Overview

overview

7

Static

static

7

IPQQ2006.exe

windows7-x64

7

IPQQ2006.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$SYSDIR/msvcp60.dll

windows7-x64

3

$SYSDIR/msvcp60.dll

windows10-2004-x64

3

3DShow/boy.html

windows7-x64

1

3DShow/boy.html

windows10-2004-x64

1

3DShow/girl.html

windows7-x64

1

3DShow/girl.html

windows10-2004-x64

1

3DShow/index.html

windows7-x64

1

3DShow/index.html

windows10-2004-x64

1

3DShow/ind...ace.js

windows7-x64

1

3DShow/ind...ace.js

windows10-2004-x64

1

3DShow/ind...ace.js

windows7-x64

1

3DShow/ind...ace.js

windows10-2004-x64

1

3DShow/ind...ent.js

windows7-x64

1

3DShow/ind...ent.js

windows10-2004-x64

1

ACodec.dll

windows7-x64

1

ACodec.dll

windows10-2004-x64

1

AddrImportHelper.dll

windows7-x64

1

AddrImportHelper.dll

windows10-2004-x64

1

AudioDevice.dll

windows7-x64

1

AudioDevice.dll

windows10-2004-x64

1

BDLiveUpdate.exe

windows7-x64

1

BDLiveUpdate.exe

windows10-2004-x64

1

BEdit.dll

windows7-x64

3

BEdit.dll

windows10-2004-x64

3

BMate.exe

windows7-x64

1

BMate.exe

windows10-2004-x64

1

BQQApplication.dll

windows7-x64

1

BQQApplication.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcaa7f3742d724387bff42b9b40ccc1d_JaffaCakes118

  • Size

    17.5MB

  • Sample

    240420-nkqxnsfd82

  • MD5

    fcaa7f3742d724387bff42b9b40ccc1d

  • SHA1

    1aa7fc622d5f931a58b05892f4d807592cee389b

  • SHA256

    9b1becaae353cfed426aac596fdaee9a343dffbdae42e3be55f245cd16be4b6a

  • SHA512

    11107b5db83404a492f09097e23c7bcc5a7387f5aa46ed76e05d44dfdf9f97c7366968f1af07cf3bc370b52a1022b9ed8c1f9cd823e1145e63529af6fe64efdb

  • SSDEEP

    393216:DdPqcUSEktb94J5T5SunyS8F3xvsBBLojzJ+hCxz+JryL7Z/MZ2y:Dkctd7sF5SMnu3Jc9IzJ+hGymMZf

Score
7/10
aspackv2

Malware Config

Targets

    • Target

      IPQQ2006.exe

    • Size

      17.5MB

    • MD5

      a0ffb976b7ecc959414a6056925e3812

    • SHA1

      804fdff524097ae52fa81529e59a2264164707b4

    • SHA256

      53adc084ab2b8525296e23a499724c1163589d76ceacad295868a31d9ae91d5d

    • SHA512

      1489bb6b2894c58122374b73cf10bc3df45f1e96e65bd3cce21cc103c8d214efa05e0a9a288eee1203f1858075384577cbdd3f91819d7190b6e39a4b5f2eab5b

    • SSDEEP

      393216:IAkGP1+VOuZokVLUSVDYZp0QIe3wxDHONSW0NZ3nw3:I5aoVFGSVkgxDO2Zg3

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      12KB

    • MD5

      cce5450725a9429a1d3c7aa851d40e8d

    • SHA1

      05722500e42757ac03f2558452a064b906e31937

    • SHA256

      d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

    • SHA512

      3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

    • SSDEEP

      384:kKlm7i+c3QW6ckPhyDEaLnD2bbBBIXwZ:xqi8BcyhEhLKbbTI

    Score
    3/10
    behavioral3behavioral4

    • Target

      $SYSDIR/msvcp60.dll

    • Size

      404KB

    • MD5

      59a6413fb2cc89fd8651b1d2962fb8b9

    • SHA1

      7e118606f03a591897e014b7693d64e6a86fdbe0

    • SHA256

      fed76003f544525783796a22a07b190a8340874c11b5cf1999196c697d51e154

    • SHA512

      83e7ea9905214081793c2a241b776a29dab58ba6ce279ceb3851347004c4ae99cf33fb77f12c7d7474de32d417686f8ba5624a7bd7cec73f3dcab55adae307b5

    • SSDEEP

      6144:RL9LoZGObfGc6z8TEQGpX+3OoxHkCm1N8Reo:DLmBet4wTpX+3OoxHkCmceo

    Score
    3/10
    behavioral5behavioral6

    • Target

      3DShow/boy.html

    • Size

      1KB

    • MD5

      11a39b63a6a0ad92db7ed853ac90536e

    • SHA1

      802c7e24da9abb89670302ca759cb6cc44559af5

    • SHA256

      91dcd07d3536139da995bf23ba00aa42a2364a06ac373f9fb687940746599348

    • SHA512

      43015675793b2863510e346213e9580054767a23d002d9a1ccc7f6d0415f62ce466259dbee594056adba15a18b9795182b043f4694cc3833487cfd9e1c6a92e0

    Score
    1/10
    behavioral7behavioral8

    • Target

      3DShow/girl.html

    • Size

      1KB

    • MD5

      a673906fb323a110c7fd5651b359bd97

    • SHA1

      d887d5a6839ff521e4e98a12b9e2db1d370b82fa

    • SHA256

      f868e50132f23aefecae410554c27d61509d9d74a21388b008e602d2476a427d

    • SHA512

      8481b0344de23d08dd27fa8f5c972f4daff4ca3d40cd05d345235791ba7c747dd6c56087023adef404370eb98ec025606b4cb4260a24e4fdf0bd434dbb5928e7

    Score
    1/10
    behavioral10behavioral9

    • Target

      3DShow/index.html

    • Size

      969B

    • MD5

      a34bee2135aba21907569ee43dfbaadb

    • SHA1

      49458a0ab63274c811135befecfea6db567bffb4

    • SHA256

      96264a0320a9871956304ab3dc7d1dc80b161d65f5893b981bf7660889d7be30

    • SHA512

      f2e2144d8b1035d613cd345c3992be45be1407e3bedcea9f3c876dd2bde1ad86365671cf344fbf8500de7d2672392e567e5d71a43b953592af8df0c30b09fa2f

    Score
    1/10
    behavioral11behavioral12

    • Target

      3DShow/index_resources/MTS3Interface.js

    • Size

      17KB

    • MD5

      4821dacb452c16b755f7a8444947a9c3

    • SHA1

      88331cdc9c3cd3388ab8c44a6a3fb083c08dca2f

    • SHA256

      a0bf2562fb16d1341112a98f776ac2c7deaebc0bcfe8a097c153f4f2caab0dec

    • SHA512

      84f0ba5f7c7d5e41d5aab11a10f32d2ba2d7a597224a97fe1e61b9ca1d487b9e5fd69d16be25f643031aa896172a05e5dcf56e57a87f97f4716690c913c23727

    • SSDEEP

      384:WomFEZJ5yQVMglv9pNz1CIYYhMtKbn3Y3JVLGQgf/Y4k:LQETlVBCXZXylk

    Score
    1/10
    behavioral13behavioral14

    • Target

      3DShow/index_resources/MTS3Interface.js.bak

    • Size

      17KB

    • MD5

      9f9a085e62db9e20cfaa67733179559c

    • SHA1

      11c77fc618391445eea229a0c217f99dd22173eb

    • SHA256

      086128f3d5d4d8351e287d0b0626ce92ab3b7d35d2eee6af0bedec6c9e640fb2

    • SHA512

      e1c1991ed23b8c7eb05c0fd7af58c23d299d90cd1d7f7c1343c94bc70fb48a6c9b28f1f2e947b01983dfccf81d5dbddf179f35a4bdd55b925895e2795cbb34d0

    • SSDEEP

      384:WomFEZJ5yQVMglv9pNz1CIYYhMtKbn3Y3JVLGQgf/Y4a:LQETlVBCXZXyla

    Score
    1/10
    behavioral15behavioral16

    • Target

      3DShow/index_resources/MTS3Interface_tencent.js

    • Size

      20KB

    • MD5

      7be3ecf1f6696a1ef6c9351398433780

    • SHA1

      1f37d0eace4974c22798ff75e7b99113ff08f789

    • SHA256

      e841982acca50037057703190c05ecf994e7f1bfeba39709cdd05550e09f0710

    • SHA512

      f79238f0288e5940a770543670d6e88dd142ef078459e63f4b83d2289dbd4375135d42e93c1fce89d5a1be2faac45c1913f553036ed0a0595c976188171b1321

    • SSDEEP

      384:bozFaOMLZvrheI2buQvWipHfE1/dUDq6uYZhMVQmC339J+GMT7SCIOeY47:8h0tgO/d7/Q7AtPg7

    Score
    1/10
    behavioral17behavioral18

    • Target

      ACodec.dll

    • Size

      196KB

    • MD5

      33f12e40ac02640c66f65843a98ed647

    • SHA1

      b7f115dd4cfb3efa87645f33cf418573781c4829

    • SHA256

      ccf3b8b6acf1a0a6a1fb6bb64d51dbbacd48711e4829f8ca6a9033eb358ff627

    • SHA512

      652dcc77f4e71376aea7de4260f30a11e7bf821bad4adb4ce5d850fc669ef33024409632c36a16a5645651c95c20650ade80bbb9637f10ca5fddc6aef7386f11

    • SSDEEP

      3072:teKONHZezSBVOnRD+XaDKfMOaDmcf7QXZrvy/9HmgqPuNks2JD2eLfa2ksFuDa9e:thz2XKiaD+XpqmgguNkN4QJk2u2F9u2

    Score
    1/10
    behavioral19behavioral20

    • Target

      AddrImportHelper.dll

    • Size

      40KB

    • MD5

      49dcc6a6ed57518d1a7dbf9505856948

    • SHA1

      4bff8e6a7d04b5a73537f0173d6d73d880904c9e

    • SHA256

      aae69b62209d7a130ae2b7380330ac3d436c7051984caecd5af24b406b1fa528

    • SHA512

      47dced8d10e350eca5836492232006d85570bcf9aec213e7c093c7829702f1d67a6a30595fec4ad589ba1e3b6c544ce17d4577f0f570e2faf5e59770b3392db3

    • SSDEEP

      384:qm/mR3tJ6dfAFTDXZPD5wX1QXSjFenRLQhnCzZ7Qtc37dRxOzQk:5/mRKxApXr0OXSeRsCzZ7737dRxOM

    Score
    1/10
    behavioral21behavioral22

    • Target

      AudioDevice.dll

    • Size

      32KB

    • MD5

      f3e7ab1a7f63e2252f2a5b2f4cae530b

    • SHA1

      e8fcc1d8e458b031c63e4be8d0a71fc0442c65a4

    • SHA256

      5ec4a2ad48a06ae86d2020324a4b0d22d7317c26543e30b08fb33b253c5dad31

    • SHA512

      c10507c7aa2e72dfbd585a983623627a9240bbf1fa63ba7fca9f8068e848a2b610bd1e2570d78d99dab270f481efc774465a25df782ec5ec790733dd7fc3c538

    • SSDEEP

      384:H0IFEUAnuspBauANAtGZDkOZ/SHmcCQh:HVAnXpZ2At6DkRmF8

    Score
    1/10
    behavioral23behavioral24

    • Target

      BDLiveUpdate.exe

    • Size

      72KB

    • MD5

      997241f89e88dd91f8f67289667e8c9b

    • SHA1

      b349809aed8d024982bcaff9ab15b419fadc6c25

    • SHA256

      0f4a2aff27916de255e97f547805dce73b4b8c15462804987834f6b4536bc589

    • SHA512

      7bb16a36597b90b68338ef83705b5b0fbb0704ef87fc2b41273cfc16fc70e5e454c95577c3016dff0f30f60f2993588eeef3406499a4e5146334632c8d1825a6

    • SSDEEP

      768:Sj/I7nS18RejESfsmIyrcC0D7nnCm1CBbZ/EB/elwwOMrJePp1DrRyQWnsoymYmt:c4S1VQSLInF0cxwpMvDU7ssIw

    Score
    1/10
    behavioral25behavioral26

    • Target

      BEdit.dll

    • Size

      248KB

    • MD5

      d4510cf3b581e6fd301317d52dfd13e6

    • SHA1

      1700bc35d3817b15cba01f86731fe4f3c97346b7

    • SHA256

      97331f4efe5e888b492a89f382cd283bea70b87af491ac49b64a91205886dd21

    • SHA512

      151aceb75da676f0e7d8a0c9fbeb3e9b1ffea2769d93be71047d7327ef74f379aad6db2d76266106199fb4e1fd553941b16152f4dd8707d5f098842ef758ea2e

    • SSDEEP

      3072:1G3lXaQbgIaxAWY3qyD0h1xf87P5Wh1Cl1/N3i0iPgDKMLE66zUuGY6pf60256Y8:43sV7szPWbCjlSZgfQ682/25O

    Score
    3/10
    behavioral27behavioral28

    • Target

      BMate.exe

    • Size

      148KB

    • MD5

      7cf1dea821a2fe6294196b03ed530d6d

    • SHA1

      293bddd5cc592a6b05000d18cfd7be6d237600ae

    • SHA256

      be8044e5c956a654425c783154afeeaa8b6f2c0bb9dbaad2ebdcdc6271806cca

    • SHA512

      99899519367ac53d146001a5d9539ab1370879d64b1e5cae279bac9d76bbb90f19c07f50a58c2591fe863e0188cec254749782052e2c47505bc2ab9d341825bf

    • SSDEEP

      1536:dGE3PCia6ut+ix6zuCdkPf6LrcbWiH+wMv3EQv+6zxGjTExUsJZcqoK4VrHhBb2B:dD3PllcPf0Abkwi7OCoK4hHP2U/O1d

    Score
    1/10
    behavioral29behavioral30

    • Target

      BQQApplication.dll

    • Size

      112KB

    • MD5

      8fae27c85de02113f625e09594f416ba

    • SHA1

      2846a9ce6d37ae6ec2dfbf7e7dbe5deb2de7c42f

    • SHA256

      41614db30eaf779a8e4649f06a839a3114b13afe77c02e1937b0b913a2f05d9f

    • SHA512

      9d3594e0dbe062660a72cb4a168d2e1a78895ad488ea1c04dfb7c89c1e02d71e5dd3405a479c2f2568ffe400fe13a3137d141d1a4ddd3a5bf4926afc0f6af08f

    • SSDEEP

      1536:4fdGExRBPcFhbbhn3xq5vpeJkMb74Gfx0Oh9PDc4lh6pFCH9nnc:hORZubmKum74Gf51Dc4lh6pu+

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks