Overview
overview
7Static
static
36ddbb67562...18.exe
windows7-x64
76ddbb67562...18.exe
windows10-2004-x64
7$1/QipInst...ff.exe
windows7-x64
1$1/QipInst...ff.exe
windows10-2004-x64
1$3/$APPDAT...er.exe
windows7-x64
7$3/$APPDAT...er.exe
windows10-2004-x64
7$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$3/QIPApp.exe
windows7-x64
1$3/QIPApp.exe
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$R1/Plugin...ng.dll
windows7-x64
1$R1/Plugin...ng.dll
windows10-2004-x64
1$R1/qip 8.0.exe
windows7-x64
1$R1/qip 8.0.exe
windows10-2004-x64
1$R1/unins000.exe
windows7-x64
7$R1/unins000.exe
windows10-2004-x64
7Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
6ddbb6756221ab1efdc28350d2dff2aa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6ddbb6756221ab1efdc28350d2dff2aa_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$1/QipInstallerStuff.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$1/QipInstallerStuff.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$3/$APPDATA/QIPApp/uninstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$3/$APPDATA/QIPApp/uninstaller.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$3/QIPApp.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$3/QIPApp.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$R1/Plugins/docking.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
$R1/Plugins/docking.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
$R1/qip 8.0.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$R1/qip 8.0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$R1/unins000.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$R1/unins000.exe
Resource
win10v2004-20240508-en
General
-
Target
$R1/qip 8.0.exe
-
Size
3.2MB
-
MD5
e0fb51ae556cb2c8d88a326705b2b602
-
SHA1
30031d0ea12cf5aa34f2222fdc4be3a3a6205b7b
-
SHA256
66a20bffe2e1e2fcbfddc8ee3a90418da636b833cbb7a075c743a18d54914437
-
SHA512
59a9488ce451351c9ac407f67364b07a8992b4b9e9e6a97f1dcd4f0933d1693ad574fcb56192b4776c92de021c1d0dfd83e9d5c969eb1d6208a2b0ad4ea7a346
-
SSDEEP
49152:KjjfdlGBAJIAAw0HAcQzTndgmZ1NGBbBIKgmAvlhhciTnLHwf2foam+:KPffGCJIAAPHAcQfRZ1NGRIhhgft+
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 752 qip 8.0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 752 qip 8.0.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 752 qip 8.0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 752 qip 8.0.exe 752 qip 8.0.exe