86e26870c374db439a137ea800a2ac917504c88a041c033bbe78d876643cb4fb

Analysis

max time kernel
134s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24/02/2024, 13:32

Target
Fake-QR-Logger-main/README.md
Size 4KB
Sample240224-qs1g7ada73
SHA256 85c27bd6c6c11e8130124a81cc9b48879a23345dab49ffaa508d90cbc30ec530
MD5 f52d922ce63a057e00a726c419e8f226
SHA1 7bd0ce0420cad9a3f2c26c7ef73707051080cd9f
SHA512 d33c0350421199caf22198a1470c41917ee85268c9b8881cd3661603ac3cb257732a17b7113790d36568469575d495c455d06b08a3cbb8a115d6ca143e3ecec6
SSDEEP 96:62HWAfg9k+V7v2CczeczCczjOvxBI5XlrCcgbk+k8PIYfb7kTjgpA4Nmobjt+99i:6xAo9j/aeaCaCvxBI5Vupk+clyXI9GOC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1990815831-2007029909-3877453929-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fake-QR-Logger-main\README.md
1⤵
- Modifies registry class
PID:2124

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact