Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 13:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1aacbef4a98cb921cc6916f5ec08c3b0.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1aacbef4a98cb921cc6916f5ec08c3b0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1aacbef4a98cb921cc6916f5ec08c3b0.exe
-
Size
256KB
-
MD5
1aacbef4a98cb921cc6916f5ec08c3b0
-
SHA1
6cd15a314ab76eb420838a491a3afe0e1fa0a30e
-
SHA256
b4d406c78e5f2b076f6888ac67f21b48ddd0c8968e899f1757ecf473c43e4767
-
SHA512
5b4267856ef8a2b688042cf7627be678a200d6a4f1bc2ea432d5d4edfcc0eb4d742a3d09c619c5cf517c0567bab1831fbe8ff7ad1c7db42af2a170f1e46ffa7d
-
SSDEEP
6144:Jlr3NLWUJP6wS0pea6R9Pofm7zsn5QMu+6VU:JlDnql
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quouhi.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 1aacbef4a98cb921cc6916f5ec08c3b0.exe -
Executes dropped EXE 1 IoCs
pid Process 3872 quouhi.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /w" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /i" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /J" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /k" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /E" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /A" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /e" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /h" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /P" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /g" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /G" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /M" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /S" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /j" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /p" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /z" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /Q" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /W" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /d" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /X" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /u" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /o" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /l" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /C" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /a" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /Z" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /n" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /b" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /v" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /O" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /K" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /x" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /N" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /D" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /L" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /I" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /F" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /U" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /f" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /B" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /r" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /T" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /Y" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /t" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /q" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /y" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /s" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /H" quouhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quouhi = "C:\\Users\\Admin\\quouhi.exe /m" quouhi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe 3872 quouhi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2640 1aacbef4a98cb921cc6916f5ec08c3b0.exe 3872 quouhi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2640 wrote to memory of 3872 2640 1aacbef4a98cb921cc6916f5ec08c3b0.exe 74 PID 2640 wrote to memory of 3872 2640 1aacbef4a98cb921cc6916f5ec08c3b0.exe 74 PID 2640 wrote to memory of 3872 2640 1aacbef4a98cb921cc6916f5ec08c3b0.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aacbef4a98cb921cc6916f5ec08c3b0.exe"C:\Users\Admin\AppData\Local\Temp\1aacbef4a98cb921cc6916f5ec08c3b0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\quouhi.exe"C:\Users\Admin\quouhi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5c60254df4af7603c907302809328a9ab
SHA15b7992f9d9ea685d5ffeefbe589261d255bdb925
SHA25686c2da14b6e46b745f8f1b37cada7daf895187492b5481052e25ee24c1e0474d
SHA51285e729fe30bdf4de421f997aa0b1808c5a49d7439d6af775d0c44ac6d4a80bc22e3b74cbaada412dc312b4e2deafe7139df7720006c47bc7254a2fda845d9480