659c54979fa4c75840e4ee9b17393be08dd86c5e7c726493b7eb58a8623bb6a7

Analysis

max time kernel
145s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06/07/2024, 21:12

Target

QtGraphicalEffects/DropShadow.qml
Size

12KB
MD5

c4df6196555578a35d0d81012fb946ad
SHA1

c33ca563feae48724c8f41351a689a4786c682e4
SHA256

f1101f41816f3c518ef77077cbdcbeb15f4f8119db3bddfc0959ca3c4c45fdf3
SHA512

85a99272709a605d55c1fc3f17ed682db6ace93eeb2ec1680010676c01f0b4b2c6c0840de3c5fbbd321f138a5eb0b83e576f82b207ecb26271e781a5ee831273
SSDEEP

96:naizgUldGcQWG3gGj4MhuB4Nd1az/ivsCI8/ivse3gmZJOo1o6ZK5W8f6:nRscGh3g+ldUz/ivfx/ivP3h1o6Chi

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
328	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QtGraphicalEffects\DropShadow.qml
1⤵
- Modifies registry class
PID:2020

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact