Analysis

  • max time kernel
    141s
  • max time network
    156s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-01-2024 22:59

General

  • Target

    translations/qtbase_cs.qm

  • Size

    170KB

  • MD5

    c57d0de9d8458a5beb2114e47b0fde47

  • SHA1

    3a0e777539c51bb65ee76b8e1d8dce4386cbc886

  • SHA256

    03028b42df5479270371e4c3bdc7df2f56cbbe6dda956a2864ac6f6415861fe8

  • SHA512

    f7970c132064407752c3d42705376fe04facafd2cfe1021e615182555f7ba82e7970edf5d14359f9d5ca69d4d570aa9ddc46d48ce787cff13d305341a3e4af79

  • SSDEEP

    3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\translations\qtbase_cs.qm
    1⤵
    • Modifies registry class
    PID:3192
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads