c33df6609f32072b9327d6786ff5745f3df412acf93c0f5ec317ca96fca415fb

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QFsetup.exe
Size

1.8MB
MD5

00153955e305592baf9a2add40af8b97
SHA1

f295407f566f9f9053adbc9318c962151a294408
SHA256

95ed8ef4f83cc3c6d1699541dab4ee838beed60d431c9561900f9538c4ea6365
SHA512

c40bb6bf9381683219290d606b7f9aac7c0ec595513dc76b03892ff40571b9c836d2c93685fd03baaaf7c8aafa0be64a62cb329ca5d4116e58fea922e6c77610
SSDEEP

24576:8y9r0T5aDO+j8oOgFGPdsjuTfOM7IoH5qMZxjkD3KZpWcUHPhBj+T5rPpnsE4lnF:F0T5aDJjU6Klpx8jKZATQxsXw6RR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2496	QFsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	QFsetup.exe

C:\Users\Admin\AppData\Local\Temp\QFsetup.exe
"C:\Users\Admin\AppData\Local\Temp\QFsetup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5A61.tmp\ioSpecial.ini

Filesize
605B

MD5
a70b61deef7f463ab0abdafc674266b1

SHA1
9bc042891a15d94a5baaeb0adb523758a666132e

SHA256
95fd9638f9059299fa1f5ae0d1df9ca5f1a6d58f15ab805832d9d5e8ba8eaacf

SHA512
c8937199e69556f495c0724129e3c385e1ae734dfe7b871a65e88dae2b11ce6d6da019d12244925b6f96ff54ce9cbbc6f6316726c3f8c712659cd11cb366bc67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5A61.tmp\ioSpecial.ini

Filesize
396B

MD5
0b83fc95dd96ddf73a66b08a59b1667e

SHA1
f190fdf850f64364d38cccb7f005e9d08ad9b411

SHA256
529a5aed86479637f50b8cdd8ffdf4363014a5f635c08d8514ea255b81db4bc1

SHA512
5baaf183d7cbd8356f08dda1c84bc75636e77d375932d8fabecd1d5848ce6ad36866e01f9f110bd4dc3a402e4b4dc484a723c89669e6e70bbc3557b2bef581b5

Download Submit
\Users\Admin\AppData\Local\Temp\nso5A61.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit