Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe
-
Size
316KB
-
MD5
42b28e3768d82add2333264859336e9c
-
SHA1
accd4c5eb16a46563ebe77551c5dcab0656bd235
-
SHA256
7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41
-
SHA512
b21a61fa46e2b9a7086bb2c000263811f1f23b19ce262c2e3bc547367c472a938eb0b2c7e0917ba58893fceb83f9da479effc814ac1985dbbc2253bd1eeea152
-
SSDEEP
6144:6MfP4Psq8gFV91GGGLVTmrshXj0MQH1DUhu1GJu+DODryKnKx:xuUgFV6Hm1JKx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qyfix.exe -
Executes dropped EXE 1 IoCs
pid Process 1076 qyfix.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /i" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /h" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /P" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /w" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /B" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /U" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /A" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /d" 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /Y" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /l" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /R" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /K" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /W" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /J" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /F" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /Z" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /H" qyfix.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /v" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /O" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /c" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /D" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /r" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /N" qyfix.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /T" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /u" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /o" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /I" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /j" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /z" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /L" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /d" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /k" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /e" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /g" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /M" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /V" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /X" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /m" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /q" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /G" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /Q" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /p" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /n" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /b" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /y" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /f" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /x" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /t" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /a" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /E" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /C" qyfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyfix = "C:\\Users\\Admin\\qyfix.exe /s" qyfix.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe 1076 qyfix.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 1076 qyfix.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4248 wrote to memory of 1076 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 81 PID 4248 wrote to memory of 1076 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 81 PID 4248 wrote to memory of 1076 4248 7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe"C:\Users\Admin\AppData\Local\Temp\7529842af692dcff5882d0255ad3dacc85202edc964e906c68c82037e33b7f41.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\qyfix.exe"C:\Users\Admin\qyfix.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1076
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5e71e9ff4b802068064b737683d5489f6
SHA165d1e29c42a5b6b0184d16d733f8cf26c8060bae
SHA2564467e98be8fd5ff88b5b2d8fc4497e8068199604df085bbdcfffbb3553130455
SHA512515c7866c70720e4b3e4c03506b81b966ed7115cc6992172fe688f270c34f067851241562f745e78329c642d330d6f365d102408eb5320173625b12536dfde3d
-
Filesize
316KB
MD5e71e9ff4b802068064b737683d5489f6
SHA165d1e29c42a5b6b0184d16d733f8cf26c8060bae
SHA2564467e98be8fd5ff88b5b2d8fc4497e8068199604df085bbdcfffbb3553130455
SHA512515c7866c70720e4b3e4c03506b81b966ed7115cc6992172fe688f270c34f067851241562f745e78329c642d330d6f365d102408eb5320173625b12536dfde3d