Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0729d893aeb17d01a61877855d52e33c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0729d893aeb17d01a61877855d52e33c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0729d893aeb17d01a61877855d52e33c.exe
-
Size
48KB
-
MD5
0729d893aeb17d01a61877855d52e33c
-
SHA1
37c44c6c8225a71eaf9506f1dddb8c0f2a288b85
-
SHA256
c6164eb23e75fac6ccbf82e4729d6b6b7d04f456e6ed8e2d23abe1acb9583520
-
SHA512
1c98736fa5865645ee06c63400c4f8090780f30c887d581066b410cae97519f5735be225e971ce339fca9171a900a9471aed9695bd8174080cd5a9a008376e6b
-
SSDEEP
768:ljNEhmygYfsdYC7v+6wH9H7MfygXaDMFQXD7e:ljam+EeCX6NNDsQXD7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qlviis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 0729d893aeb17d01a61877855d52e33c.exe -
Executes dropped EXE 1 IoCs
pid Process 2148 qlviis.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qlviis = "C:\\Users\\Admin\\qlviis.exe" qlviis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe 2148 qlviis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1704 0729d893aeb17d01a61877855d52e33c.exe 2148 qlviis.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2148 1704 0729d893aeb17d01a61877855d52e33c.exe 92 PID 1704 wrote to memory of 2148 1704 0729d893aeb17d01a61877855d52e33c.exe 92 PID 1704 wrote to memory of 2148 1704 0729d893aeb17d01a61877855d52e33c.exe 92 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16 PID 2148 wrote to memory of 1704 2148 qlviis.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\0729d893aeb17d01a61877855d52e33c.exe"C:\Users\Admin\AppData\Local\Temp\0729d893aeb17d01a61877855d52e33c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\qlviis.exe"C:\Users\Admin\qlviis.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD52dbfe11d1faf48a928ad750f29684a46
SHA1eb3143b35fd7adb3082da1dffb9da7c206f1d722
SHA2566404e02d705e5b702e37ec8008320da7c1820a99fe4362753be86f03a6840b71
SHA5126624bfc9f15c81bed3a0715a59e1ef364937a236115d5352c57455aed942f118b123fd2704a2c2881ba6bc405c98a6172ed27187739358a0ef297d01ebcf8beb
-
Filesize
43KB
MD5403843e5ce0ab2d2fe804f1a0f426e89
SHA1507bd58fe1b56fc511d4e56456b657102abfb9b0
SHA256960577d1db11e49afb627e448696017926b8ba343c867a245bfbc16c55ee491c
SHA51219dcd82ac854a3877ba699e10f7f5d6256d5ee50f1c6e54a1e840226ce37280bc1c6b277407818a27a1702dfd5a5c9f26b9db579db9c1db20f9372374840aa6e
-
Filesize
48KB
MD5edbb28e8358cedf1095bfbec25cba16b
SHA16968e738d3dd58080f2f4ef24127f0aba34a6b62
SHA25659be99f1424a02d3f0bcd1f5883244c23fb6152c18aef75d5b058b28af6f18d2
SHA512916230fd3dc326adf4dc666e626b1843626878f00a4fa1dd8a1088d10b796ac4bdc571801336ec3e931b8d68ce4eb02e1ff1b5514b5d46bfae46fa16a50f326f