Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 18:46
General
-
Target
$TEMP/QuickStores_Unlocker.exe
-
Size
425KB
-
MD5
13e66d856d535b6739c1c634d915e0a8
-
SHA1
8b8a2b930b31fbde7243d64fa03073fbfdfd85fd
-
SHA256
40ad334f59cf5d27fb60cf3ce0e2ce423c781ec00b9e2a8d98aca91c6db7ecf2
-
SHA512
921398bdfb0e1a755adf228fb0b8f29404c1bc8c7d784618ae3223af85625510c0c5d42020368f3b0def70403bf62752bbafd8f62e86e9ad05001182aa923cb7
-
SSDEEP
6144:x/20g715fltZaDXy6VhYYFpPuZaSHQwNrj15WHMokC6ml6x8gtV81ohySfS:p20g7JtZaNzYworj1Ysokk6ig81ifS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 16 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\QuickStores_Unlocker.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\QuickStores_Unlocker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C022T.tmp\QuickStores_Unlocker.tmp"C:\Users\Admin\AppData\Local\Temp\is-C022T.tmp\QuickStores_Unlocker.tmp" /SL5="$F0046,166493,54272,C:\Users\Admin\AppData\Local\Temp\$TEMP\QuickStores_Unlocker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5792620390aae5305220283f2ce33ca68
SHA1d9fee4cb3e2fa5e7d88b45662fd58b30aa9979f0
SHA25621bc620515ebbdeb125d273c2d8db45577d05408ef624464af26afcfecfd201a
SHA512470914116f40e4f7216c840ccbc706eb7953c10e62195c9b4d15e73f422625096df6c68edb33c25e2eec3305b4a1b159054f812c4a2307aeb3e49d35ae5f575c
-
Filesize
683KB
MD5ce4e0ff83ac2a3256fd5c220562294a1
SHA172429c43cc4ed0a184a9c7b208902005489ff49a
SHA256130ec61d37b76fa26a4c7ebcf210467c5be3ae2ace7346546c65f093478bb06b
SHA512b375a78ca9b8e30ba665d3934716e5d3ac5737d8cf05a562f59c8b142923e3a79f1c44b55e995bd43fd0a9056a122cbe332d33947f626fa2d5bfb9f2e1824e98
-
Filesize
124KB
MD52613734670b491be45410d496cef7fa8
SHA15b9ae74a23e76863c025fdede54c4ee3316074fb
SHA256d84e2fcb321bb969eebca48d44787fffc8016f70660c4a58e46589dd22906bda
SHA51269dc8ad210361bce4c28b15ad31cfccb916557fd60d366642a90a37e046ba4b023c1d41833a15534ab9413f046a5af350403e44c7e80fc40eba58724c3d14c04
-
Filesize
39KB
MD55494d46cbe14a5e0644cb219c9ac2fea
SHA1d90389af5872217a258e4c5c07b7d064f50deea8
SHA256fd3c814cd7a101ae6d82e044e9bdfc3bccd0f8b402d8f028aca53dbddc00976d
SHA5120e3d40af922e8a2a1ed8f3a92080ff937dc6c700f1c28f34505c9710e55db0ff6f30f20ec4d36f9640fc344d799b97064a6f6b63d8da86851000c7c67e3e324f
-
Filesize
44KB
MD5723130df7bbca7fc4bfb1f829abd13b3
SHA1b0b2c0a3e9915ef419d5fa4f7d8c662445d78c99
SHA2560e7bcd39f8255eaa3c9dc017586fc52f6912c0c34fabea3143beef7b211ec4a6
SHA512037ecae3012c8e7ce6ced6f9faf10c2ebd46a517b0be4f59696f1758502741b43e7600a675c9260efee29210ab9e47b58e663ac54a434ce271c5082bed77d77c
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
80KB