Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 02:20

General

  • Target

    5052cf2d1f8b28b72768fae254e34a64_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    5052cf2d1f8b28b72768fae254e34a64

  • SHA1

    c28918f7ddabe26ba0d0ece6e3ea953ae5e7df72

  • SHA256

    206f0e7fd34c289a30061a61e700296dca6df48535922f94384f6c1715534691

  • SHA512

    bd222d6b63b1c199da18b652d226f9a67c0f34931ceb60849ec0272a7042ba3bfe46b659baf7e8a09a073a9145bc618a47ff4bc99a25d7bac6dcc78b0118f620

  • SSDEEP

    49152:prpRAcE4BJ16/bI6KH9/W/mxnwfYkW7mr1ir:pREYnFH9/PJYYkWe0

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5052cf2d1f8b28b72768fae254e34a64_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5052cf2d1f8b28b72768fae254e34a64_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\Tencentdl.exe
      "C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\Tencentdl.exe" /Install
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe
        "C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe" -RegServer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\program files (x86)\common files\tencent\qqdownload\113\DownloadProxyPS.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3648
    • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\MiniQQDL.exe
      "C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\MiniQQDL.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4824
  • C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe
    "C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1028
  • C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe
    "C:\program files (x86)\common files\tencent\qqdownload\113\tencentdl.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Tencent\Desktop\Global.db

          Filesize

          16B

          MD5

          20a290387265425af96f651e77980cc7

          SHA1

          8e4e81cdda51eeb9af705dad53f9b4b589b74b3e

          SHA256

          be084831617a9191d223167be28e8941a169cd730992b9080a586d222f6aba26

          SHA512

          148107f9924d8e6df5bcff7dcfba7e7e3e710f14e54df925bc48a299a0ded2b03cdb9c7e1f35a64a401323b8946e6cea8dd906a9d393a7e58af5638e83789f5c

        • C:\ProgramData\Tencent\QQDownload\mediadl.cch

          Filesize

          13B

          MD5

          fcdbaab3b332f90e2c6aec0e0c1b835d

          SHA1

          31a8c1d4f0211e534b3b28d867f5aa54838fc276

          SHA256

          523c575e9afff0d47d61c7324358dcccfed98b4f315c11b67ee3cf255449960b

          SHA512

          606739c79371de93c3a88e7843bca3bfae86708b9e631d37b1d931653e929ae15b1ab99064bb6abcb31e0f135357afc44e5249b07e9b110994648c7f2a8cc201

        • C:\ProgramData\Tencent\QQDownload\mediadlp.cch

          Filesize

          8B

          MD5

          f6bd6b3389b872033d462029172c8612

          SHA1

          f4533a73e647c710d3ddbfb253de66e1ac8a6891

          SHA256

          f0a0278e4372459cca6159cd5e71cfee638302a7b9ca9b05c34181ac0a65ac5d

          SHA512

          8c7471bddfd31fa1e83a761a2f5bc2fc772a5567c85b3a753d3b8a2e8259386f8f7e440c0ad80272514d821ff27362047e1171b02a95537bd3b40416e5810231

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\DownloadProxyPS.dll

          Filesize

          65KB

          MD5

          4ceb4641a90de4feee34ba5f949d41ba

          SHA1

          cb060db236d9938f97b5e4e2d1b1c663071a2bd7

          SHA256

          2a075c11148c3f04163b9ffdaa05d4b46bc55c96b2fe50d0a39cc377139c2b26

          SHA512

          932960a503817683c3d7c66695732ec6dc59887b0eaa8d53c4e26e1de6fd6c4e9291a4afe25d898c9b02dfe4cd976414f66b715b861e7974e765bff587fa2d27

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\MiniQQDL.exe

          Filesize

          829KB

          MD5

          b45f4840234e8aa94d0d75c47cc052ff

          SHA1

          9fd12d040d7033c0b5b81d4c3ce97145bf504cc4

          SHA256

          e510b8ef6baba2229fe2c7a88865b8f9cb4609a8d504ca74ca93420fe4eef700

          SHA512

          08322f3fdf76d52544e8c0ccf88e127f23237fb9d0de3002c6231cea2d5e97342068617d2b4695ccf858ab148436255a965a5daa28e2d3a99f51767a5f306ff8

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\PreDown.dll

          Filesize

          601KB

          MD5

          e6f2f48d472676dadd9a7d50566ebedb

          SHA1

          414f0aeaf7fc815d550385cea1ee4d7077f8cf71

          SHA256

          804b1bb1ee609957eacfae505a98744b40e6967fe5b215f628b94fae6abaae02

          SHA512

          ac99e0056abf53b16090cd9cef1b5ea6d3ef393513daaeb05e79b5c1d3d564b6cd74013459813f6b1bbc6844866af8a8f504f995a511e0a61264aed72f8bc0f6

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\Tencentdl.exe

          Filesize

          821KB

          MD5

          b8f64b0b53e039cbeba7d60c81710bd8

          SHA1

          a9be269daa7f404a23fcaf002be7ee13697ef8e0

          SHA256

          54e0b845eff52823a951ff4b38c6728a381613a0603ce82d4d5c34aa6402f7cc

          SHA512

          9b5c5818fc0a11c8dc80b3befd3459a031f411fc5ddba43f7c0737f20ce6b265599790b64897aed448ccff766c98c5f8d0837495a8eecca36777be390f49ec05

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\config.ini

          Filesize

          850B

          MD5

          9592bad096e70eeac962f67426e04614

          SHA1

          a804b1e7f13ed6fd6be1f4524d51fb363f10a405

          SHA256

          d1519683a381602b04f217934415057f7bf2dc5d18f88a510860fbce138d8e4f

          SHA512

          f96135bf64898fd43747e0412d0e1d0a3fae790a33df00b03e75e5514accf416244a4102c660b4079306be3ab0ef9628f1edbb7cb5307fa933185f7940d561ae

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\dlcore.dll

          Filesize

          1.7MB

          MD5

          82ce23aad749aee959820533c0676cb2

          SHA1

          3aa526a4ed51491b01a5419713d1582a426b7efc

          SHA256

          a2fd92c7fc26bf2851aaefcc5f0bafd75511794ad0c781e1a715df812f7bd2ab

          SHA512

          c91f5165059677071a1e2949244dd1ce4e2c5ce58fe38298f1707ff4b6de6981d7c45f8fd5a189a91d154b0c4af25dbaae4e7a51f107dee77f2f51f0150d2707

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\extract.dll

          Filesize

          358KB

          MD5

          9da51d4506bd094fbfc7d337338fc872

          SHA1

          1b5799ef6b66ac9471842f17570813e7c42cdb27

          SHA256

          f2181e41d5950fcb762edf6b9cbb665e94004a7f1102b606c331690e6069a501

          SHA512

          07dfae7c04ea2815ed78af9e29313050338bfec5a8e08a8846c0f846d6d27b79b7bfe2c3b4dbf3758aa22f88342aadf5513dcbcd6a718b9dd939996d6ce9e044

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\XF.png

          Filesize

          3KB

          MD5

          1aa27fb55cb6f229cd47074268ed89cf

          SHA1

          11abd79d69b8012a2bfa48af4462a2169d554cf1

          SHA256

          9525586a06237e90be7969028a255a627c547b9cf916549ee7438a896588b3c3

          SHA512

          347e29a88e74be4689bc7df6f6f6ece30b398338083117f85398e19cb43c310d7b81c039b79976abd09902005a34b8b2f7a4da004f9460d8b6c0cd74c8405409

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\button.png

          Filesize

          8KB

          MD5

          810e18e5e782ea451d6c78bc5586e194

          SHA1

          aaa61c7655e0cdf407ca26d8a9777078603be676

          SHA256

          65b38298dc57ad481c76795c7262e426f76564666bf9b461535243eda06af5ca

          SHA512

          85829e840849a2074d2a6d23fd0a86facaf7a9d39101d9eae3c96025fb817b2730f709c6692d2284e9e229b85d43277e53d4a3d7352fcfb82cac8cc508c416a2

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\checked.png

          Filesize

          3KB

          MD5

          0167d8af18d97247c2a8fe123531460d

          SHA1

          733e5003888e6416ea43af197e290c143eaac5e8

          SHA256

          64de4c088b64f617967143113eaf571046e116616d013f2df19925442fa4871a

          SHA512

          5ebe8a916e51db2556d07313e33381df550c2b668b2f23e2be56c95834573294cdfa5fb42e9e96587eba50a55169e0816a67f2f8e13dd152a4891ce20739ff7d

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\close.png

          Filesize

          5KB

          MD5

          2f94db129b7474b09958a7f04ba3591b

          SHA1

          78e5ed7db8a0d9d1f32508f8605b999c334860f4

          SHA256

          406481e12ef84471031264244e035993abdb832792519d45bdc6b1240eb33bb7

          SHA512

          d888a0398d4b6509c930dab11a8702859cd4fee4e647eb06ddad8562ec4ce8042453312ec633d449a9fc2160138b2590beb3d61f35ddf45443448cc1e6e8c342

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\loading.png

          Filesize

          2KB

          MD5

          366d5ae87ae0c97ee8b995334f86f572

          SHA1

          1c350c4a3ddbd582013dcb7f86d272eca81f3e9b

          SHA256

          ee7f579baa2cd58ea7a093f6913e2074b987d862b07603b09bf2c0be0476c91d

          SHA512

          07f4aef8e673b6ec236daab90a915352dc6c4273e9e99e1af01a3fbc79e1214b83c4d0f3d0699f09fb980ac42a34f8c9b79c8d4ea0152d966650a1607354c0fb

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\mainbnd.png

          Filesize

          6KB

          MD5

          c5a0b10d206e67a2e23ceba6e0996cb9

          SHA1

          5594da0d5a20980fb9eee9f3cb123f98f04102ca

          SHA256

          79c07d49c63921752a6614e593b232b70348b0613decc724ed8eedb691fd4461

          SHA512

          8f2dbf7e94f2202e9ced29dc5ca33ac77ddd5faf1484320bcab195364a1685fa883cab0f5a325148c6b7913a8338f970906f62f4485ada3da0e45323d3811e24

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\mainwnd.jpg

          Filesize

          30KB

          MD5

          6e3de863ba255d42b15c0b1fe7e74dc7

          SHA1

          2edb379f17c36c91cbc313d8afa4c3389f975283

          SHA256

          284578c26f6f083fdcdddf8734273adb92230d9aac8d652b3ca93aa73ba01065

          SHA512

          c6b5c6fe71579009cb0dc5c5e7d36adb484e202d65586786e4b1092f8a141bd997bf5fd23ce3646433b620036ed7deb8b41d1000bbf92d69fe23071cf6f2bd82

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\min.png

          Filesize

          5KB

          MD5

          bd7e98287cc90e5a71c21333f8a67f53

          SHA1

          77d0118645af536580983de045357afbc5c753e7

          SHA256

          4f1f2d974d7a10930f0b255fcb33ba313bd9296694d9b35c3a1cbe7f1899fe1c

          SHA512

          2cefb47e3ee4796416c6e35b2a2ae5f3538951d73f85c47e9bf2f0a0e441cf795aec404bb647e63073a303034b0c947c522213e96bb0708172719fad18e38d26

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\image\unchecked.png

          Filesize

          2KB

          MD5

          4449c38913ad0ee04b8f37cddd9351ee

          SHA1

          fd638a9038d76d00a4ee83e0daf83f25d1a56296

          SHA256

          f92c38e9e499d1b6e25e98c896e6ba9a957f3ebb5857cf0ec74be7cae9c806da

          SHA512

          ad4949c79400a4ed4e5e1a1e09e7de212acfea6487948b519d47ba2dc333198a339e2b8184f28d519f8efd11cda3b0f0215ee6ce4e3847534a2306a79fa715ec

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\tnproxy.dll

          Filesize

          377KB

          MD5

          858fc685a5bff591985394f9cdf9e289

          SHA1

          5970a28aab399d005885b9c6b79eafd606640fab

          SHA256

          3404212366a3aed4155e5d73d901e769a7005cadde5169a8d9677ab5a0585dcf

          SHA512

          620491b27ff281ad42f947fb9dbef3256624fe8d298740d6b9942627525a2d44525cbb9065d2ffa2efb0ab3478b8a33148fc9b0b4c531106cc8e421e2c59f0d0

        • C:\Users\Admin\AppData\Local\Temp\QQGameDownloader\yxd1321498145\xzqdl.ico

          Filesize

          4KB

          MD5

          c8c946b477d16d4a4a8afbaa5b34487a

          SHA1

          4f9ee477b7ebbcf76551ad468caad87d44b4044b

          SHA256

          62e613ef55fe8144867fd8521065a1ace6aa3b1f85911ba343be3c4311b88cc4

          SHA512

          82f25c507f21137f936cc51efe968c9a5c89921b9241b750818c27c096e4a24ded5b5d194e4a645b5cdcf29174139d873b628f6cc53c81fbea204c8a758de959

        • C:\Users\Admin\AppData\Roaming\Tencent\QQDownload\3574315683\Setting\host.dat

          Filesize

          49B

          MD5

          a0b75ed98fc4ada93f4fa46c5ca2798e

          SHA1

          c0ef629de1b6afe558ce7d7be63875766d3fb30a

          SHA256

          431eed895f2678955c7acc1beab41dfa30d1b89dd4927e9a0c56b1c57b52a835

          SHA512

          bccd4f3eb5f64527b75ee7bb7630f12bec8f54be30bde1a21ec89920244ef49c8d3f726aa8ddcebc95cb70266acb72b4a6e04873beb2eb90fdd60af713afa35c

        • C:\Users\Admin\AppData\Roaming\Tencent\QQDownload\3574315683\Setting\p2pconfig.dat

          Filesize

          64B

          MD5

          130401193e712950009d8fc8e307963d

          SHA1

          5249eb4e58b26399b6953fe904104f0ea27fa5e3

          SHA256

          1c2aebef8009f60cb26e9cb10d3a01d3cdb1f625929f4f599fe5ffc1c73e4316

          SHA512

          e9efaefa35e5fa298d65f7941573f816ddfddd1d27cbcfd16e23f9e29acdd19c74fa29da7d668cd76c21d9d8b30afd7572211a541e80f8a8e670ede1c89e536b

        • memory/1028-73-0x0000000003F60000-0x0000000003FBD000-memory.dmp

          Filesize

          372KB

        • memory/2712-85-0x0000000003900000-0x000000000395D000-memory.dmp

          Filesize

          372KB

        • memory/2712-82-0x0000000002900000-0x0000000002910000-memory.dmp

          Filesize

          64KB

        • memory/4824-70-0x0000000002460000-0x00000000024BD000-memory.dmp

          Filesize

          372KB

        • memory/4824-64-0x0000000007270000-0x0000000007430000-memory.dmp

          Filesize

          1.8MB