659c54979fa4c75840e4ee9b17393be08dd86c5e7c726493b7eb58a8623bb6a7

Analysis

max time kernel
90s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06-07-2024 21:12

Target

QtGraphicalEffects/private/DropShadowBase.qmlc
Size

7KB
MD5

43574d74110a1b10d316c6a2f569094e
SHA1

b5b5dfc884730eed4f36619372b23eef7faeddb2
SHA256

0ee34715c54dd74bb850e80d393b359cb71de60ce25cfdc20f9fa7efce37fe2f
SHA512

2612ef687504a1bca53bd4a2cb8c331ed1ba8314e4a981e08727e08b77aa1c9ad25d9e9d1df61e84777ee85f7e1f290d0ffc0e837daf9ddad7d1d6dbc23a0e74
SSDEEP

48:4PNmd48VJuVPCAHzHlHd2egJxtlkmMt0GebxWUQxZ+l4VZjxVcGrLGfGOTS4Agkp:sM48V8HzuegsmMt0RegS4ApXKbFsmCX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119450053-3073099215-1938054741-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1176	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QtGraphicalEffects\private\DropShadowBase.qmlc
1⤵
- Modifies registry class
PID:4780

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact