4d4b0060ff09ac7d0da455adae4e0ffaab4f0066c3fcf0da28f3630a2d543629

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:09

Target

qqjiahaoyou-v2.2/CrackCaptchaAPI.dll
Size

1.3MB
MD5

9a4965011a94705227f62df0776f2ab6
SHA1

fe91972e1c993731cdacc7429c4f4760672adcf7
SHA256

a9ea79e9c5017616ca9085351ef166f35882ad5a201b92c4839ffdf1169e4113
SHA512

e74bc303d99a2151dd00b8f4da0aabd70b37fe46a74702034a5a0ab3da7cad9ad0b7d69b960a10d0876ad5b660e1b868c8956e8d05321f7120f480baee34378a
SSDEEP

24576:ll7VKWLgjBTGxuQi0aqj45fnNVWhb0yX6i2JHoBTURfymDdTELFI:lwmX4N2hbYiPTUQmJTa

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4516 4652 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	pid_target	process	target process
4516	4652	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 4652	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 4652	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 4652	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\CrackCaptchaAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\CrackCaptchaAPI.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 644
3⤵
- Program crash
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4652 -ip 4652
1⤵
PID:1412

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact