Overview

overview

7

Static

static

7

IPQQ2006.exe

windows7-x64

7

IPQQ2006.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$SYSDIR/msvcp60.dll

windows7-x64

3

$SYSDIR/msvcp60.dll

windows10-2004-x64

3

3DShow/boy.html

windows7-x64

1

3DShow/boy.html

windows10-2004-x64

1

3DShow/girl.html

windows7-x64

1

3DShow/girl.html

windows10-2004-x64

1

3DShow/index.html

windows7-x64

1

3DShow/index.html

windows10-2004-x64

1

3DShow/ind...ace.js

windows7-x64

1

3DShow/ind...ace.js

windows10-2004-x64

1

3DShow/ind...ace.js

windows7-x64

1

3DShow/ind...ace.js

windows10-2004-x64

1

3DShow/ind...ent.js

windows7-x64

1

3DShow/ind...ent.js

windows10-2004-x64

1

ACodec.dll

windows7-x64

1

ACodec.dll

windows10-2004-x64

1

AddrImportHelper.dll

windows7-x64

1

AddrImportHelper.dll

windows10-2004-x64

1

AudioDevice.dll

windows7-x64

1

AudioDevice.dll

windows10-2004-x64

1

BDLiveUpdate.exe

windows7-x64

1

BDLiveUpdate.exe

windows10-2004-x64

1

BEdit.dll

windows7-x64

3

BEdit.dll

windows10-2004-x64

3

BMate.exe

windows7-x64

1

BMate.exe

windows10-2004-x64

1

BQQApplication.dll

windows7-x64

1

BQQApplication.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 11:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IPQQ2006.exe

  • Size

    17.5MB

  • MD5

    a0ffb976b7ecc959414a6056925e3812

  • SHA1

    804fdff524097ae52fa81529e59a2264164707b4

  • SHA256

    53adc084ab2b8525296e23a499724c1163589d76ceacad295868a31d9ae91d5d

  • SHA512

    1489bb6b2894c58122374b73cf10bc3df45f1e96e65bd3cce21cc103c8d214efa05e0a9a288eee1203f1858075384577cbdd3f91819d7190b6e39a4b5f2eab5b

  • SSDEEP

    393216:IAkGP1+VOuZokVLUSVDYZp0QIe3wxDHONSW0NZ3nw3:I5aoVFGSVkgxDO2Zg3

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe
    "C:\Users\Admin\AppData\Local\Temp\IPQQ2006.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst91F5.tmp\ioSpecial.ini
    Filesize

    635B

    MD5

    60847141b5bff7491e56af3fadc44d05

    SHA1

    71d9f31d88c698cf42997e4929c8bb3fda63ace8

    SHA256

    83a4d534aabdd3c4dd963e6255c2f98cd6e2b384c199c1de0a847256b5b2f36a

    SHA512

    5c04ad55bf0f156a35078c3657474ff4968a0feb148ad00c54c53c9576895c313d9a8b36e1659f7a51d99925609a56d59e24f84ee8e0b3fc0ca44dabef2204af

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nst91F5.tmp\ioSpecial.ini
    Filesize

    674B

    MD5

    5a992463384adb5083ff5efbeb95e9bc

    SHA1

    e8f235eac8245ec9402fdffb1d25e3cba6b91ab9

    SHA256

    4838aa71495110739350b28cdd21a80a80e4ebbf02f5ecc5cd009063c5d96153

    SHA512

    1f3572031b0f30f599f451c3e0a5ac0951906f994bd19650b66a552b499a97831c2539a691c2c0ce07c0522ddfd5fab1ea73198b1f3be7e1191407770008cd20

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nst91F5.tmp\InstallOptions.dll
    Filesize

    12KB

    MD5

    cce5450725a9429a1d3c7aa851d40e8d

    SHA1

    05722500e42757ac03f2558452a064b906e31937

    SHA256

    d850c786a68df9520a3ecf2a96f4f091c9bae71d3adbf7731e8c172533cb266d

    SHA512

    3ddb56429e097ecf942e8a5147ba4c4191c52b736df267934f0dca75ffa74faffee8911dda47c5d2542f91138abbcaf61be3e3d68b368631d6bc21e254b5c637

    Download Submit