f048d6c021a1f189e86a0bb99b5010c3b43c7ca326e6f7aef1ef85c56060ff6f

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
Size

1.4MB
MD5

aadfd9f322ba0dbd314c98e50c897427
SHA1

856c227c0c3301cd2e8576e4130e0817da94f02a
SHA256

f048d6c021a1f189e86a0bb99b5010c3b43c7ca326e6f7aef1ef85c56060ff6f
SHA512

2c43f173640003a569b6d5cb0dee240031a112868e6d33cd642f5fa25dd205972e3ad9340dc084b8ee4b2c5b4842b2ad26cf822ceb6af6bf6ca1b68f07070a88
SSDEEP

24576:58QmqMQVIDKEDUmVcZqefKc54Aw28oSAP7zxBUxdbtJKLXceNRzzPji0dpnKMJLv:uQ1VIEiczxVAoSA/xB4KA4yExjLv

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2756	douyou_duan-qzd.exe

Loads dropped DLL 7 IoCs

pid	Process
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
2756	douyou_duan-qzd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	douyou_duan-qzd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe
2756	douyou_duan-qzd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2756	5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe	85
PID 5048 wrote to memory of 2756	5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe	85
PID 5048 wrote to memory of 2756	5048	aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aadfd9f322ba0dbd314c98e50c897427_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Roaming\qz\douyou_duan-qzd.exe
  "C:\Users\Admin\AppData\Roaming\qz\douyou_duan-qzd.exe" /setupsucc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso5100.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5100.tmp\StdUtils.dll

Filesize
94KB

MD5
0061a96c8ff17ad0927aae65b5dfe06b

SHA1
9d1bd69d930ccda683e6b7c2c0d1dbe3b54861fe

SHA256
2aaef1ed8a25097b3a807568daeffd3320fa29d6de66df90a57beaa8df8949cf

SHA512
c6b887a4e1682ba1e126c93bc4d886c7f1ce392f97866e631c5b8a945824cbefc9af2429a14c2dac3b16d97bd33195d4378a7e92ae53fdeb47197452d4d90fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso5100.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Roaming\qz\config.dll

Filesize
1.0MB

MD5
b4d19749adaf9f2c42f06eff71b003cb

SHA1
6cae6493aca04be3b721df0c34f7b54b9b4f48ba

SHA256
d05b2b15a2338adbb2202ec480a5c9689247df4c175ee41a20ce1d03422193f2

SHA512
54a22826314925a7ea5b154dd81f880bfd33dd0fea238761c4a7d166248ffd0a0cb088f901f3fcadf03573ed7dc89353d96fefa8a236608535773d15ffbe834e

Download Submit
C:\Users\Admin\AppData\Roaming\qz\config.ini

Filesize
367B

MD5
3a8ac6b3f7bbdae9198c1a9624172e24

SHA1
0bb84341a3dc4b17f2da3b0a9b774ab539591941

SHA256
975a566ca19b836bdf4c375cbed44a48dbf303dbd58ca1c7f6998198d8ab36f9

SHA512
afc4f01309aede00c49bd96bedf34519c705761df9acc81eead5e6fa351626fe747758b4b3f0794ee22865435460e3a805d051deb72693b9e2faa0e51d02e5b3

Download Submit
C:\Users\Admin\AppData\Roaming\qz\douyou_duan-qzd.exe

Filesize
160KB

MD5
40c208e08b1442ce16683584757a553e

SHA1
fb9d56c453ee3d6f53941dae7a46aa46d4a403c4

SHA256
9eb97093a6e455ddd48b964b8d798da841c2fcb6bcc389826bb87b50dafe9c12

SHA512
1be251466b79ba40f04848c9db16ccc51f30730f689ea5d9783e15103da09a026b3b6392fbc17d1bf6277b5d63a001319b30ff3881c489a92e8a0cd4801f7177

Download Submit
memory/5048-15-0x00000000048D1000-0x00000000048D2000-memory.dmp

Filesize
4KB

Download
memory/5048-14-0x00000000048D0000-0x00000000048D3000-memory.dmp

Filesize
12KB

Download
memory/5048-55-0x00000000048D1000-0x00000000048D2000-memory.dmp

Filesize
4KB

Download
memory/5048-54-0x00000000048D0000-0x00000000048D3000-memory.dmp

Filesize
12KB

Download
memory/5048-65-0x00000000048D1000-0x00000000048D2000-memory.dmp

Filesize
4KB

Download