Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe
Resource
win10v2004-20240226-en
General
-
Target
07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe
-
Size
180KB
-
MD5
6c195fdd3feed05dfb0f92bd596f0882
-
SHA1
9aaa4b3097944475d5126da567b1e9aa1b3a775f
-
SHA256
07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66
-
SHA512
108e38341c3698d5c3beedeb4e57e009d0e741a3f434c2e4506aea96fcbd9fab6865d5b92aa49251e8f524c2b12708f4664ace02109e2c51142286c5e66214af
-
SSDEEP
768:lM/HdK9ki5+OXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:lkUqHyj6S3T77
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qlviis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe -
Executes dropped EXE 1 IoCs
pid Process 3744 qlviis.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qlviis = "C:\\Users\\Admin\\qlviis.exe" qlviis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe 3744 qlviis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2208 07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe 3744 qlviis.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3744 2208 07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe 92 PID 2208 wrote to memory of 3744 2208 07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe 92 PID 2208 wrote to memory of 3744 2208 07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe 92 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85 PID 3744 wrote to memory of 2208 3744 qlviis.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe"C:\Users\Admin\AppData\Local\Temp\07a689b13a762ea04a4ce737e1ab5bf07b941766b4dd39ce042733727cd82c66.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\qlviis.exe"C:\Users\Admin\qlviis.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD51d18e65f848975345799bbc904763301
SHA15bab6e0642ce0617c39963c32b2867c7ae70bffa
SHA2569c34ae20ce2f84721775df228d83859fcfac6c2557101315e58b9a1141f5475d
SHA5129c8f2b361217942626ee3297de7a8519a2f8c4d19beb6d5679b682cb733193cd68f55f50bdd5ece35fd18ba9c139e4b21179680373f0ce29a0f5b5e59ccfbf1b