68111aff6f58632930f934340647991159c9e51ac7955e89599f82b6947f6f1a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KanKan/KanKan.exe
Size 4.6MB
Sample260421-ppln7aas2x
SHA256 68111aff6f58632930f934340647991159c9e51ac7955e89599f82b6947f6f1a
MD5 dda84a51c34a92fd27b6aaac8ef677f1
SHA1 d6e7148cb31d79cef5df93f6e21d869786240130
SHA512 fa5e85fb08ee874ac8a97395182ddc5c4e269327d4ea0dc2f30db8912811f8f8ce594bdcf509e8e2fe5c98da61a3dbc4cc09cd7d04386549efc7765db4402285
SSDEEP 49152:22ttpyXhFlSueTTrITggPTTy0AhlrLb0cDdsfap7vVTpBmUj3730BeSlTsLQJA61:2UkSpTrITggP5cjCfappp9730BiLijCs
TLSH
T144367D85E6D350F6FF52253014FEB3369635DE895B15CBC793A8FE282832181A43B26D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	KanKan.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	KanKanST.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKanLive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKanST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeituUDEx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	KanKanLive.exe
1128	KanKanLive.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3468	KanKan.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe
3468	KanKan.exe
1128	KanKanLive.exe
1128	KanKanLive.exe
3468	KanKan.exe
3996	KanKanST.exe
3996	KanKanST.exe
3468	KanKan.exe
3432	MeituUDEx.exe
3432	MeituUDEx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1128	3468	KanKan.exe	84
PID 3468 wrote to memory of 3996	3468	KanKan.exe	85
PID 3468 wrote to memory of 3432	3468	KanKan.exe	86

C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe
"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanLive.exe
  "C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanLive.exe" MTKK
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe
  "C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe" <software>MTKK</software><style>6</style><wparam></wparam><style>4</style><wparam></wparam><style>3</style><wparam></wparam><style>19</style><wparam></wparam><style>22</style><wparam></wparam>
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\KanKan\MeituUDEx.exe
  "C:\Users\Admin\AppData\Local\Temp\KanKan\MeituUDEx.exe" /KanKan 2126
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lay.ini

Path C:\Users\Admin\AppData\Roaming\Meitu\KanKan\Config\Lay.ini
Size 27B
SHA256 7c8e9372a8d2be7769f42a883c9d1019448d1569136ff5c9dd94b428906e120a
MD5 b632917a636ffd919d4b0e89e0484a73
SHA1 dc3b32bfdc191e3602617aa0f4bceca330357406
SHA512 86e44d9583aa0c2586b36889b0c43595c0a68036bc4a5ccf4a3fcf6304bbeed9d5486826aad8ff377bc96618edba0d1f5ae8e505ffbcf9e5701a2bf8af83e557
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\Meitu\KanKan\Config\config.ini
Size 95B
SHA256 afe5717993ab838b19eeed51d8d04f7f305fd9b1a3bea69ba86d298639abec80
MD5 f1bb12e2052f30a1f4274f93edd85b1d
SHA1 0cc941312f980d92c824dfd8ef801fe4b80857b5
SHA512 f47cd75d8298ba2cad0419e17506c7bbd5c7d5624e1b71547a7a5932dee38a1f6b788e24f87761ef2aebcf3e4f5077c193324810457973817ed0e4b5c27a8961
TLSH
T15BB012310082408CDC9B312055F0622408C5036331F0AC2004D141ED8EC05CE77D7032
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\Meitu\KanKan\Config\config.ini
Size 147B
SHA256 7abd47d4433e90f2d4f38c7d2dbb14fe6277e7957b5936c6fa88f19c015e6c98
MD5 0045d4bf954faa50f17822ce1797caca
SHA1 b3be67758341f15daf93c286337654d28df760e3
SHA512 952498a4b76a8f529597372ad742d2bc6e60c24829d56d67d54497f180703d4968ec915fb05d33ab4da4ac68e0127b009d462f183d7675c92f6a2df3b6013ee3
TLSH
T19DC02B3128D3408CDC4B323046FC501808C553D334B45C002AC2C0ED4DB03EDAAD7437
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3468-4-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-5-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-6-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-1-0x0000000000442000-0x0000000000443000-memory.dmp

Download

memory/3468-3-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-2-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-67-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-68-0x0000000000442000-0x0000000000443000-memory.dmp

Download

memory/3468-69-0x0000000000400000-0x00000000008AC000-memory.dmp

Download

memory/3468-70-0x0000000000400000-0x00000000008AC000-memory.dmp

Download