0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
Size 13.9MB
Sample240601-p5e7cade87
SHA256 0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf
MD5 8a8322becd5a1eee98a776a6aa573f03
SHA1 e6a29ed2cfa0f20753a6c59aaccf2e4c76eaca76
SHA512 e04a1b4f969a41c45e54f6fdf8118597ede0bc910dced595b5f2ddcdce957b3dd225f0c629e7e5e3b70d66eb4d0e550edeaf1cf0836837fe21bde8577435cdd3
SSDEEP 196608:kewkER6VbBiYl/yWDocWTz+3OugWW45TUUA57nADSuPPnWkxhEjpW7QBA/HNwSna:HwvuiSEVzuP25szPPh3EjplaiW+zUa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023424-90.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	QQPCDetector.exe

Loads dropped DLL 6 IoCs

pid	Process
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
4976	QQPCDetector.exe
4976	QQPCDetector.exe
4976	QQPCDetector.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023424-90.dat	upx
behavioral2/memory/4976-97-0x0000000003380000-0x000000000355A000-memory.dmp	upx
behavioral2/memory/4976-96-0x0000000003380000-0x000000000355A000-memory.dmp	upx
behavioral2/memory/4976-99-0x0000000003380000-0x000000000355A000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	QQPCDetector.exe
File opened for modification	\??\PhysicalDrive0	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	QQPCDetector.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	QQPCDetector.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 6aa55449fb62784f8160297245e2bd86	QQPCDetector.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
4976	QQPCDetector.exe
4976	QQPCDetector.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4976	3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe	85
PID 3328 wrote to memory of 4976	3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe	85
PID 3328 wrote to memory of 4976	3328	8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a8322becd5a1eee98a776a6aa573f03_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\QQPCDetector.exe
  "C:\Users\Admin\AppData\Local\Temp\QQPCDetector.exe" ##supplyid=60040;operator=1;
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QQPCDetector.exe

Path C:\Users\Admin\AppData\Local\Temp\QQPCDetector.exe
Size 1.0MB
SHA256 133f91e2862eaa771b3c9235ad96f14d8f1ccb087bb4e72d5e2ce000de2245fc
MD5 1e28fd208a93540fac22e94f64dc8c15
SHA1 63e7697bf0f3cc25e359ceaeeb63d40a4894f668
SHA512 1c3499a91b51760c41ad99d5aecf67653c4ae965b50196376ff36fc0892d1613594449fa5821e19bc3dbc474ab2d2424e0b0eaf30c2aae9bc090009737552820
SSDEEP 24576:mz8s9AlA9YVZqPurm8U2222222KZDibQCI6Vd2Qy68pCx2U5aaU:i9ApVSurm8oAbl8Qy1W22a
MD5 SHA1 SHA512 SSDEEP

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Temp\dr.dll
Size 73KB
SHA256 967bfd76354486919fd252a8bcb3d787af495a0a58bfb8a216b3776cdc2dfc43
MD5 4f53e6f3881ff3e1ee1cc0dc0561410f
SHA1 31388b4d64164eaa5b79ee30bf22840f6b5955a2
SHA512 a652d85e36143e45bafc105f7f385b1dfa25cc83d7bb1c2b167999ec95f4dd27fc43ea91e14abc26f78395a202159807dbfd85394b30061b64fea285aab64921
SSDEEP 768:NONzLXDPzdtxeI8R/ZrwkMHmLfbWX4ub6hgzyra6YIQNcPiLV7D0kFoiu3vAxpzk:89XDPJFp/bk3YISc6Lt0PieAxpza7Ck
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq3C7E.tmp\InstallHelper.dll
Size 320KB
SHA256 3507d6cd8472340f8a8d6cfae84370fa2b9a42114488720a4958d5a7fde0d1bf
MD5 4be1dc408cc08c562aa5d1dec0473d6a
SHA1 19558333e4aa11afeb9ebefe86247aee38264190
SHA512 1df0c384bfc70db083b1bae2d9ebd209c9e076e37bf47b33f1f277374ccbf29e04754388a7d5c0406237a7443567ec9cc274500e19f069a2d445f607751161bb
SSDEEP 6144:F3jxPxKh/ICK7eprXNSVeGqjBcvw40frIcDxG2lKi:FTxPxKiMX+Utcvl0jIcDxG9i
MD5 SHA1 SHA512 SSDEEP

Submit Download

QQMusicResource.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq3C7E.tmp\QQMusicResource.dll
Size 711KB
SHA256 b58885befc56dc4d91dd29c15e1dea36b58d9c42863a408bb3fe96a1af1151a8
MD5 13c2a252683c75ed23910b89d4a669e5
SHA1 ee53fe8cdd409fa78700bc03b350432c27bdc4d8
SHA512 73723b50252cc0919c7b39dd33e385db6983e40d4273df6a5972889bfd7a93fab1fbd00ba1800f9ac5de480f4a19985995218c42b37808e133b88533840c9c36
SSDEEP 3072:rayWt6oDjbhHbRsiww9E12U2jA9W/1ipKLe7FwLPZ2kx83w7ONllbDKH9bu2e3H9:kbts4k2LJ2y5s9DKHBsH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq3C7E.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqdownload.dll

Path C:\Users\Admin\AppData\Local\Temp\qqdownload.dll
Size 636KB
SHA256 a9a5456d3878664a0f689d25401de1328a56972a697d38b0798a32de05f42c61
MD5 e2401fa2c7096c83a26153135c389b5c
SHA1 7f453599197034ec36716577d4525e4961444af8
SHA512 a42d0f5e127e3c36e03518eac6da4f953bff912f4515591b8a857c6a525ebc7352769edb5bb389d156babf187bc84bd0981db7a9e50d10fb35b9aa8c10372b1d
SSDEEP 12288:JtnSCNKQS8hVjyHKviTLQaN3V7W8pCx2U5aa1OZf:JQCI6Vd2Qy68pCx2U5aaUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4976-88-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/4976-97-0x0000000003380000-0x000000000355A000-memory.dmp

Download

memory/4976-96-0x0000000003380000-0x000000000355A000-memory.dmp

Download

memory/4976-99-0x0000000003380000-0x000000000355A000-memory.dmp

Download