Overview
overview
7Static
static
36442836c74...18.exe
windows7-x64
76442836c74...18.exe
windows10-2004-x64
7$FAVORITES...��.url
windows7-x64
1$FAVORITES...��.url
windows10-2004-x64
1$FAVORITES...��.url
windows7-x64
1$FAVORITES...��.url
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/atl71.dll
windows7-x64
1$SYSDIR/atl71.dll
windows10-2004-x64
1$TEMP/KanKan_1020.exe
windows7-x64
7$TEMP/KanKan_1020.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3KanKan/Cra...rt.exe
windows7-x64
1KanKan/Cra...rt.exe
windows10-2004-x64
1KanKan/IDesktop.dll
windows7-x64
5KanKan/IDesktop.dll
windows10-2004-x64
3KanKan/ImgFmt.dll
windows7-x64
1KanKan/ImgFmt.dll
windows10-2004-x64
1KanKan/KanKan.exe
windows7-x64
3KanKan/KanKan.exe
windows10-2004-x64
7KanKan/Kan...in.exe
windows7-x64
1KanKan/Kan...in.exe
windows10-2004-x64
1KanKan/zlib.dll
windows7-x64
3KanKan/zlib.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 18:16
Static task
static1
Behavioral task
behavioral1
Sample
6442836c748e63da7521355251d95dcd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6442836c748e63da7521355251d95dcd_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$FAVORITES/520ҳ_www.520.net.url
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$FAVORITES/520ҳ_www.520.net.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$FAVORITES/뷨ٷվ 52hxw.com.url
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$FAVORITES/뷨ٷվ 52hxw.com.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$SYSDIR/atl71.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$SYSDIR/atl71.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$TEMP/KanKan_1020.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$TEMP/KanKan_1020.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
KanKan/CrashReport.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
KanKan/CrashReport.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
KanKan/IDesktop.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
KanKan/IDesktop.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
KanKan/ImgFmt.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
KanKan/ImgFmt.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
KanKan/KanKan.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
KanKan/KanKan.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
KanKan/KanKanGengxin.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
KanKan/KanKanGengxin.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
KanKan/zlib.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
KanKan/zlib.dll
Resource
win10v2004-20240709-en
General
-
Target
KanKan/KanKan.exe
-
Size
2.9MB
-
MD5
2b42d9a69ad17ddea409a55af2b2ca82
-
SHA1
494ec740af0a5dfd80b820a0b524ab00e44f6913
-
SHA256
64152982a776a8e100cd216b194e00730b7c93a45d7cc196c108124740bce19b
-
SHA512
41bd954b6b800e7c9f57bddbef711caecfd2fe8fc60fa06f0fde0693280f5bdc7728688bae774fdf3e47d0b11e04b48e5bfe15bba2d53259d0420ca68904ecd1
-
SSDEEP
49152:u9XwIKIhTrITE1SOjbSKQVZMpOsgWfwPfdhTsVpQ6t:0KIhTrITE1EX3UwPfdapQ6t
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2632 KanKan.exe 2796 KanKanGengxin.exe 2796 KanKanGengxin.exe 2632 KanKan.exe 2632 KanKan.exe 2632 KanKan.exe 2632 KanKan.exe 2632 KanKan.exe 2632 KanKan.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2796 2632 KanKan.exe 30 PID 2632 wrote to memory of 2796 2632 KanKan.exe 30 PID 2632 wrote to memory of 2796 2632 KanKan.exe 30 PID 2632 wrote to memory of 2796 2632 KanKan.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanGengxin.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanGengxin.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26B
MD53261d41c66a0311c3291b44d391deedc
SHA15d85e32fa5104e1a63fa8328a881569758cf972e
SHA256ea675ccfb09962669b09aef5f40e565c13acdeb1a73026a98b6e85faee26cf98
SHA5129ebc786841240d9b3c1452d62cce547697c8097607a467c56374e09e31fbeb686150485f0a50edfc6be091d1c1faebe5f227922edfacfef492074bf2d611f1c8