3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a

Analysis

user interaction
yes
max time kernel
898s
max time network
406s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZqousPerm.exe
Size 11.5MB
Sample260825-sdctpahf33
SHA256 3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a
MD5 ce423491e631ee64b4d7ff5da95c80af
SHA1 7f7fbb7d31a951a9abc4b670d4314c335ff7954b
SHA512 ea283cf017fd91732a6bf824215d4b3d66cc8e6b83efd73300f2c0fb910d5a1d7b3b26153e345dda3efa8af03ee07a3c2a8098bb3de75a26a5aa4564d5f36be0
SSDEEP 196608:0v0XvckyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:035u+I3qspVAmsu2K
TLSH
T1CBC68D16EBA649E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ZqousPerm.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ZqousPerm.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1740	cmd.exe
5484	cmd.exe
6104	cmd.exe
4380	cmd.exe
1220	cmd.exe
3088	cmd.exe
1684	cmd.exe
3012	cmd.exe
5508	cmd.exe
4620	cmd.exe
1788	cmd.exe
1112	cmd.exe
2604	cmd.exe
4760	cmd.exe
4544	cmd.exe
1588	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ZqousPerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	ZqousPerm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1336	ZqousPerm.exe
1336	ZqousPerm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1336	ZqousPerm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5652	WMIC.exe
Token: SeSecurityPrivilege	5652	WMIC.exe
Token: SeTakeOwnershipPrivilege	5652	WMIC.exe
Token: SeLoadDriverPrivilege	5652	WMIC.exe
Token: SeSystemProfilePrivilege	5652	WMIC.exe
Token: SeSystemtimePrivilege	5652	WMIC.exe
Token: SeProfSingleProcessPrivilege	5652	WMIC.exe
Token: SeIncBasePriorityPrivilege	5652	WMIC.exe
Token: SeCreatePagefilePrivilege	5652	WMIC.exe
Token: SeBackupPrivilege	5652	WMIC.exe
Token: SeRestorePrivilege	5652	WMIC.exe
Token: SeShutdownPrivilege	5652	WMIC.exe
Token: SeDebugPrivilege	5652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5652	WMIC.exe
Token: SeRemoteShutdownPrivilege	5652	WMIC.exe
Token: SeUndockPrivilege	5652	WMIC.exe
Token: SeManageVolumePrivilege	5652	WMIC.exe
Token: 33	5652	WMIC.exe
Token: 34	5652	WMIC.exe
Token: 35	5652	WMIC.exe
Token: 36	5652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5652	WMIC.exe
Token: SeSecurityPrivilege	5652	WMIC.exe
Token: SeTakeOwnershipPrivilege	5652	WMIC.exe
Token: SeLoadDriverPrivilege	5652	WMIC.exe
Token: SeSystemProfilePrivilege	5652	WMIC.exe
Token: SeSystemtimePrivilege	5652	WMIC.exe
Token: SeProfSingleProcessPrivilege	5652	WMIC.exe
Token: SeIncBasePriorityPrivilege	5652	WMIC.exe
Token: SeCreatePagefilePrivilege	5652	WMIC.exe
Token: SeBackupPrivilege	5652	WMIC.exe
Token: SeRestorePrivilege	5652	WMIC.exe
Token: SeShutdownPrivilege	5652	WMIC.exe
Token: SeDebugPrivilege	5652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5652	WMIC.exe
Token: SeRemoteShutdownPrivilege	5652	WMIC.exe
Token: SeUndockPrivilege	5652	WMIC.exe
Token: SeManageVolumePrivilege	5652	WMIC.exe
Token: 33	5652	WMIC.exe
Token: 34	5652	WMIC.exe
Token: 35	5652	WMIC.exe
Token: 36	5652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4700	WMIC.exe
Token: SeSecurityPrivilege	4700	WMIC.exe
Token: SeTakeOwnershipPrivilege	4700	WMIC.exe
Token: SeLoadDriverPrivilege	4700	WMIC.exe
Token: SeSystemProfilePrivilege	4700	WMIC.exe
Token: SeSystemtimePrivilege	4700	WMIC.exe
Token: SeProfSingleProcessPrivilege	4700	WMIC.exe
Token: SeIncBasePriorityPrivilege	4700	WMIC.exe
Token: SeCreatePagefilePrivilege	4700	WMIC.exe
Token: SeBackupPrivilege	4700	WMIC.exe
Token: SeRestorePrivilege	4700	WMIC.exe
Token: SeShutdownPrivilege	4700	WMIC.exe
Token: SeDebugPrivilege	4700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4700	WMIC.exe
Token: SeRemoteShutdownPrivilege	4700	WMIC.exe
Token: SeUndockPrivilege	4700	WMIC.exe
Token: SeManageVolumePrivilege	4700	WMIC.exe
Token: 33	4700	WMIC.exe
Token: 34	4700	WMIC.exe
Token: 35	4700	WMIC.exe
Token: 36	4700	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4700	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	ZqousPerm.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4620	1336	ZqousPerm.exe	81
PID 4620 wrote to memory of 5652	4620	cmd.exe	82
PID 1336 wrote to memory of 2604	1336	ZqousPerm.exe	84
PID 2604 wrote to memory of 4700	2604	cmd.exe	85
PID 1336 wrote to memory of 1220	1336	ZqousPerm.exe	86
PID 1220 wrote to memory of 4896	1220	cmd.exe	87
PID 1336 wrote to memory of 3088	1336	ZqousPerm.exe	88
PID 3088 wrote to memory of 556	3088	cmd.exe	89
PID 1336 wrote to memory of 1684	1336	ZqousPerm.exe	90
PID 1684 wrote to memory of 4732	1684	cmd.exe	91
PID 1336 wrote to memory of 1740	1336	ZqousPerm.exe	92
PID 1740 wrote to memory of 3080	1740	cmd.exe	93
PID 1336 wrote to memory of 1788	1336	ZqousPerm.exe	94
PID 1788 wrote to memory of 2160	1788	cmd.exe	95
PID 1336 wrote to memory of 4760	1336	ZqousPerm.exe	96
PID 4760 wrote to memory of 1080	4760	cmd.exe	97
PID 1336 wrote to memory of 5484	1336	ZqousPerm.exe	98
PID 5484 wrote to memory of 5888	5484	cmd.exe	99
PID 1336 wrote to memory of 3012	1336	ZqousPerm.exe	100
PID 3012 wrote to memory of 1728	3012	cmd.exe	101
PID 1336 wrote to memory of 4544	1336	ZqousPerm.exe	102
PID 4544 wrote to memory of 3652	4544	cmd.exe	103
PID 1336 wrote to memory of 6104	1336	ZqousPerm.exe	104
PID 6104 wrote to memory of 2068	6104	cmd.exe	105
PID 1336 wrote to memory of 4380	1336	ZqousPerm.exe	106
PID 4380 wrote to memory of 5152	4380	cmd.exe	107
PID 1336 wrote to memory of 1588	1336	ZqousPerm.exe	108
PID 1588 wrote to memory of 3720	1588	cmd.exe	109
PID 1336 wrote to memory of 5508	1336	ZqousPerm.exe	110
PID 5508 wrote to memory of 3420	5508	cmd.exe	111
PID 1336 wrote to memory of 1112	1336	ZqousPerm.exe	112
PID 1112 wrote to memory of 5460	1112	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe
"C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber
    3⤵
    PID:556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get SerialNumber
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get SystemType
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get SystemType
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Version
    3⤵
    PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get BuildNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get BuildNumber
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get Product
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get IdentifyingNumber
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic get MACAddress
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic get MACAddress
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Version
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads