4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QDeskSetup1.1.1.6.exe
Size

10.1MB
MD5

413fd3e1d20e10b93ceb366b51bf6f53
SHA1

e8a7d0c2ad2b4f923b56edecb547304f433eda07
SHA256

4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf
SHA512

9b90b7ff03decc5154cc8e07a40e0d7f73fe7e110809550957d3fc841526c62a6ca785c417ae717e9cad7ebd3cc96fbb96d304933fc5b79b26c71e27f85081fd
SSDEEP

196608:FC6Dc8zspBYxPYvYWAi19y5bx+ys/4OLQAFzTk9xRCk2KINKwXOIdpyVJ6:Fvzsp3vYm85b8yslZTcF8tXkI

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2024	QDeskSetup1.1.1.6.exe
2024	QDeskSetup1.1.1.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	QDeskSetup1.1.1.6.exe

C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe
"C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\ioSpecial.ini

Filesize
706B

MD5
9e852ff7375b83b21c9fa0d94379eb29

SHA1
0f9b35a414aed1c4b339c4f7fb13eed0e08a37eb

SHA256
9533d92f0f999877b787d663982ff7c4237fbfa18d3c173cd7d8dd162a842971

SHA512
0d21191bc68435f784ad7df772af3c9c1a2f6e29fc8528258e27c478229df5f4a7479728436a26599c2f09b5b7f928d28965e7e41407197beda748b86f329ea8

Download Submit
\Users\Admin\AppData\Local\Temp\nso3620.tmp\InstallOptions.dll

Filesize
14KB

MD5
20f3184efe7edddfef3325efc25d12a5

SHA1
8db4c500d73f9525a7e9834df6caea2e70189939

SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

Download Submit
\Users\Admin\AppData\Local\Temp\nso3620.tmp\LangDLL.dll

Filesize
5KB

MD5
ea60c7bd5edd6048601729bd31362c16

SHA1
6e6919d969eb61a141595014395b6c3f44139073

SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

Download Submit