Overview

overview

4

Static

static

3

QuickSFV.exe

windows11-21h2-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    QuickSFV.exe
  • Size 101KB
  • Sample260522-24c2taav4s
  • SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QuickSFV.exe
    "C:\Users\Admin\AppData\Local\Temp\QuickSFV.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3556
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4368
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4a29c728,0x7ffc4a29c734,0x7ffc4a29c740
      2⤵
        PID:3020
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,2727511899645117868,9856252579393224214,262144 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1848 /prefetch:2
        2⤵
          PID:4060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2260,i,9329709186466943287,1237278726503104848,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:11
          2⤵
          • System Time Discovery
          PID:2244
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2392,i,13338294540397046264,15820076262824597792,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:13
          2⤵
            PID:1296
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,13444908149596528528,9611668509965506649,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
            2⤵
              PID:1860
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3584,i,8242866903901376072,3499118342008928879,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3596 /prefetch:1
              2⤵
                PID:1152
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,11223275277311030764,5232513085707662274,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:9
                2⤵
                  PID:1728
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,8476972691955586032,17333511226444690909,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:1
                  2⤵
                    PID:4632
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5556,i,16934030791722033298,2528128094624370285,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:14
                    2⤵
                      PID:1648
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5548,i,7317933751519045714,9075883570521063779,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
                      2⤵
                        PID:2852
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4840,i,16662754279643691354,9483642222879675289,2097152 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
                        2⤵
                          PID:776
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3272,i,4573671713822079285,11195339762360518845,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:14
                          2⤵
                            PID:856
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3652,i,14657566247103665928,581269704333520698,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3716 /prefetch:14
                            2⤵
                              PID:1952
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3700,i,575098241991320962,1142636375818867392,524288 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:14
                              2⤵
                                PID:568
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5036,i,63145263430450542,7459099320264290077,262144 --field-trial-handle=1836,i,11037199384017451447,11536616531174605714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:10
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1344
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:1748
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:2032

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      997f4dab-b29e-4565-ab9b-56e447a23977.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\997f4dab-b29e-4565-ab9b-56e447a23977.tmp
                                      • Size 17KB
                                      • SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BookmarkMergedSurfaceOrdering
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                      • Size 6B
                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      BrowsingTopicsState
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                      • Size 649B
                                      • SHA256 70f656de912a7dd72c896f6bc514bc41107dbef57fa1835da33d61e7a018ae40
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                      • Size 2KB
                                      • SHA256 a2973ae2e8df718c813532cd206049d3a8e1024bbac4ac1fdb04e07549918116
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      • Size 2KB
                                      • SHA256 f724e5fc5f68c44f77430e51e9c8df261cc97fcf57699ce0f430e3ba39aa240c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      • Size 4KB
                                      • SHA256 844758cdf8a8b3bef9ef08058c1e60b21a73e3000e930e491e8ee4f0eabfe812
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 ed1b2ad7119ecd442b191d811d9c14195ac06f997a2956c41c6dfed487e56636
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 12KB
                                      • SHA256 a8af967ca91dce8cb247d7a0e8f110eb955c2dda4f3b0df3ede6952cf46e0b2d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      the-real-index
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                      • Size 120B
                                      • SHA256 fb46b5049edc028911c84932764180c7a8bd623335e80fcd8e80829051d13100
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      the-real-index~RFe58b0cd.TMP
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b0cd.TMP
                                      • Size 96B
                                      • SHA256 da8d768f9db6ba9188a48864cc640580312727c72a37b1bf547afd55e52c1019
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 115KB
                                      • SHA256 13733a6cb270cc192800abfb69ff2f43da8d017bc2aafe1c4b997c3a5bc2cfd4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 231KB
                                      • SHA256 921f16aa1e0508a57888dc2f2f3b60b7b6747fdea2e4515c5c496e1b2b4931ca
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      e5882616-af4a-49a3-96a0-cf24df3362b3.tmp
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e5882616-af4a-49a3-96a0-cf24df3362b3.tmp
                                      • Size 232KB
                                      • SHA256 501c805690e1ce6f89ea8395ae58df56117fbc8d725954cac10783fa9ddcb80d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      QuickSFV.ini
                                      • Path C:\Users\Admin\AppData\Local\Temp\QuickSFV.ini
                                      • Size 39B
                                      • SHA256 6371a0e6d66f0fab5665719ecb06f3da7b09d4a02a0cc0deba1f811a8b7f0cfd
                                      • MD5 SHA1 SHA512
                                      Submit Download