Overview
overview
7Static
static
369b9435033...18.exe
windows7-x64
769b9435033...18.exe
windows10-2004-x64
7$1/QipInst...ff.exe
windows7-x64
1$1/QipInst...ff.exe
windows10-2004-x64
1$3/$APPDAT...er.exe
windows7-x64
7$3/$APPDAT...er.exe
windows10-2004-x64
7$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$3/QIPApp.exe
windows7-x64
1$3/QIPApp.exe
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$R1/Plugin...ng.dll
windows7-x64
1$R1/Plugin...ng.dll
windows10-2004-x64
1$R1/qip 8.0.exe
windows7-x64
1$R1/qip 8.0.exe
windows10-2004-x64
1$R1/unins000.exe
windows7-x64
7$R1/unins000.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 04:28
Static task
static1
Behavioral task
behavioral1
Sample
69b94350338b13014b0f6c4f51f70b6f_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
69b94350338b13014b0f6c4f51f70b6f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$1/QipInstallerStuff.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$1/QipInstallerStuff.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$3/$APPDATA/QIPApp/uninstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$3/$APPDATA/QIPApp/uninstaller.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$3/QIPApp.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$3/QIPApp.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$R1/Plugins/docking.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$R1/Plugins/docking.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$R1/qip 8.0.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$R1/qip 8.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$R1/unins000.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$R1/unins000.exe
Resource
win10v2004-20240508-en
General
-
Target
$R1/qip 8.0.exe
-
Size
3.2MB
-
MD5
e0fb51ae556cb2c8d88a326705b2b602
-
SHA1
30031d0ea12cf5aa34f2222fdc4be3a3a6205b7b
-
SHA256
66a20bffe2e1e2fcbfddc8ee3a90418da636b833cbb7a075c743a18d54914437
-
SHA512
59a9488ce451351c9ac407f67364b07a8992b4b9e9e6a97f1dcd4f0933d1693ad574fcb56192b4776c92de021c1d0dfd83e9d5c969eb1d6208a2b0ad4ea7a346
-
SSDEEP
49152:KjjfdlGBAJIAAw0HAcQzTndgmZ1NGBbBIKgmAvlhhciTnLHwf2foam+:KPffGCJIAAPHAcQfRZ1NGRIhhgft+
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
qip 8.0.exepid process 728 qip 8.0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
qip 8.0.exepid process 728 qip 8.0.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
qip 8.0.exepid process 728 qip 8.0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
qip 8.0.exepid process 728 qip 8.0.exe 728 qip 8.0.exe