bc87c85e306f1da4f9d76d95628f7de1c85ed04d5fdf8b0b9c13793df4bd1b28

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 12:32

Target

Source/Qt/labs/platform/plugins.qmltypes
Size

18KB
MD5

38d76c26aea10e5ba057c754ee620281
SHA1

ea7c89f86435e8605b33adaa68cdec9844716a00
SHA256

48a48c9038c388a6e68e63e44d56ba509f7f61023a5d63bb06dda332febb07a1
SHA512

4956aaff9141be561429258793f6e00fc58f3b8da3ac6ecd1a3e1c63dcaf2f978aa55e2c03731fac79384d6b3eac71f52ea4ac50a0b2e5f9c9dcc901730a5a29
SSDEEP

192:ooCFNyU7vyUA6lyUtifPMlViJ2kyGLHLlwyL2vb/WryiuPy6UX87XvKXlR8Sx34t:ooW1HSD2/MSi0VFR2M2Q2XrRKRt2M

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Source\Qt\labs\platform\plugins.qmltypes
1⤵
- Modifies registry class
PID:3288

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact