Overview

overview

8

Static

static

3

QDeskSetup1.1.1.6.exe

windows7-x64

7

QDeskSetup1.1.1.6.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

D3DCompiler_43.dll

windows7-x64

1

D3DCompiler_43.dll

windows10-2004-x64

1

D3DX9_43.dll

windows7-x64

1

D3DX9_43.dll

windows10-2004-x64

1

VMProtectSDK64.dll

windows7-x64

1

VMProtectSDK64.dll

windows10-2004-x64

1

avcodec-58.dll

windows7-x64

1

avcodec-58.dll

windows10-2004-x64

1

avdevice-58.dll

windows7-x64

1

avdevice-58.dll

windows10-2004-x64

1

avfilter-7.dll

windows7-x64

1

avfilter-7.dll

windows10-2004-x64

1

avformat-58.dll

windows7-x64

1

avformat-58.dll

windows10-2004-x64

1

avutil-56.dll

windows7-x64

1

avutil-56.dll

windows10-2004-x64

1

breakpad.dll

windows7-x64

1

breakpad.dll

windows10-2004-x64

1

d3dx11_43.dll

windows7-x64

1

d3dx11_43.dll

windows10-2004-x64

1

driver/devcon.exe

windows10-2004-x64

1

driver/idd...dd.dll

windows10-2004-x64

1

driver/install.bat

windows7-x64

1

driver/install.bat

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 11:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    driver/install.bat
  • Size 913B
  • Sample240329-nzkdfagg89
  • SHA256 931170d763dbbf046aac972d548a182c473957714db63d99133ae65240459916
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\driver\install.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      2⤵
        PID:4532
      • C:\Windows\system32\find.exe
        find "10.0"
        2⤵
          PID:4312
        • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
          devcon status Nefarius\ViGEmBus\Gen1
          2⤵
          • Checks SCSI registry key(s)
          PID:4180
        • C:\Windows\system32\findstr.exe
          findstr "Driver is running"
          2⤵
            PID:2768
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon remove Nefarius\ViGEmBus\Gen1
            2⤵
            • Checks SCSI registry key(s)
            PID:4520
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon install vigem\ViGEmBus.inf Nefarius\ViGEmBus\Gen1
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:5044
          • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
            devcon status djpnewton\vmulti
            2⤵
            • Checks SCSI registry key(s)
            PID:4712
          • C:\Windows\system32\findstr.exe
            findstr "Driver is running"
            2⤵
              PID:3424
            • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
              devcon status Root\qdeskvhid
              2⤵
              • Checks SCSI registry key(s)
              PID:3360
            • C:\Windows\system32\findstr.exe
              findstr "Driver is running"
              2⤵
                PID:4884
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon remove *qdeskvhid*
                2⤵
                • Checks SCSI registry key(s)
                PID:3352
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon.exe install qdeskhid\qdeskhid.inf root\qdeskvhid
                2⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:2996
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon remove Root\Qdesk\IDD
                2⤵
                • Checks SCSI registry key(s)
                PID:232
              • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                devcon status Root\Qdesk\IDD
                2⤵
                • Checks SCSI registry key(s)
                PID:3124
              • C:\Windows\system32\findstr.exe
                findstr "Driver is running"
                2⤵
                  PID:784
                • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                  devcon remove Root\Qdesk\IDD
                  2⤵
                  • Checks SCSI registry key(s)
                  PID:2100
                • C:\Users\Admin\AppData\Local\Temp\driver\devcon.exe
                  devcon install idd\qdeskidd.inf Root\Qdesk\IDD
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2832
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1128
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3850783a-65a7-1f49-820d-a269cbc3d4b0}\vigembus.inf" "9" "429a86e87" "000000000000014C" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp\driver\vigem"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:4664
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce88408607219:ViGEmBus_Device:1.17.333.0:nefarius\vigembus\gen1," "429a86e87" "000000000000014C"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2672
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d439740c-eeaa-3644-8caf-751a62952425}\qdeskhid.inf" "9" "47099baef" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "c:\users\admin\appdata\local\temp\driver\qdeskhid"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:1712
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\USB\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce884788e99ee:qdeskhid_Device:14.16.37.368:root\qdeskvhid," "47099baef" "0000000000000160"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1140
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d06b75cc-d1af-8240-b678-50530b88de90}\qdeskidd.inf" "9" "4f369b2e7" "000000000000014C" "WinSta0\Default" "0000000000000184" "208" "c:\users\admin\appdata\local\temp\driver\idd"
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:3604
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem5.inf" "oem5.inf:c14ce8840c48fa1f:Qdeskidd_Install:14.7.32.627:root\qdesk\idd," "4f369b2e7" "000000000000014C"
                  2⤵
                  • Drops file in Drivers directory
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5056

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    vigembus.inf
                    • Path C:\Users\Admin\AppData\Local\Temp\{3850783a-65a7-1f49-820d-a269cbc3d4b0}\vigembus.inf
                    • Size 3KB
                    • SHA256 634b032a33cecbf2e43c46c5896a3c359cdda452c632da6396452419ffa301d6
                    • MD5 SHA1 SHA512
                    Submit Download

                    ViGEmBus.cat
                    • Path C:\Users\Admin\AppData\Local\Temp\{38507~1\ViGEmBus.cat
                    • Size 10KB
                    • SHA256 58b8a1bf9160fd4310a183b3431580eda2bc0a5ecaac2e0fbd6399184ff02404
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    qdeskidd.cat
                    • Path C:\Users\Admin\AppData\Local\Temp\{D06B7~1\qdeskidd.cat
                    • Size 11KB
                    • SHA256 0e2c1794746f2eabc4c92234257eea2a78a77e721285496e73293fe7398e7576
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    qdeskidd.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\{D06B7~1\qdeskidd.dll
                    • Size 84KB
                    • SHA256 3dc27c2c533fc448bd7d7a3920d11fbe024f7d16464f1f4cd346796a5844b69f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    qdeskhid.cat
                    • Path C:\Users\Admin\AppData\Local\Temp\{D4397~1\qdeskhid.cat
                    • Size 11KB
                    • SHA256 3dc91a3305343ae255155f509e4f3f1459437e4ad23845e252a859ac960dbcaa
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    qdeskhid.sys
                    • Path C:\Users\Admin\AppData\Local\Temp\{D4397~1\qdeskhid.sys
                    • Size 41KB
                    • SHA256 f9eb3f77e7a876dff81b9e7e524dff7b7de9c716999af506711d6b3008d1cdf6
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    qdeskidd.inf
                    • Path C:\Users\Admin\AppData\Local\Temp\{d06b75cc-d1af-8240-b678-50530b88de90}\qdeskidd.inf
                    • Size 3KB
                    • SHA256 bb3f1a3243059e8d9234b278e95003e7e0ac8979f4ba2a84fffc170224203f7a
                    • MD5 SHA1 SHA512
                    Submit Download

                    qdeskhid.inf
                    • Path C:\Users\Admin\AppData\Local\Temp\{d439740c-eeaa-3644-8caf-751a62952425}\qdeskhid.inf
                    • Size 2KB
                    • SHA256 71eef0e27bd7d25079353e889d62d4f096b4c51fa3ff6cffa9404c101aac7431
                    • MD5 SHA1 SHA512
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 19KB
                    • SHA256 e200329d0adb21e5a622329569e9895155275ee4cb0cfb1cf018623effc95493
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 19KB
                    • SHA256 13325c1d5650d750ab008d635e9205a8b45d22c98cfc1ac260d0e21fdfa55124
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    SET3961.tmp
                    • Path C:\Windows\System32\DriverStore\Temp\{77041586-67a4-804e-a683-aba8988d386f}\SET3961.tmp
                    • Size 161KB
                    • SHA256 8fb8402b7266fa9b9ea8841708317c8c25367b2947eeda9b6462c0e4801f05a4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download