2eb54f154dccd84c47ce239be465807d65c72a4d839d6d237d448a1ed96a6c45

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQ牧场一键收获助手/QQ牧场一键收获助手.exe
Size

1.2MB
MD5

6cd65b3de6017d8921e2b35945226317
SHA1

a7aded8ad581b0d9211aa5f00ed0ae4da8627c18
SHA256

4b1b2b36367674edaf6f3e240d9ec554205ef92441fcdeeb65d4c2c709edd769
SHA512

1c84f54bbc1fd430ca0807b0a721cb7ca6411dd2bf93983b2b653395d9a8373b30d44fcbf0ce78a5e97160d4f095b7eaa23dad2dc0574b9a8d3bf05d755624d5
SSDEEP

24576:CyXQi3re6QuM1uGS1q6QSab9bGt/GM0CUQWjg7kWYKyTwfDG7fCgJmoIy7ha:1gw6sTGPnSq9ber0C3xYzTiDGPmoIWha

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a000000012033-0.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2148	QQ牧场一键收获助手.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	QQ牧场一键收获助手.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQ牧场一键收获助手.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	QQ牧场一键收获助手.exe
2148	QQ牧场一键收获助手.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	QQ牧场一键收获助手.exe

C:\Users\Admin\AppData\Local\Temp\QQ牧场一键收获助手\QQ牧场一键收获助手.exe
"C:\Users\Admin\AppData\Local\Temp\QQ牧场一键收获助手\QQ牧场一键收获助手.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\V220090726.EPE

Filesize
477KB

MD5
ca2ac02906ea3dd183678ebff7f3354d

SHA1
e1661ae1280b6a5bb56f954672e298ab93b15868

SHA256
962f7d1d251db7bb422e8add837e7efd78528b005b41c58fab71d130920863d7

SHA512
7ecc03726a1412580d575a1b193d4893c1a7375bae313a9f2f83fab1fec28ee6ec928a1a8a6507200b9c0bcecb58c55fd69037ef0015952521f978cd20ee3a33

Download Submit
memory/2148-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2148-2-0x0000000071120000-0x0000000071265000-memory.dmp

Filesize
1.3MB

Download
memory/2148-1-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/2148-5-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/2148-7-0x0000000071120000-0x0000000071265000-memory.dmp

Filesize
1.3MB

Download