051a80a2a82dd18faa9d0738c5403f3f0dbd0926e0525a445596cc6ef2d7d754

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_2_/QQVipDownloader.exe
Size

1023KB
MD5

65dbfaf76be7baf0369e1a202f8499cc
SHA1

542dca77ea0f20b91b8ebac80e326686dd507c55
SHA256

e997d69e9649210f79167f2a8501196ac2a62a23944b5d0d39b1e9bd7e3b774f
SHA512

0880bc2a3182708e3ac620f4028a85eb1683bda96f0246ea5751c9ad20c3ea2c1e9879751b4f57fea0ee16b41347a93be88ef0f87661583971204179b917b608
SSDEEP

12288:pDfAIZBLC7KNkg2BirPUTYLzD3zk2U5LZE+KGngCRyEi1QOCXSSY9p8s96+9AUys:pDfAIZBZkg2B4UsKKLEiGi9X0cAUSK6

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

2652 netsh.exe
2640 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

tencentdl.exetencentdl.exe

pid process

2500 tencentdl.exe
2416 tencentdl.exe

pid	process
2652	netsh.exe
2640	netsh.exe

pid	process
2500	tencentdl.exe
2416	tencentdl.exe

Loads dropped DLL 18 IoCs

Processes:

tencentdl.exeregsvr32.exetencentdl.exetencentdl.exeQQVipDownloader.exe

pid	process
2228	tencentdl.exe
2724	regsvr32.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2500	tencentdl.exe
2416	tencentdl.exe
2416	tencentdl.exe
2416	tencentdl.exe
2416	tencentdl.exe
1612	QQVipDownloader.exe
1612	QQVipDownloader.exe
1612	QQVipDownloader.exe
2416	tencentdl.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

tencentdl.exetencentdl.exeQQVipDownloader.exetencentdl.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	tencentdl.exe
File opened for modification	\??\PhysicalDrive0	tencentdl.exe
File opened for modification	\??\PhysicalDrive0	QQVipDownloader.exe
File opened for modification	\??\PhysicalDrive0	tencentdl.exe

Drops file in Program Files directory 9 IoCs

Processes:

tencentdl.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\dlcore.dll	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\Tencentdl.exe	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\DownloadProxyPS.dll	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\tinyxml.dll	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\bugreport_xf.exe	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\InstallInfo.xml	tencentdl.exe
File opened for modification	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\dlcore.dll	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\tnproxy.dll	tencentdl.exe
File created	C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\extract.dll	tencentdl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

tencentdl.exeregsvr32.exeQQVipDownloader.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloadProxy.Downloader\CLSID	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ = "IDownloader"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloadProxy.Downloader\CurVer	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\VersionIndependentProgID	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib\Version = "1.0"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}\ = "IDownloader_2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib\ = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ = "IDownloader"	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E49847-9822-4139-BC55-7173ED1ADA11}\InProcServer32\ = "C:\\program files (x86)\\common files\\tencent\\qqdownload\\127\\DownloadProxyPS.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid32\ = "{B9E49847-9822-4139-BC55-7173ED1ADA11}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DownloadProxy.EXE\AppID = "{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloadProxy.Downloader.1	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\LocalServer32\ = "\"C:\\program files (x86)\\common files\\tencent\\qqdownload\\127\\tencentdl.exe\""	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\ = "DownloadProxy 1.0 Type Library"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloadProxy.Downloader.1\ = "Downloader Class"	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\ProgID\ = "DownloadProxy.Downloader.1"	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib\ = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\AppID = "{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\TypeLib	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{28D341BF-13DD-457E-BAFB-D3FC0C442CA4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}\ = "DownloadProxy"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\ProgID	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib\Version = "1.0"	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib\Version = "1.0"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\Programmable	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DownloadProxy.EXE	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib\ = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid32	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\VersionIndependentProgID\ = "DownloadProxy.Downloader"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{28D341BF-13DD-457E-BAFB-D3FC0C442CA4}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E49847-9822-4139-BC55-7173ED1ADA11}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}\ = "IDownloader_3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	QQVipDownloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloadProxy.Downloader\ = "Downloader Class"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\0\win32	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\ = "_IDownloaderEvents"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\LocalServer32	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70DE12EA-79F4-46bc-9812-86DB50A2FD64}\TypeLib\ = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E49847-9822-4139-BC55-7173ED1ADA11}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\ = "IDownloader"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{28D341BF-13DD-457E-BAFB-D3FC0C442CA4}\ = "IDownloader_4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\FLAGS	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\TypeLib	tencentdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	QQVipDownloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}\ProxyStubClsid32	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\1.0\FLAGS\ = "0"	tencentdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11}\ProxyStubClsid32\ = "{B9E49847-9822-4139-BC55-7173ED1ADA11}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}\TypeLib\ = "{DA624F8F-98BF-4B03-AD11-A12D07119E81}"	tencentdl.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

QQVipDownloader.exetencentdl.exe

pid process

1612 QQVipDownloader.exe
1612 QQVipDownloader.exe
1612 QQVipDownloader.exe
2416 tencentdl.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

QQVipDownloader.exe

pid process

1612 QQVipDownloader.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

QQVipDownloader.exe

pid process

1612 QQVipDownloader.exe
1612 QQVipDownloader.exe

pid	process
1612	QQVipDownloader.exe
1612	QQVipDownloader.exe
1612	QQVipDownloader.exe
2416	tencentdl.exe

pid	process
1612	QQVipDownloader.exe

pid	process
1612	QQVipDownloader.exe
1612	QQVipDownloader.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

QQVipDownloader.exetencentdl.exetencentdl.exe

description	pid	process	target process
PID 1612 wrote to memory of 2228	1612	QQVipDownloader.exe	tencentdl.exe
PID 1612 wrote to memory of 2228	1612	QQVipDownloader.exe	tencentdl.exe
PID 1612 wrote to memory of 2228	1612	QQVipDownloader.exe	tencentdl.exe
PID 1612 wrote to memory of 2228	1612	QQVipDownloader.exe	tencentdl.exe
PID 2228 wrote to memory of 2500	2228	tencentdl.exe	tencentdl.exe
PID 2228 wrote to memory of 2500	2228	tencentdl.exe	tencentdl.exe
PID 2228 wrote to memory of 2500	2228	tencentdl.exe	tencentdl.exe
PID 2228 wrote to memory of 2500	2228	tencentdl.exe	tencentdl.exe
PID 2500 wrote to memory of 2640	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2640	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2640	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2640	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2652	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2652	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2652	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2652	2500	tencentdl.exe	netsh.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe
PID 2500 wrote to memory of 2724	2500	tencentdl.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\$_2_\QQVipDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\$_2_\QQVipDownloader.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\appdata\local\temp\$_2_\tencentdl.exe
"C:\Users\Admin\appdata\local\temp\$_2_\tencentdl.exe" /install
2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2228

C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
"C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" /RegServer
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" action=allow
4⤵
- Modifies Windows Firewall
PID:2640

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件Crash上报" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" action=allow
4⤵
- Modifies Windows Firewall
PID:2652

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\program files (x86)\common files\tencent\qqdownload\127\DownloadProxyPS.dll"
4⤵
- Loads dropped DLL
- Modifies registry class
PID:2724

C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
"C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\InstallInfo.xml
Filesize
1KB

MD5
68deb2a7669c8a17da384ca980b360a9

SHA1
c0c46ffb5f5a21d384fb03ca5e6c44a4cf0307dc

SHA256
fb32f89eda8ab7303629f1c13fbe055b57e9fe2a9fde4694b1447ed081606e57

SHA512
d8e49fd250a7c721cc6a91af5df89446e9625f9228dea12ec303bc3d6bda3f2870aca58021c275c24bdcba9b2c91745f21bdf540df02f28c2db872c799239732

Download Submit
C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
Filesize
915KB

MD5
7e8dfc56349967d134ccdc9de4cd772f

SHA1
80f9636e5f2b7509d50e3e865b5c0d921348fff0

SHA256
fcaf44a74ec98e9780ddded45729dab1dc292c3a1bfed1c1a7ce56f1fed9b604

SHA512
b25fa86519cc23157f253ab816e8f8dfab54c5eddb72ec2092ece5b33767131f2ebdb4c791a2e28688c3bbbddc0db1e34d046f309592f95bf4665f5f12617010

Download Submit
\??\c:\program files (x86)\common files\tencent\qqdownload\127\dlcore.dll
Filesize
1.9MB

MD5
0ed92ed82d4d1b22fe231c177b45eac5

SHA1
d858a692e6c0a364137c4d0190816809b8c37f7f

SHA256
ad1425b8497cf8b5891adbd51371c3ceb0f977e6e417b6c3f3262e6b6f01e2fc

SHA512
8d7d60e84314ba2b5b1a9248e6ddf1f2723844ebde1953343ee5f825f1d3e30a5a9a504d028c9311f9aa82c17929c4927769b7ae6df986003b2c1aaef0be3aa1

Download Submit
\Program Files (x86)\Common Files\Tencent\QQDownload\127\DownloadProxyPS.dll
Filesize
67KB

MD5
9c629978377e3edc8d0b001115f93eec

SHA1
c563aad2e04b0e69b3ceeb722f7f7e85dd3cb410

SHA256
1ce25ffc0d8671f5c44573ec190533860cc3bec823d2dcfaf4548a0bd76add50

SHA512
34cb1eafd31385094bc0f2f03da80fb94662a7a966dff7f9be974b5e850e2c588e82546edfaf244b7f20046fd63421495b7a429d50184d074b83208d86dcd619

Download Submit
\Program Files (x86)\Common Files\Tencent\QQDownload\127\extract.dll
Filesize
358KB

MD5
9da51d4506bd094fbfc7d337338fc872

SHA1
1b5799ef6b66ac9471842f17570813e7c42cdb27

SHA256
f2181e41d5950fcb762edf6b9cbb665e94004a7f1102b606c331690e6069a501

SHA512
07dfae7c04ea2815ed78af9e29313050338bfec5a8e08a8846c0f846d6d27b79b7bfe2c3b4dbf3758aa22f88342aadf5513dcbcd6a718b9dd939996d6ce9e044

Download Submit
\Program Files (x86)\Common Files\Tencent\QQDownload\127\tnproxy.dll
Filesize
707KB

MD5
3bad47f1e11387358ba090fbc2682713

SHA1
e7e7843d3fd4f45fdb65ff40936bc28a10651589

SHA256
26c906e83d280f03e021a5730908cc40551f8ef98e048b9ae001354ec83ae736

SHA512
c00f7079746cc0ab961680ca784cac036ad60c2883e032fea9d8ac4791579f5cb952a341efb0068a38f81ab84c6dc870ddd8ae5ddb66d17a812a80fc8e1486eb

Download Submit
memory/1612-37-0x0000000006EB0000-0x0000000006EC0000-memory.dmp

Filesize
64KB

Download
memory/2416-35-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/2416-30-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2416-41-0x0000000004EA0000-0x0000000004F4F000-memory.dmp

Filesize
700KB

Download
memory/2416-43-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download