General
- Target v2_builds_latest_QuiverPhotos-amd64-installer.exe
- Size 14.6MB
- Sample240709-1jl9bayglb
- SHA256 5a1191d2527486f195ab010ad2bd770019ea9c881496d757e2ba1b0f31115fba
Malware Config
Targets
-
- Target v2_builds_latest_QuiverPhotos-amd64-installer.exe
- Size 14.6MB
- SHA256 5a1191d2527486f195ab010ad2bd770019ea9c881496d757e2ba1b0f31115fba
Score8/10Downloads MZ/PE file
Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 32KB
- SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
Score3/10 -
- Target $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score8/10Downloads MZ/PE file
Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
- Target QuiverPhotos.exe
- Size 13.2MB
- SHA256 9abc771cc6af7025e4c42e474aa5c9beb2a32a2bd3136914022fe3af2f242fe6
Score8/10Downloads MZ/PE file
Event Triggered Execution: Image File Execution Options Injection
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.