956abb3f2c6a4eb1635051125e04996ab099dfb9e799ba9f49b834a4f2095782

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qwikmark.exe
Size 84KB
Sample260415-g6bljsbs3v
SHA256 956abb3f2c6a4eb1635051125e04996ab099dfb9e799ba9f49b834a4f2095782
MD5 d1588b02a2889729152c6cb8410459b4
SHA1 9119d2a734cc67fccaaafc3f82966f7e9c9ab72d
SHA512 e2e2a0334c84ab682295ca5ef42ea4364901c57649b38943c8597521292e6851a57fc7cf7f2fd9ebd255d60833d16b5f0e5f33203d628cde17da7e1f08be384d
SSDEEP 1536:GnazUMIK49HA0WQKwNJ6lbibGP3QMAGo2U/eMJL/o7Of:+oIK4VA0zNJ8BIMAGi/o7O
TLSH
T1A5836C3267D1C163D49601B025A5AF679FFABE3412364C8BE7583A8B7EB05F2D931602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwikmark.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\5	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\VendorIdentifier	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\8	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\3	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\VendorIdentifier	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\VendorIdentifier	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\6	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\1	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\4	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\7	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	qwikmark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\2	qwikmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	qwikmark.exe

C:\Users\Admin\AppData\Local\Temp\qwikmark.exe
"C:\Users\Admin\AppData\Local\Temp\qwikmark.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240700859.bin

Path C:\240700859.bin
Size 16.0MB
SHA256 341aacac661ccb210720bedaa9ead5d668fe5ea41a73532fc147c71e34040df1
MD5 e06888832b83d4f381e885edebd1d782
SHA1 b2c3166c5c8f4558f82d6ab565e6640d9fbf39ba
SHA512 3f8349df130ba8deb450e2907e0d5814103a01490fde3d9d7b5c1083a8ca6ed44757e51bdb70767cdce3c7dfafaccc526a7f2798a07208ecdfbac14e82ed88e9
SSDEEP 192:znnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnb:n
TLSH
T1F6F69524E6514D7D1F175ADCD04E44DF554FCDE302C5002517F186D1C510294440ED1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-0-0x00000000752FA000-0x00000000752FB000-memory.dmp

Download

memory/552-1-0x00000000752F9000-0x00000000752FA000-memory.dmp

Download

memory/552-3-0x00000000752F9000-0x00000000752FA000-memory.dmp

Download

memory/552-2-0x00000000752FA000-0x00000000752FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads