Overview
overview
8Static
static
qqjiahaoyo...PI.dll
windows7-x64
6qqjiahaoyo...PI.dll
windows10-2004-x64
6qqjiahaoyo...��.url
windows7-x64
1qqjiahaoyo...��.url
windows10-2004-x64
1qqjiahaoyo....2.exe
windows7-x64
8qqjiahaoyo....2.exe
windows10-2004-x64
8qqjiahaoyo...��.url
windows7-x64
1qqjiahaoyo...��.url
windows10-2004-x64
1Analysis
-
max time kernel
206s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 22:09
Static task
static1
Behavioral task
behavioral1
Sample
qqjiahaoyou-v2.2/CrackCaptchaAPI.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
qqjiahaoyou-v2.2/CrackCaptchaAPI.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
qqjiahaoyou-v2.2/去脚本之家看看.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
qqjiahaoyou-v2.2/去脚本之家看看.url
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
qqjiahaoyou-v2.2/嗨星QQ批量加好友工具2.2.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
qqjiahaoyou-v2.2/嗨星QQ批量加好友工具2.2.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
qqjiahaoyou-v2.2/服务器软件.url
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
qqjiahaoyou-v2.2/服务器软件.url
Resource
win10v2004-20221111-en
General
-
Target
qqjiahaoyou-v2.2/嗨星QQ批量加好友工具2.2.exe
-
Size
3.6MB
-
MD5
01a797fb3950fc40b793a2a930961b69
-
SHA1
e4a7a06b513e61baf2a3dbf7c1fff3946c6663cc
-
SHA256
82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8
-
SHA512
60bec9c1fac173a161e4b84b0f151adbe76e14f6cad45268676f4bf2f8149e5475aeef244ed9ad312aa7ba15ac007cbb79a7fd4a18c912980cc8ec472a6a30ec
-
SSDEEP
49152:hDjeP+ApznKhqavgYjXOUzIeZwmX4N2hbYiPTUQmJTaId+s8KuqGaX0ToIBAUZL8:9jeP+ApznWI4XOiIGX4NuEmNJBAUZLO7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral6/memory/4604-132-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-138-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-140-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-142-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-144-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-146-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-148-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-150-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-152-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-154-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-156-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-158-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-160-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-162-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-164-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-166-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-168-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-170-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-172-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-174-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral6/memory/4604-175-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
嗨星QQ批量加好友工具2.2.exedescription ioc process File opened for modification \??\PhysicalDrive0 嗨星QQ批量加好友工具2.2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msedge.exepid process 4360 msedge.exe 4360 msedge.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
嗨星QQ批量加好友工具2.2.exepid process 4604 嗨星QQ批量加好友工具2.2.exe 4604 嗨星QQ批量加好友工具2.2.exe 4604 嗨星QQ批量加好友工具2.2.exe 4604 嗨星QQ批量加好友工具2.2.exe 4604 嗨星QQ批量加好友工具2.2.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
嗨星QQ批量加好友工具2.2.exemsedge.exedescription pid process target process PID 4604 wrote to memory of 2600 4604 嗨星QQ批量加好友工具2.2.exe msedge.exe PID 4604 wrote to memory of 2600 4604 嗨星QQ批量加好友工具2.2.exe msedge.exe PID 2600 wrote to memory of 4824 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4824 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4912 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4360 2600 msedge.exe msedge.exe PID 2600 wrote to memory of 4360 2600 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\嗨星QQ批量加好友工具2.2.exe"C:\Users\Admin\AppData\Local\Temp\qqjiahaoyou-v2.2\嗨星QQ批量加好友工具2.2.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.12345ee.com/2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc58e646f8,0x7ffc58e64708,0x7ffc58e647183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2612,16587122583247800812,2758893616194616356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2612,16587122583247800812,2758893616194616356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2784 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\LOCAL\crashpad_2600_VLNSNFEFQQYGXKDUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2600-176-0x0000000000000000-mapping.dmp
-
memory/4360-180-0x0000000000000000-mapping.dmp
-
memory/4604-158-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-162-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-140-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-142-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-144-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-146-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-148-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-150-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-152-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-154-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-156-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-132-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-160-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-138-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-164-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-166-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-168-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-170-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-172-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-174-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-175-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-133-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4604-134-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4824-177-0x0000000000000000-mapping.dmp
-
memory/4912-179-0x0000000000000000-mapping.dmp