Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 23:31
Static task
static1
Behavioral task
behavioral1
Sample
14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe
-
Size
219KB
-
MD5
62d4134cde56768ee8b4e0437ac84e20
-
SHA1
71b8a1ccf900b9fa84add1f0708ccbdc2ac6a73b
-
SHA256
14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45
-
SHA512
bee1ca09bba298e3d38e2dd4e4a8227adcf574930717c1f4ab4d0ae02410f92e9303f336aebbff0d0cbead132146b689078dd60e00da6c4bf1fd03088c244fae
-
SSDEEP
1536:ORiWvSMlp6jpF1vjZRs/AvBLACR2pBXhCku2f97jl3dhaFqL3O/jxTcx/jMcZ8FI:m7vpWjpIAvufOrNMxbVDtEDk
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quaow.exe -
Executes dropped EXE 1 IoCs
pid Process 848 quaow.exe -
Loads dropped DLL 2 IoCs
pid Process 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ quaow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\quaow = "C:\\Users\\Admin\\quaow.exe" quaow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe 848 quaow.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 848 quaow.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 848 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 27 PID 1692 wrote to memory of 848 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 27 PID 1692 wrote to memory of 848 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 27 PID 1692 wrote to memory of 848 1692 14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe 27 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26 PID 848 wrote to memory of 1692 848 quaow.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe"C:\Users\Admin\AppData\Local\Temp\14864a5524c83f9dc77db046407d24b11d25cd950b81190f9524baf669fdeb45.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\quaow.exe"C:\Users\Admin\quaow.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5d9768025fe62bcfb6ef1fcabef955d17
SHA1907b80d67969e833ae061a2e5ee06ad47d78c9f2
SHA256685d874d1b3105bb85831cc850581e4127eab25d5fd3b3e6c4ef8c1c582ad376
SHA5127deb8503a8e863b56065dd3a5f9db6cf8f71117d30749a6c885f65c98ae60f0ff904a158a0c9006aeba699476b9912d5fc4bd2c0e58cde9cf4e8a093001ebd20
-
Filesize
219KB
MD5d9768025fe62bcfb6ef1fcabef955d17
SHA1907b80d67969e833ae061a2e5ee06ad47d78c9f2
SHA256685d874d1b3105bb85831cc850581e4127eab25d5fd3b3e6c4ef8c1c582ad376
SHA5127deb8503a8e863b56065dd3a5f9db6cf8f71117d30749a6c885f65c98ae60f0ff904a158a0c9006aeba699476b9912d5fc4bd2c0e58cde9cf4e8a093001ebd20
-
Filesize
219KB
MD5d9768025fe62bcfb6ef1fcabef955d17
SHA1907b80d67969e833ae061a2e5ee06ad47d78c9f2
SHA256685d874d1b3105bb85831cc850581e4127eab25d5fd3b3e6c4ef8c1c582ad376
SHA5127deb8503a8e863b56065dd3a5f9db6cf8f71117d30749a6c885f65c98ae60f0ff904a158a0c9006aeba699476b9912d5fc4bd2c0e58cde9cf4e8a093001ebd20
-
Filesize
219KB
MD5d9768025fe62bcfb6ef1fcabef955d17
SHA1907b80d67969e833ae061a2e5ee06ad47d78c9f2
SHA256685d874d1b3105bb85831cc850581e4127eab25d5fd3b3e6c4ef8c1c582ad376
SHA5127deb8503a8e863b56065dd3a5f9db6cf8f71117d30749a6c885f65c98ae60f0ff904a158a0c9006aeba699476b9912d5fc4bd2c0e58cde9cf4e8a093001ebd20