Analysis
- max time kernel
119s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/09/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3071841ab7c6f07644d2d9521c0aaf0N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
f3071841ab7c6f07644d2d9521c0aaf0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target f3071841ab7c6f07644d2d9521c0aaf0N.exe
- Size 168KB
- Sample240903-mgb4nsvgnb
- SHA256 26d4034da7063a001ac71ebc99cec05bc808cb58500b8ff595e3b2a75f6e8db3
- MD5 f3071841ab7c6f07644d2d9521c0aaf0
- SHA1 17b1257202b2d314e9458ddfdb19513e6e342628
- SHA512 f7138e74da6e0f8e1477192e8ad0784a8cb70a6a1166c36077c9844e48af0a64ebe62be00a0123458c3d42baf634627a77e8b299037581f26956c155429fae45
- SSDEEP 3072:Fu1zr1cPFBTZCchor5KFjvFP5YCkyJnnrr:EN+7ha5KFjNcaH
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f3071841ab7c6f07644d2d9521c0aaf0N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qvkeaw.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation f3071841ab7c6f07644d2d9521c0aaf0N.exe - Executes dropped EXE 1 IoCs
pid Process 3200 qvkeaw.exe - Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /e" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /k" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /o" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /x" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /r" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /f" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /w" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /b" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /d" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /s" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /y" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /j" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /g" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /c" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /u" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /i" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /v" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /j" f3071841ab7c6f07644d2d9521c0aaf0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /h" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /t" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /a" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /m" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /q" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /p" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /l" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /z" qvkeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvkeaw = "C:\\Users\\Admin\\qvkeaw.exe /n" qvkeaw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3071841ab7c6f07644d2d9521c0aaf0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qvkeaw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe 3200 qvkeaw.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 3200 qvkeaw.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1084 wrote to memory of 3200 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 90 PID 1084 wrote to memory of 3200 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 90 PID 1084 wrote to memory of 3200 1084 f3071841ab7c6f07644d2d9521c0aaf0N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3071841ab7c6f07644d2d9521c0aaf0N.exe"C:\Users\Admin\AppData\Local\Temp\f3071841ab7c6f07644d2d9521c0aaf0N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\qvkeaw.exe"C:\Users\Admin\qvkeaw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3200
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\qvkeaw.exe
- Size 168KB
- SHA256 119c237affdeb2e59fd31e92ed4e346cd74ffdda0e95666229be870ae96edcce
- MD5 1cc264f67005cc1516d753a4eebdac31
- SHA1 14c90870c45e36cc56070261c89a12ceff16374b
- SHA512 a68fd8bc0fe368c23a0b810e4e05bfd6a84ae3444c0e51095932c2ef46fb2bb82fb7cf0f2237ac53c6592c47d5148b7bc8fee444f1902348d2581804c668e625
- SSDEEP 3072:2u1zr2qFBTZCchor5KFjvFP5YCkyJnnrr:9Nx7ha5KFjNcaH
- MD5 SHA1 SHA512 SSDEEP