc837f43903f06a14785f670d88e0