6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
Size

23.6MB
MD5

f556d4d630a00a5b52d53149c5a571e3
SHA1

630b3e6bfc6dd2e2fef10b282e78701a63d07df3
SHA256

6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf
SHA512

b474f93b218185d08d42e61435fad03ac5351c80bfff640ea6868f49941829150bb92a455e7d40772d18a86fa5cca8d7a7291cf609c20bc5b4ecb96602c42a35
SSDEEP

393216:J/lD14+gS60vJ2JkYcCQhYESZP66UJ2KHEleIPoAqnS1zJOpCKXHF31uVbpNcueQ:ld14+Fp8xd5fKkleI/oaI8EHR1qbjQpK

Score

7^/10

bootkit discovery persistence upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023485-133.dat	upx
behavioral2/files/0x0007000000023487-136.dat	upx
behavioral2/memory/2020-137-0x00007FF728790000-0x00007FF729FAA000-memory.dmp	upx
behavioral2/memory/2020-141-0x00007FF728790000-0x00007FF729FAA000-memory.dmp	upx
behavioral2/memory/2020-140-0x00007FF81ECE0000-0x00007FF8204CA000-memory.dmp	upx
behavioral2/memory/3884-146-0x00007FF728790000-0x00007FF729FAA000-memory.dmp	upx
behavioral2/memory/400-149-0x00007FF728790000-0x00007FF729FAA000-memory.dmp	upx
behavioral2/memory/3616-160-0x00007FF728790000-0x00007FF729FAA000-memory.dmp	upx

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Qiibiosinfo.exe
File opened (read-only)	\??\K:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\X:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\J:	Qiibiosinfo.exe
File opened (read-only)	\??\M:	Qiibiosinfo.exe
File opened (read-only)	\??\Y:	Qiibiosinfo.exe
File opened (read-only)	\??\H:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\I:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\U:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\T:	Qiibiosinfo.exe
File opened (read-only)	\??\L:	Qiibiosinfo.exe
File opened (read-only)	\??\O:	Qiibiosinfo.exe
File opened (read-only)	\??\M:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\P:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\Y:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\G:	Qiibiosinfo.exe
File opened (read-only)	\??\Z:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\H:	Qiibiosinfo.exe
File opened (read-only)	\??\S:	Qiibiosinfo.exe
File opened (read-only)	\??\E:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\G:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\Q:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\T:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\K:	Qiibiosinfo.exe
File opened (read-only)	\??\Q:	Qiibiosinfo.exe
File opened (read-only)	\??\W:	Qiibiosinfo.exe
File opened (read-only)	\??\X:	Qiibiosinfo.exe
File opened (read-only)	\??\N:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\O:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\R:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\B:	Qiibiosinfo.exe
File opened (read-only)	\??\A:	Qiibiosinfo.exe
File opened (read-only)	\??\I:	Qiibiosinfo.exe
File opened (read-only)	\??\A:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\J:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\L:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\S:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\W:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\F:	QiiPECMD.exe
File opened (read-only)	\??\U:	Qiibiosinfo.exe
File opened (read-only)	\??\Z:	Qiibiosinfo.exe
File opened (read-only)	\??\V:	Qiibiosinfo.exe
File opened (read-only)	\??\B:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\V:	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
File opened (read-only)	\??\P:	Qiibiosinfo.exe
File opened (read-only)	\??\R:	Qiibiosinfo.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	Qiibiosinfo.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe

Executes dropped EXE 9 IoCs

pid	Process
1540	wimlib.EXE
2020	Qiibiosinfo.exe
3884	Qiibiosinfo.exe
400	Qiibiosinfo.exe
2592	QiiPECMD.exe
704	cxdir.exe
3616	Qiibiosinfo.exe
4620	cxdir.exe
1296	cxdir.exe

Loads dropped DLL 5 IoCs

pid	Process
1540	wimlib.EXE
2020	Qiibiosinfo.exe
3884	Qiibiosinfo.exe
400	Qiibiosinfo.exe
3616	Qiibiosinfo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Qiibiosinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Qiibiosinfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Qiibiosinfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	Qiibiosinfo.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2020	Qiibiosinfo.exe
2020	Qiibiosinfo.exe
3884	Qiibiosinfo.exe
3884	Qiibiosinfo.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	1540	wimlib.EXE
Token: SeSecurityPrivilege	1540	wimlib.EXE
Token: SeRestorePrivilege	1540	wimlib.EXE
Token: SeSecurityPrivilege	1540	wimlib.EXE
Token: SeTakeOwnershipPrivilege	1540	wimlib.EXE
Token: SeManageVolumePrivilege	1540	wimlib.EXE
Token: SeSystemEnvironmentPrivilege	2020	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	3884	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	400	Qiibiosinfo.exe
Token: SeBackupPrivilege	2592	QiiPECMD.exe
Token: SeRestorePrivilege	2592	QiiPECMD.exe
Token: 33	2592	QiiPECMD.exe
Token: SeIncBasePriorityPrivilege	2592	QiiPECMD.exe
Token: SeSystemEnvironmentPrivilege	3616	Qiibiosinfo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 216	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	94
PID 3364 wrote to memory of 216	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	94
PID 3364 wrote to memory of 216	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	94
PID 216 wrote to memory of 1540	216	cmd.exe	96
PID 216 wrote to memory of 1540	216	cmd.exe	96
PID 3364 wrote to memory of 3508	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	97
PID 3364 wrote to memory of 3508	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	97
PID 3364 wrote to memory of 3508	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	97
PID 3508 wrote to memory of 2020	3508	cmd.exe	99
PID 3508 wrote to memory of 2020	3508	cmd.exe	99
PID 3364 wrote to memory of 5008	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	100
PID 3364 wrote to memory of 5008	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	100
PID 3364 wrote to memory of 5008	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	100
PID 5008 wrote to memory of 3884	5008	cmd.exe	102
PID 5008 wrote to memory of 3884	5008	cmd.exe	102
PID 3364 wrote to memory of 3596	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	104
PID 3364 wrote to memory of 3596	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	104
PID 3364 wrote to memory of 3596	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	104
PID 3596 wrote to memory of 400	3596	cmd.exe	107
PID 3596 wrote to memory of 400	3596	cmd.exe	107
PID 3364 wrote to memory of 1988	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	108
PID 3364 wrote to memory of 1988	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	108
PID 3364 wrote to memory of 1988	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	108
PID 1988 wrote to memory of 2592	1988	cmd.exe	110
PID 1988 wrote to memory of 2592	1988	cmd.exe	110
PID 3364 wrote to memory of 2108	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	111
PID 3364 wrote to memory of 2108	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	111
PID 3364 wrote to memory of 2108	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	111
PID 2108 wrote to memory of 704	2108	cmd.exe	113
PID 2108 wrote to memory of 704	2108	cmd.exe	113
PID 3364 wrote to memory of 3732	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	114
PID 3364 wrote to memory of 3732	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	114
PID 3364 wrote to memory of 3732	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	114
PID 3732 wrote to memory of 3616	3732	cmd.exe	116
PID 3732 wrote to memory of 3616	3732	cmd.exe	116
PID 3364 wrote to memory of 4624	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	117
PID 3364 wrote to memory of 4624	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	117
PID 3364 wrote to memory of 4624	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	117
PID 4624 wrote to memory of 4620	4624	cmd.exe	119
PID 4624 wrote to memory of 4620	4624	cmd.exe	119
PID 3364 wrote to memory of 2268	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	120
PID 3364 wrote to memory of 2268	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	120
PID 3364 wrote to memory of 2268	3364	6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe	120
PID 2268 wrote to memory of 1296	2268	cmd.exe	122
PID 2268 wrote to memory of 1296	2268	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe
"C:\Users\Admin\AppData\Local\Temp\6fe49a3ed0b29b53cf2aa9112c154f511ad56428808acebb95008cf62bc186cf.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dism\
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dism\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --uefi
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Temp\UjyQii\QiiPECMD.exe
    C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\cxdir.exe -mohong
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\Qiibiosinfo.exe --disk
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --disk
    3⤵
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\cxdir.exe -mohong
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Temp\UjyQii\\cxdir.exe -mohong
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\UjyQii\QiiImagex.EXE

Filesize
845KB

MD5
dcd13e8935cd5a235d6d3124fc9d8bc2

SHA1
41426a7d1c5932ac6853186e41797f94c043e7dc

SHA256
3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e

SHA512
c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e

Download Submit
C:\Temp\UjyQii\QiiPECMD.exe

Filesize
1.2MB

MD5
0c281029701d9b5b6b4af837218628fc

SHA1
7ddbc1338a6e81e604fd10a43aee62b2b38c5f6f

SHA256
2583ac3e1529142cc2fead99d340f4253dc4f87743299e207772a1c8d0141bc1

SHA512
cddb8b658b170517f18baba9e2fae57f5d776a4c32394bd38bbacaec91d83b00007825d9c6109513ef26167dcea6a70d8f399904663e0dc28db76e3c21d8e0d5

Download Submit
C:\Temp\UjyQii\Qiibiosinfo.exe

Filesize
194KB

MD5
7d57bf77092c043109557e871c384c3e

SHA1
82e5c77a51aa06c42dfdd926e020a3b856c3efb1

SHA256
7b73ceb34696676ce117d8149fd1057e6593754a1f5f3d6744be30d32d10659b

SHA512
0dc1e1d68ce966dc565ed42bf80f4ea1abe54903852c4a84b10b0713814c6056a314970eee9b0b2609d11d2d8c6d7d4ca865ddf524ee71f509c1cb97957d5984

Download Submit
C:\Temp\UjyQii\WinRing0x64.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Temp\UjyQii\cxdir.exe

Filesize
42KB

MD5
2aa80509e9840822a3b6799a356efe90

SHA1
3dc558c97b209c91b7b45f90624f80c05c9094d0

SHA256
301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d

SHA512
9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2

Download Submit
C:\Temp\UjyQii\dism.wim

Filesize
2.9MB

MD5
89680fc75407e4047e92f9c80f798dc9

SHA1
1c024e24eaeda6809234658909c2bae24b8f091f

SHA256
34d6c13b673b87ea21e12e4fadf984662beb4b852f2f22d7ec83fb9d7a185276

SHA512
223e789344ea2710f26b76fccfeead5fbe183dd5c079e7c1a07a6321cee3b1efcd4308f41e8e36719679ecf3238907c8c9d788658f7736cd8fdcfa06f04b5e79

Download Submit
C:\Temp\UjyQii\dism\X64\dism.exe

Filesize
329KB

MD5
f350e791f2ed95fb4a6fc50a0ea32b37

SHA1
472a3de24cd10913354798d51082d20fb166b2b1

SHA256
3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f

SHA512
4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b

Download Submit
C:\Temp\UjyQii\libcdi.x64.dll

Filesize
171KB

MD5
08f864b7dc54bbc8c90d0765b401ffa8

SHA1
b4228701d611c0808b4e318cc29507b8961625ce

SHA256
2da0044c231dafcc4bbe4f1e65b21b47e95a0a2f229ff21ead35a5b67e46a6d4

SHA512
2ed430537bfb7b73ba252b90abefb9d577e35fe2f2f63ebb46d4d57ca631a90aa695b4fa65c463a8ede10703753782bd598c07f8c0d011ebfffd5a0072e44ef2

Download Submit
C:\Temp\UjyQii\libwim-15.dll

Filesize
472KB

MD5
9abce30396b5dfe99460283b727622d0

SHA1
26fbca9b5e8454053407b6738d76575ab68ec286

SHA256
6480b53d4ecd4423af9e100fe15e3d2c3d114eff33fba07977e46c1ab124342e

SHA512
5e06c346d5a8d78529065d7f7ef5a044ef467909452b644cef2600a57f57750957a2364eb413eef13a5a8cb78781e5e91f858e2ef9ab3c2b45e9c551085289b0

Download Submit
C:\Temp\UjyQii\pci.ids

Filesize
1.4MB

MD5
4796aa3a48936592cdb5bf664d47b2c0

SHA1
2892815355b81eb6aa8039f09cc7d19411441c1a

SHA256
f649f3d2f36b835403a229fc0bd3fef27ae39c688b40900c2ef41cdc0f644187

SHA512
9f63d254425d64f2d43f18cd10b8b5164f981814f50e5fe888a902cff6e79fd441c2ca7e9c70eac670a6f75664e0ee49ba9ad2b23b721c14030c97d1d6dfe7e8

Download Submit
C:\Temp\UjyQii\wimlib.EXE

Filesize
134KB

MD5
a9f8b061a59cc092ccb99f7da527dc61

SHA1
64ff9a79a22b3369995c276c73e45085b316fe48

SHA256
401bf99d6dec2b749b464183f71d146327ae0856a968c309955f71a0c398a348

SHA512
26ca90d6a81dd82eae0aa28577ae289928552880b0951837c80022886c19b833f612704bfd1af4eb06c96d711bfd8c391a16dc347b2616a13accad5c6a996ca0

Download Submit
memory/400-149-0x00007FF728790000-0x00007FF729FAA000-memory.dmp

Filesize
24.1MB

Download
memory/704-157-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1296-164-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1540-121-0x00007FF82F7B0000-0x00007FF82F84F000-memory.dmp

Filesize
636KB

Download
memory/1540-120-0x00007FF6BA6F0000-0x00007FF6BA71A000-memory.dmp

Filesize
168KB

Download
memory/2020-140-0x00007FF81ECE0000-0x00007FF8204CA000-memory.dmp

Filesize
23.9MB

Download
memory/2020-141-0x00007FF728790000-0x00007FF729FAA000-memory.dmp

Filesize
24.1MB

Download
memory/2020-137-0x00007FF728790000-0x00007FF729FAA000-memory.dmp

Filesize
24.1MB

Download
memory/3364-0-0x0000000000400000-0x00000000032CD000-memory.dmp

Filesize
46.8MB

Download
memory/3364-2-0x0000000000400000-0x00000000032CD000-memory.dmp

Filesize
46.8MB

Download
memory/3364-150-0x0000000000400000-0x00000000032CD000-memory.dmp

Filesize
46.8MB

Download
memory/3364-1-0x00000000032B2000-0x00000000032B3000-memory.dmp

Filesize
4KB

Download
memory/3364-3-0x0000000000400000-0x00000000032CD000-memory.dmp

Filesize
46.8MB

Download
memory/3364-5-0x00000000032B2000-0x00000000032B3000-memory.dmp

Filesize
4KB

Download
memory/3364-165-0x0000000000400000-0x00000000032CD000-memory.dmp

Filesize
46.8MB

Download
memory/3616-160-0x00007FF728790000-0x00007FF729FAA000-memory.dmp

Filesize
24.1MB

Download
memory/3884-146-0x00007FF728790000-0x00007FF729FAA000-memory.dmp

Filesize
24.1MB

Download
memory/4620-162-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download