Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 02:27

General

  • Target

    translations/qt_gl.qm

  • Size

    316KB

  • MD5

    0661ffabfbc50187f3ba38876b721946

  • SHA1

    eb5e7205355cfc6bcb4df27e224079842c97b296

  • SHA256

    204a01ac7deb6b5bae193afecbd1e50d18c73bf7d94badeb2bbfdf6123c4ed93

  • SHA512

    65ab66cc54d65e7678fa731a5c5f2cc9d6fc217b91ad47d538440811e09a23e49cd95ce62a79e3e8c275e250ac1a0b54bd289f6dd067573876da7aff54381d02

  • SSDEEP

    3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\translations\qt_gl.qm
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\translations\qt_gl.qm
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\translations\qt_gl.qm"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    c39c1b75069f9578c4991bbde177334a

    SHA1

    8b5fef1bdd07773d90b9c37e9735c6e9aa15144c

    SHA256

    9ea992cfb9a0c08a635f881b9fac762f33a08e66aaea4fabce9c1885e0c20c32

    SHA512

    db9af361d73af49112a4833c7643bbc76c797d1d1a231762fe6ff0e1acf4e112efa9d5488b3af80a300766b15150e71451f4cc7ca8efbf47095784b94c4aba67