Overview

overview

8

Static

static

3

QwikTwik-S...15.exe

windows10-2004-x64

8

QwikTwik-S...15.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    QwikTwik-Setup-1.1.15.exe
  • Size 60.8MB
  • Sample261104-vpvvrayt2k
  • SHA256 f46c4ddcb3d94ab87fbf9cdfffc07f02a1264b6db6d7a9818950d473415ac351
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceransomware

Malware Config

Targets

    • Target
      QwikTwik-Setup-1.1.15.exe
    • Size 60.8MB
    • SHA256 f46c4ddcb3d94ab87fbf9cdfffc07f02a1264b6db6d7a9818950d473415ac351
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutioninstallerpersistenceransomware

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Modifies boot configuration data using bcdedit

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks