Overview

overview

8

Static

static

3

2182d64d0b...18.exe

windows7-x64

8

2182d64d0b...18.exe

windows10-2004-x64

8

$_2_/Ad.exe

windows7-x64

1

$_2_/Ad.exe

windows10-2004-x64

1

$_2_/Downl...PS.dll

windows7-x64

1

$_2_/Downl...PS.dll

windows10-2004-x64

1

$_2_/QQVip...er.exe

windows7-x64

8

$_2_/QQVip...er.exe

windows10-2004-x64

8

$_2_/TXSSOSetup.exe

windows7-x64

7

$_2_/TXSSOSetup.exe

windows10-2004-x64

7

$_2_/Tencentdl.exe

windows7-x64

1

$_2_/Tencentdl.exe

windows10-2004-x64

1

$_2_/bugreport.exe

windows7-x64

1

$_2_/bugreport.exe

windows10-2004-x64

$_2_/curllib.dll

windows7-x64

3

$_2_/curllib.dll

windows10-2004-x64

3

$_2_/dlcore.dll

windows7-x64

1

$_2_/dlcore.dll

windows10-2004-x64

1

$_2_/extract.dll

windows7-x64

1

$_2_/extract.dll

windows10-2004-x64

1

$_2_/tinyxml.dll

windows7-x64

3

$_2_/tinyxml.dll

windows10-2004-x64

3

$_2_/tnproxy.dll

windows7-x64

1

$_2_/tnproxy.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 20:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2182d64d0b3489d4e4313035391d4775_JaffaCakes118.exe
  • Size 3.6MB
  • Sample240507-yrfqdsfg63
  • SHA256 045004ce594115c91ee0c8b949c1192794291e234f64df034101f99784b651f8
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitevasionpersistence

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2182d64d0b3489d4e4313035391d4775_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2182d64d0b3489d4e4313035391d4775_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\TXSSOSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\TXSSOSetup.exe" -DIR="C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Users\Admin\AppData\Local\Temp\TXSSO\InstTXSSO.exe
        "C:\Users\Admin\AppData\Local\Temp\TXSSO\InstTXSSO.exe" "C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO" "C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:688
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.94\Bin\\SSOCommon.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3564
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.94\Bin\\npSSOAxCtrlForPTLogin.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3220
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.94\Bin\\SSOLUIControl.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:772
    • C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\Tencentdl.exe
      "C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\Tencentdl.exe" /Install
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
        "C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" /RegServer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" action=allow
          4⤵
          • Modifies Windows Firewall
          PID:1760
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件Crash上报" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" action=allow
          4⤵
          • Modifies Windows Firewall
          PID:2188
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\program files (x86)\common files\tencent\qqdownload\127\DownloadProxyPS.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1808
    • C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\QQVipDownloader.exe
      "C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\QQVipDownloader.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5036
  • C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
    "C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of FindShellTrayWindow
    PID:3568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InstallInfo.xml
        • Path C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\InstallInfo.xml
        • Size 1KB
        • SHA256 642a5cc2120549c4cb138834a687a8d96a03f6a883583c05904b4b9425bf54f5
        • MD5 SHA1 SHA512
        Submit Download

        Tencentdl.exe
        • Path C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\Tencentdl.exe
        • Size 915KB
        • SHA256 fcaf44a74ec98e9780ddded45729dab1dc292c3a1bfed1c1a7ce56f1fed9b604
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        QQVipDownloader.exe
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\QQVipDownloader.exe
        • Size 1023KB
        • SHA256 e997d69e9649210f79167f2a8501196ac2a62a23944b5d0d39b1e9bd7e3b774f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bk.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\bk.png
        • Size 161KB
        • SHA256 46d7f3ddfa293d729025206fad8921a09662adecc1c21e33e240d4d722ccaab5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_pause_task.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_pause_task.png
        • Size 9KB
        • SHA256 784e9ca146c9d562005b2642f208fb60f298965c2d0385609eb7188296205674
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_resume_task.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_resume_task.png
        • Size 10KB
        • SHA256 6f5f444ab68c09046b88ea7f79108e7fc7b9b9100f549aefd4ef104a85cce9a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_retry_task.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_retry_task.png
        • Size 9KB
        • SHA256 7585972041acbe0e00dfb91f76d02ffbf3a6998e8439e1e78b45b901d13ec239
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_setup.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_setup.png
        • Size 15KB
        • SHA256 dec8719ea000ef4a5a04db43398be0aecd55b615e3a2c499553b5c8ed64a34bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_start_task.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_start_task.png
        • Size 14KB
        • SHA256 f4f38ab0bff198d04b815fa6f7c767c600ff04f6f15354a1e1bfa54f0e2c5de4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        btn_topspeed.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\btn_topspeed.png
        • Size 14KB
        • SHA256 e63984cf41dd5e6463d453be0c6e1777082f9f9002187535b50afa717d0fc2bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        close.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\close.png
        • Size 4KB
        • SHA256 307e527d1d1c0dc5b71184a6a35a6fe9cd6c9417032adc237ee813e79762bfb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        file_path_input.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\file_path_input.png
        • Size 4KB
        • SHA256 a174c337b30437ee798ab264a190960d388267728739f3d1bed04d24c3ffc6c6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icon_path.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\icon_path.png
        • Size 3KB
        • SHA256 6eeabb69a9bbb476320cba23c087814779d4cb9bf546474aab652978b08b8154
        • MD5 SHA1 SHA512
        Submit Download

        min.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\min.png
        • Size 3KB
        • SHA256 f664131f8414985afb7f643d0e0620fd159837ba97102522f9551d1ecc18f2dc
        • MD5 SHA1 SHA512
        Submit Download

        setting.png
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SKin\setting.png
        • Size 4KB
        • SHA256 34947745baeb6277146b49e1697906f748f57dc98f694f02868e6c770c85067b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SkinConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\SkinConfig.ini
        • Size 385B
        • SHA256 ff179b9e9b54c3787e56301039a5366478dbc78d9b35c3cba9d7e603e8fda728
        • MD5 SHA1 SHA512
        Submit Download

        TXSSOSetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\TXSSOSetup.exe
        • Size 1.2MB
        • SHA256 8aa5ad11255f7526bd924a14b2ad0f4511ec2abf9f80abc5d2ac3d147490088a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VerConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\VerConfig.ini
        • Size 2KB
        • SHA256 9537cb075ceffc761989f0b5c4d5ee0745853d15eb93db678cfbb42965a330cf
        • MD5 SHA1 SHA512
        Submit Download

        bugreport.exe
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\bugreport.exe
        • Size 274KB
        • SHA256 18a53e047d0536e49385177d00d526f252de98d5d04e58e057c7684f820788c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\config.ini
        • Size 829B
        • SHA256 d8beb2ea287478581b565e22754fbe4614477ef343a856a95a50017e09909c29
        • MD5 SHA1 SHA512
        Submit Download

        curllib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\curllib.dll
        • Size 228KB
        • SHA256 f79808272d03aa7a2e904438f97a63dee8d0d62fd4ed77709eb80ca3bdba6510
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vipdl.ico
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\skin\vipdl.ico
        • Size 33KB
        • SHA256 41b78db81a97aee638f799f8b2e15bb6ed0367485724bd28643a0581db058036
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tinyxml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\QQVipDownloader\dancer2_1416387682\tinyxml.dll
        • Size 99KB
        • SHA256 0460e9e03edf807453e66f0332c84a4f8ea8ace16e25b8c2e62abe12a6b7eebc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstTXSSO.exe
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\InstTXSSO.exe
        • Size 92KB
        • SHA256 45c3dfbb89ad4298beb4724776df711d4dccd03f1e636c5ed20fa602e246c7bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PGFStringBundle.xml
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\I18N\2052\PGFStringBundle.xml
        • Size 6KB
        • SHA256 673eb178dae8cf3addcbb5d82969ec47a3631ac59a20e6cc806938de5cc3beb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SSOStringBundle.xml
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\I18N\2052\SSOStringBundle.xml
        • Size 3KB
        • SHA256 58adbbb6f500699838a417c5d8fbd1ad80e44849dafce453f80bc75f5d90b614
        • MD5 SHA1 SHA512
        Submit Download

        SSOConfig.xml
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\I18N\SSOConfig.xml
        • Size 394B
        • SHA256 32f912e1eceb0000e04ddb3c627b00c4533e882cc34e3d8117bc9cafeb2faf8b
        • MD5 SHA1 SHA512
        Submit Download

        SSOCommon.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\bin\SSOCommon.dll
        • Size 1.5MB
        • SHA256 bbed821ef363e1dd69442417355d781391d1af6532d62d1f67c2c64de9121155
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SSOLUIControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\bin\SSOLUIControl.dll
        • Size 482KB
        • SHA256 5ee176db9b6317ad7dbd0adc2f6b1735ed2fd55b10084565e27f28f829fe09dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SSOPlatform.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\bin\SSOPlatform.dll
        • Size 1.3MB
        • SHA256 cff96f4fbfa0b7efc619a0c9ad39978873e24a8c9e737f6c64d57836d99bd182
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        npSSOAxCtrlForPTLogin.dll
        • Path C:\Users\Admin\AppData\Local\Temp\TXSSO\TXSSO\bin\npSSOAxCtrlForPTLogin.dll
        • Size 194KB
        • SHA256 9bdf42d867153622be14a65d7e56de0dde2f6e8c3ca693e0e50b65cd2756ef23
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsh4037.tmp\System.dll
        • Size 11KB
        • SHA256 29f4a1c87161643e0ed5c46b46786d9a48437ec5dc6b99f4ff14037429e6e20a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        regsvr32.tlg
        • Path C:\Users\Admin\AppData\Roaming\Tencent\Logs\regsvr32.tlg
        • Size 752B
        • SHA256 e39070158a079fdef029b9b61341772b9117a73ccc7e070301560038938ae383
        • MD5 SHA1 SHA512
        Submit Download

        setuplog.log
        • Path C:\Users\Admin\AppData\Roaming\Tencent\TXSSO\SetupLogs\setuplog.log
        • Size 904B
        • SHA256 5e2aae90662b6eb1758bfe5fa3eaa00a881057274f35170c04eba6f9f7807b19
        • MD5 SHA1 SHA512
        Submit Download

        dlcore.dll
        • Path \??\c:\users\admin\appdata\local\temp\qqvipdownloader\dancer2_1416387682\dlcore.dll
        • Size 1.9MB
        • SHA256 ad1425b8497cf8b5891adbd51371c3ceb0f977e6e417b6c3f3262e6b6f01e2fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        downloadproxyps.dll
        • Path \??\c:\users\admin\appdata\local\temp\qqvipdownloader\dancer2_1416387682\downloadproxyps.dll
        • Size 67KB
        • SHA256 1ce25ffc0d8671f5c44573ec190533860cc3bec823d2dcfaf4548a0bd76add50
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        extract.dll
        • Path \??\c:\users\admin\appdata\local\temp\qqvipdownloader\dancer2_1416387682\extract.dll
        • Size 358KB
        • SHA256 f2181e41d5950fcb762edf6b9cbb665e94004a7f1102b606c331690e6069a501
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tnproxy.dll
        • Path \??\c:\users\admin\appdata\local\temp\qqvipdownloader\dancer2_1416387682\tnproxy.dll
        • Size 707KB
        • SHA256 26c906e83d280f03e021a5730908cc40551f8ef98e048b9ae001354ec83ae736
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3568-227-0x0000000003E80000-0x0000000003E90000-memory.dmp
        Download

        memory/3568-229-0x0000000004D50000-0x0000000004DFF000-memory.dmp
        Download

        memory/5036-228-0x0000000008DD0000-0x0000000008DE0000-memory.dmp
        Download