4d4b0060ff09ac7d0da455adae4e0ffaab4f0066c3fcf0da28f3630a2d543629

General

Target

qqjiahaoyou-v2.2/嗨星QQ批量加好友工具2.2.exe
Size

3.6MB
MD5

01a797fb3950fc40b793a2a930961b69
SHA1

e4a7a06b513e61baf2a3dbf7c1fff3946c6663cc
SHA256

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8
SHA512

60bec9c1fac173a161e4b84b0f151adbe76e14f6cad45268676f4bf2f8149e5475aeef244ed9ad312aa7ba15ac007cbb79a7fd4a18c912980cc8ec472a6a30ec
SSDEEP

49152:hDjeP+ApznKhqavgYjXOUzIeZwmX4N2hbYiPTUQmJTaId+s8KuqGaX0ToIBAUZL8:9jeP+ApznWI4XOiIGX4NuEmNJBAUZLO7

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral5/memory/1272-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral5/memory/1272-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

嗨星QQ批量加好友工具2.2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 嗨星QQ批量加好友工具2.2.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	嗨星QQ批量加好友工具2.2.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.12345ee.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com\Total = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000e99798aa4e5a8cdff8ed6a79f1c34b5f671ba9be1bfa3257d0a8909bd0723fd2000000000e80000000020000200000007acb220b0785e497f216e1aaa2eadf08b8fd035e177576281c7a9321c239b11e20000000192dfb783f05db0d9a9a3cba7f6795ddab62afe356767c4c94f03b9271bf6d1e400000007b05dd96ff902b43c6703a91e844dbb4e04629dcc500807d0128da95f92f902b5ee13eac148202399ca46c267941123aa63ac920f614087f7eb653d48dc6137c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02952017a01d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376220085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.12345ee.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\12345ee.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{221166B1-6D6D-11ED-9607-CED6325FB9F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000031c4fad0c7a7c850f77acf3c14938c1a9e15ad42a9c4c95538c437d7ac885d1b000000000e80000000020000200000008b3bb0f8049726352d07a5f953f33d8f9cdc83388d30c389eb25876958e76e1290000000b5668f88d634c2f5e0c73e22231c10cf1a200dddca03a8483fdaa67432285cef1aeece118c070e5696897037723e6d908057fbe2ca57f67d14eef8ff905374bc77a68656b72562447091d54887f798af6e8f4ba9ee3da9e444e3a1d2e282293eaab46b9d3ae9c5cba8a5cb32fc41f4b35562273cc5d7f167f0f2dd9218fd9a8910f449f735b2128a04df277a659afb3140000000c9913d584b78b7f170852d213017cd822773f3c7bc5bc961f46d39e0d17790c06482b1619d95faa46ade5ffcccf549798db663229d596ed8ef86e376b8ab2675	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1788 iexplore.exe

pid	process
1788	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

嗨星QQ批量加好友工具2.2.exeiexplore.exeIEXPLORE.EXE

pid	process
1272	嗨星QQ批量加好友工具2.2.exe
1272	嗨星QQ批量加好友工具2.2.exe
1272	嗨星QQ批量加好友工具2.2.exe
1272	嗨星QQ批量加好友工具2.2.exe
1272	嗨星QQ批量加好友工具2.2.exe
1788	iexplore.exe
1788	iexplore.exe
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

嗨星QQ批量加好友工具2.2.exeiexplore.exe

description	pid	process	target process
PID 1272 wrote to memory of 1788	1272	嗨星QQ批量加好友工具2.2.exe	iexplore.exe
PID 1272 wrote to memory of 1788	1272	嗨星QQ批量加好友工具2.2.exe	iexplore.exe
PID 1272 wrote to memory of 1788	1272	嗨星QQ批量加好友工具2.2.exe	iexplore.exe
PID 1272 wrote to memory of 1788	1272	嗨星QQ批量加好友工具2.2.exe	iexplore.exe
PID 1788 wrote to memory of 692	1788	iexplore.exe	IEXPLORE.EXE
PID 1788 wrote to memory of 692	1788	iexplore.exe	IEXPLORE.EXE
PID 1788 wrote to memory of 692	1788	iexplore.exe	IEXPLORE.EXE
PID 1788 wrote to memory of 692	1788	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\嗨星QQ批量加好友工具2.2.exe
"C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\嗨星QQ批量加好友工具2.2.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.12345ee.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8ebc6cc5225d1c5a798f28e5f4a08404

SHA1
dff95f38196dc96c5225f775ca034d645389ed89

SHA256
de6bf1473114d92f716c6b896fc763ec234f1a071f9d9a855dfe51c7eb8ff1b1

SHA512
ff2875ac08af51e18006b82bd02c4b13eeb3c65daa942db38ce6ae0b6c004645cf43d878c4ce0daa3273fa1c4fb77afe0c0aa165c1c98e0d9b700ea61b6b269f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
Filesize
9KB

MD5
243d83ff06212240ec27066c709367c4

SHA1
ab13b6e8f68ebf5d15b9be9af9d02b305507b0f9

SHA256
4dadd50890731dae9221fc6b861f61934cdeef1d9be20a1e4d34afc24644ed04

SHA512
8766c4971508e578786172e66d07165ccb990478423ec6f070d6982c21ea9d80e52b96cda35449420e69ce3c38477abffb2413b141f29ff6b73d3fe655048f8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BX9OIZRB.txt
Filesize
601B

MD5
cdf903045145f64da8d129c6a9ce0254

SHA1
43d8ed501d5be0e681150c4fdff8114b1615f715

SHA256
1a52c2c69c02ec503a510b9d4bc00cfd8e68c4afa2e5b5f7d569786171bfaadc

SHA512
5dace0dae9c27defa0ff1dcaeb027c8a46bf5d109c3d6e6d99a4e8fadfb2650d6346ed8ce8b756b2d97f32022497c00f286c20df72390f61f7b5a1def63af8ab

Download Submit
memory/1272-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1272-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1272-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads