37570137206f3b9372bd0a05ced400b528e0fc27d08d8d928afaf2691056d436

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setupqc.exe
Size

12.5MB
MD5

a649512a197804a9e092055f0ac0bfeb
SHA1

a97053562a578bf9b9c18cf7bc19851621e4776d
SHA256

5d7d160fe2526ea85708ddbcc70c49bd97af6ee2ecb9459fb4318d0302aa1fd7
SHA512

e3991b21d45eb811670517fda214f02ebdadbb11ba1d59c8853080aa23d023a7366bc230db0ec910a47f5242af704ab6c63ce5ec8d9818697b9920bc3d885227
SSDEEP

393216:Xpmn+Xvi65+YQU+hCW73xTwLDtQJTgGuU3xt3CF9VU:8nwfN8CL5Qju8Hug

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3032	Setupqc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setupqc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	Setupqc.exe

C:\Users\Admin\AppData\Local\Temp\Setupqc.exe
"C:\Users\Admin\AppData\Local\Temp\Setupqc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ci0-temp\install.bmp

Filesize
20KB

MD5
f6dc62a8543452e5fac9f4dc897b47c5

SHA1
3d421d5a6ce66a2ac9a117056ba945a97ece81f9

SHA256
a6a8fa6296f63cf3cf3c181f7f483b053447597d6825fbcfef73a87ece5ce026

SHA512
525db38873459986e6e02457bb9894f6dc50af0abe15eff8af758b3f589fe5f34e71b03155253e6f835d30508ea852c68b060e24d671c70186fe3adb9d6c10c7

Download Submit
\Users\Admin\AppData\Local\Temp\gert0.dll

Filesize
88KB

MD5
33976355fddbceb0fbe54887ee4d1596

SHA1
914c49a8a58605186d7dabeb3a67b88578c84c14

SHA256
51baaf313b57462eaa38aaf69aea6e8dbbc20f3714343817266e7f35bc2235fb

SHA512
be34e4042074da841cfbdbe3a379489b7a968f69a2bb372ce5925e0328d259af2fc0d29d02a787b8d4cfe70158bfc018bf7f6da35c26e670aea847efe3cb8389

Download Submit