Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c82a2781bf15bb0309caf3e205bad74a.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c82a2781bf15bb0309caf3e205bad74a.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c82a2781bf15bb0309caf3e205bad74a.exe
-
Size
156KB
-
MD5
c82a2781bf15bb0309caf3e205bad74a
-
SHA1
c0252b662bb6d4251918b33105bb43546e5fc88d
-
SHA256
aeb47eba92677e45dfb9606ceb4a27ceaab2e47dd20224a22f56beb0ca6e22e0
-
SHA512
4ef8f3c90a0e5bde81ddf3d911549bc2ec2170ca92783f9f6abf368d9d37954d4564f35f3074fb4dce48b89f2a222f0e358b65093da940e07a14ca80b444158a
-
SSDEEP
3072:oBd1rE2MtU7Qv0w4ZRRQMMDwtIMCeFP4ANQ4oQZiE+0D:6dBE2R7Qvb4tQTaCeFP4AqWx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c82a2781bf15bb0309caf3e205bad74a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qauzo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation c82a2781bf15bb0309caf3e205bad74a.exe -
Executes dropped EXE 1 IoCs
pid Process 872 qauzo.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /q" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /c" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /Q" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /N" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /m" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /P" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /h" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /n" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /k" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /X" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /E" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /G" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /L" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /V" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /K" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /C" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /o" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /i" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /u" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /t" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /W" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /I" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /a" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /F" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /O" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /x" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /M" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /D" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /p" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /U" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /s" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /l" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /R" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /j" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /b" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /Z" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /Y" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /J" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /d" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /r" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /f" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /T" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /e" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /T" c82a2781bf15bb0309caf3e205bad74a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /y" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /S" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /B" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /v" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /g" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /w" qauzo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qauzo = "C:\\Users\\Admin\\qauzo.exe /A" qauzo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 c82a2781bf15bb0309caf3e205bad74a.exe 2728 c82a2781bf15bb0309caf3e205bad74a.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe 872 qauzo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2728 c82a2781bf15bb0309caf3e205bad74a.exe 872 qauzo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 872 2728 c82a2781bf15bb0309caf3e205bad74a.exe 101 PID 2728 wrote to memory of 872 2728 c82a2781bf15bb0309caf3e205bad74a.exe 101 PID 2728 wrote to memory of 872 2728 c82a2781bf15bb0309caf3e205bad74a.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\c82a2781bf15bb0309caf3e205bad74a.exe"C:\Users\Admin\AppData\Local\Temp\c82a2781bf15bb0309caf3e205bad74a.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\qauzo.exe"C:\Users\Admin\qauzo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5cb070d0771f74ec629ed2c4c49c2b1ab
SHA1aee3878ee518221a7d95abfac64230937a082cbf
SHA2560dc5b3ef752d0abbf7dc4652fd7e56d1aece06f0fe94ea7cffa9b25eea2bdc60
SHA512cd900ff9bda3a35a8147c0ed358cb1461fa88810cc0b20923ccba9d30a832833140b9ef446db61629e0176f3fe6254789fa76606d378d5e03195b2ed3920d941