Extracted

• • Target
    QproFaceTracking-0.1.10-poc.zip
  • Size 134.5MB
  • SHA256 db40f4b8331a50ca6c2ec37372f1ab4b44cfbe6d21e09ca04244aaaa339cb18f
  • MD5 0cd2522fc7b175cf6992d56e1c37b1f3
  • SHA1 20ac4a10644182e83c6c70cc8ba26fdc5d260a6a
  • SHA512 407a2be1a0d776ee97df61d9f185fd52309e22616055b14330da1d8ff64eaefd8948193013382bd8fd6403eab4c6099d00245cd4c4f4ade582adc7bea3f221b4
  • SSDEEP 3145728:mk+yEj81cu0rw6lMplLlleULjR/e/eXL6XylIoci8pFsq604ltUFZ6sk8D:mkw81/0EYMuULV/We76X3+8pFFCtUD6a
  • TLSH
    T1E16833BD96F2D3B46363897A86F8F6A5757278148D0782CF291177A060EE1CFAF34244
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    QproFaceTracking-0.1.10-poc/QproFaceTracking.exe
  • Size 110.8MB
  • SHA256 f7dfd11616fd9b468c89443f75d4fcf984009e8dd0bfe512fa4be784602cdab7
  • MD5 6f89761926a5da1a18e1a295e7f62daf
  • SHA1 df398d635f1e669d0f90e8fa996a39b4dda4cbd0
  • SHA512 40b507b39ae4cbabf32481bf645f7b96ab85447a3ebad4dc1e1d9c3a0ec7688de4a0949761094b131418fc035e0d4bd61286910c79395a25a6daca81da600e06
  • SSDEEP 786432:CGI5jxFd+U4DVOK33ZiSOH0q4DlpFcz7yK95a9X6KPu5NY5oPUkp:CrlFdX0Zi0ySK3a9X6KPubYKskp
  • TLSH
    T197487C1163E86E45E23B8278977386A1D675BC525311D2CF0084FD4A3F73BD2BA363A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryexecutionpersistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral2
• • Target
    QproFaceTracking-0.1.10-poc/platform-tools/source.properties
  • Size 38B
  • SHA256 2dccd788c0234d8cf7f7457377e57f57527a86a629c6ed54feb8af0f549dac38
  • MD5 4d7b3229204fc72b7fbef1069760975b
  • SHA1 68914d9d28ffae49ebfe443b8f1068d18e63e413
  • SHA512 ae5206e5fc2af0697f05e97476e785bc001d25bb945d57878999f5e80f819f5d6edac549e24d8dc869dd301a0456072f2d6dfcd5fe6054892554ec81153d6e37
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral3