cf7b7ab4b0e8c086a1ab1453a59c4f2fcffb4c172bc260b76cccb6620a1bfc85

Analysis

max time kernel
100s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/qqqf.exe
Size

1.8MB
MD5

49e6da97d4300e6de99f251d442ba59d
SHA1

c51dee669f143257ee99c79ee1fc5a07de2778fb
SHA256

268094ce81859231caf513484b4ca334a82bc637511fa6bcb7f3bf13ffc89cc5
SHA512

7a70e2388c369f585e1d3ba3955cba1a0dd1a1cfb12e9277600ca49ae2dd2d7e5d8a979788935cf3e69a87561079cc7b32217114f71de9b0f111ba78ea13202e
SSDEEP

24576:dJ0VE9yjrSTWQAsWl61pHRS3TvSuXrKMYxBuLvBeMIjxjumXplFSUul2MC4sLTxq:0NCW61p0WEKXdPjZFIwM1ITxKC9

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

qqqf.exe

description ioc process

File opened for modification \??\PhysicalDrive0 qqqf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

qqqf.exe

pid process

1280 qqqf.exe
1280 qqqf.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	qqqf.exe

pid	process
1280	qqqf.exe
1280	qqqf.exe

C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\qqqf.exe
"C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\qqqf.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1280-55-0x0000000000020000-0x000000000002F000-memory.dmp

Filesize
60KB

Download
memory/1280-56-0x00000000001B0000-0x00000000001CB000-memory.dmp

Filesize
108KB

Download