e08c3626a1c31d7d41230206b82c57827140827dc766dfbeb5f14722bfe2c7c3

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hjqq_V3.6.1_crsky.exe
Size

3.4MB
MD5

84b2fc1a9b64cbf797dd779b2e623f52
SHA1

7745fbef89fd0a3c03479f4640a0ad658da24188
SHA256

df9fb4c8efa15ad3cbb11163451c8a13a14cb87d1912baeb64c84c205f524d21
SHA512

edd263821e3ffee9fc1d8d2c948fd42c53639a117825ea5d7c226cddf9f45828239f59830c18af4ef226cd5cfc7c3b2472b80bcf67927feff1261df7c72f5970
SSDEEP

49152:fcGtLN+9lrGyzMuViLDrDbLoIdzTJ+p8sqjdCP3qMowzhtkzemReRx1nJKTwtJW:fcGX+l1RVErDbLoK/JjTjd63U6oD+TrW

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1712	Hjqq_V3.6.1_crsky.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	Hjqq_V3.6.1_crsky.exe

C:\Users\Admin\AppData\Local\Temp\Hjqq_V3.6.1_crsky.exe
"C:\Users\Admin\AppData\Local\Temp\Hjqq_V3.6.1_crsky.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd19D8.tmp\ioSpecial.ini

Filesize
701B

MD5
1260c4ca41ecdd1f5a347b0c1603b071

SHA1
1364ae6e5dc107d5308417cc147a95a621159145

SHA256
fc09ff20fa1f9838b2753caf3e085d65b67a486f2570565f00b082310cb910a4

SHA512
175e5fc06620dfb2db292aca823925a756f429073e09a5abfd3dcbe69838e85b645fd4c3c75ac2a39053f089ed425198fcc08e9e50456f1ff6a7228e91f7a1f3

Download Submit
\Users\Admin\AppData\Local\Temp\nsd19D8.tmp\InstallOptions.dll

Filesize
14KB

MD5
32aa6334fc543e70ef0f792bb9a0c45a

SHA1
54be1f5004f7e5afe7c9ba160495076ea2a4d60c

SHA256
610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2

SHA512
ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae

Download Submit