aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53

General

Target

aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe
Size

255KB
MD5

554bc83ad6706fae7ce9eacf171e0c03
SHA1

83226ea02e3480cd79675998a740c052ff34b5f2
SHA256

aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53
SHA512

be00c456326c7e11fc4c17839dc975ed78815121ba36257ad96ad19e094d1f6b437803688844e92b52eb16908e9ccfa16a4d5cbd795aff2708b87ff345f7476f
SSDEEP

6144:7UnITMpSph0lMqqgWoDhujqcQQbxJhVGvkVbOcH4CIMJ:7CQMY07qgWo6VVGvkVLAg

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32	regsvr32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
behavioral1/memory/1140-65-0x000007FEFB850000-0x000007FEFB8BD000-memory.dmp	upx
behavioral1/memory/1140-66-0x000007FEFB850000-0x000007FEFB8BD000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

pid process

1584 regsvr32.exe
684 regsvr32.exe
1140 explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1584	regsvr32.exe
684	regsvr32.exe
1140	explorer.exe

Modifies registry class 44 IoCs

Processes:

regsvr32.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ = "ICarefreeIdentifier"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ = "ICarefreeIdentifier"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\ = "CarefreePluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\ = "DDIAF61 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-AF61A5197766}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exeexplorer.exe

pid	process
1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe
1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe
1140	explorer.exe
1140	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1140 explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe
Token: 33	1264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1264	AUDIODG.EXE
Token: 33	1264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1264	AUDIODG.EXE
Token: SeShutdownPrivilege	1140	explorer.exe
Token: SeShutdownPrivilege	1140	explorer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

explorer.exe

pid	process
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe

Suspicious use of SendNotifyMessage 17 IoCs

Processes:

explorer.exe

pid	process
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exeregsvr32.exe

description	pid	process	target process
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1672 wrote to memory of 1584	1672	aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 684	1584	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe
"C:\Users\Admin\AppData\Local\Temp\aef3b4c860a5ed910f62851ad4d34965ae71c6c2e8f239f6d692c47688376b53.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:684

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
29f22f108861042f5c34e9ce371f5377

SHA1
b6540b4933aeab5cd4ccc142729be9d06171ac87

SHA256
3bd4e5a7bdf7cd278bd73a3d0f8b2a5b1b164ab2de8e6627845842f10f66f0d2

SHA512
047ff1d7883a2bc8239d8f102f9ddc76cc90e937fb27a5c588e78c852a8a6bc138b3c380695a5f46dd4ae7bac673debaac5c20a4de33cdd1de753780e38440de

Download Submit
C:\Users\Admin\AppData\Roaming\SogouPinyin.local
Filesize
89B

MD5
e6710029d88f4b149be13dcc425b6f13

SHA1
d07857b95ea45a0c2aac2d0edc7a197fe317805b

SHA256
8c52c518283bce37f9a10bc239865377054d64d78f723891a45217014dd3cc0b

SHA512
e3c9c4ad87ade16d569eef43ad1e6b36614ca66e06872c753de3075f338b9c2b30b342b31c470a020b426b3cb687127f87478b0904db4ed24e723ee75b54f101

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
29f22f108861042f5c34e9ce371f5377

SHA1
b6540b4933aeab5cd4ccc142729be9d06171ac87

SHA256
3bd4e5a7bdf7cd278bd73a3d0f8b2a5b1b164ab2de8e6627845842f10f66f0d2

SHA512
047ff1d7883a2bc8239d8f102f9ddc76cc90e937fb27a5c588e78c852a8a6bc138b3c380695a5f46dd4ae7bac673debaac5c20a4de33cdd1de753780e38440de

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
29f22f108861042f5c34e9ce371f5377

SHA1
b6540b4933aeab5cd4ccc142729be9d06171ac87

SHA256
3bd4e5a7bdf7cd278bd73a3d0f8b2a5b1b164ab2de8e6627845842f10f66f0d2

SHA512
047ff1d7883a2bc8239d8f102f9ddc76cc90e937fb27a5c588e78c852a8a6bc138b3c380695a5f46dd4ae7bac673debaac5c20a4de33cdd1de753780e38440de

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
29f22f108861042f5c34e9ce371f5377

SHA1
b6540b4933aeab5cd4ccc142729be9d06171ac87

SHA256
3bd4e5a7bdf7cd278bd73a3d0f8b2a5b1b164ab2de8e6627845842f10f66f0d2

SHA512
047ff1d7883a2bc8239d8f102f9ddc76cc90e937fb27a5c588e78c852a8a6bc138b3c380695a5f46dd4ae7bac673debaac5c20a4de33cdd1de753780e38440de

Download Submit
memory/684-59-0x0000000000000000-mapping.dmp

Download
memory/684-60-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download
memory/1140-62-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Filesize
8KB

Download
memory/1140-65-0x000007FEFB850000-0x000007FEFB8BD000-memory.dmp

Filesize
436KB

Download
memory/1140-66-0x000007FEFB850000-0x000007FEFB8BD000-memory.dmp

Filesize
436KB

Download
memory/1140-67-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/1584-55-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads