Overview
overview
3Static
static
Csrsrv.OCX.exe
windows7-x64
1Csrsrv.OCX.exe
windows10-2004-x64
1QQ显示ip...��.exe
windows7-x64
3QQ显示ip...��.exe
windows10-2004-x64
3QQ显示ip...��.exe
windows7-x64
3QQ显示ip...��.exe
windows10-2004-x64
3QQ显示ip...��.exe
windows7-x64
3QQ显示ip...��.exe
windows10-2004-x64
3SkinH.dll
windows7-x64
3SkinH.dll
windows10-2004-x64
3TOMCTML32.OCX.exe
windows7-x64
1TOMCTML32.OCX.exe
windows10-2004-x64
1当下软件园.url
windows7-x64
1当下软件园.url
windows10-2004-x64
1Analysis
-
max time kernel
172s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Csrsrv.OCX.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Csrsrv.OCX.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
QQ显示iphone在线.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
QQ显示iphone在线.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
QQ显示iphone在线最新版.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
QQ显示iphone在线最新版.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
QQ显示iphone在线最新版最新版.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
QQ显示iphone在线最新版最新版.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
SkinH.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
SkinH.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
TOMCTML32.OCX.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
TOMCTML32.OCX.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
当下软件园.url
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
当下软件园.url
Resource
win10v2004-20221111-en
General
-
Target
Csrsrv.OCX.exe
-
Size
40KB
-
MD5
794e1106ffcf364a7311fc81d90e238e
-
SHA1
c5d61fbe589871f2f684c77047706795f33e8580
-
SHA256
f74376809deb13703f645a4b23ae68e18d25b823d93a11afb2eee30d7e07571f
-
SHA512
156bf42f7141dbd5e09d1442fe46fc58de554cafdfd2b99a393d1e5f325e76c3fafeb4ffefd6705a54089ffc7d9330e355e006e514ed22483c2aa814d4191308
-
SSDEEP
768:hTI+fOM1iMs1u1YCEcIr/WMsOfOM1QtT:FICOMIr/ROMmZ
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4132 Csrsrv.OCX.exe 4132 Csrsrv.OCX.exe