73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7

General

Target

73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe
Size

255KB
MD5

bfd148a3b0d7c27c34c0268ea8b3bea2
SHA1

600d36d821981934a405a29152d93d0a9b1feb4d
SHA256

73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7
SHA512

367f9fa97307728333102c9a296534192bb9c5e32c0cb765de5d214808a858d5e517b654d20e569dbc431983d989b3512cc04a8f8663cfa48d6d667bbb76192c
SSDEEP

6144:7UnITMpSph0lMqqgWoDhujqcQQbxJhVGvkVbOcH4CIMw:7CQMY07qgWo6VVGvkVLAt

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32	regsvr32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
\Users\Admin\AppData\Roaming\Carefree\plugin.dat	upx
behavioral1/memory/1504-65-0x000007FEFBDF0000-0x000007FEFBE5D000-memory.dmp	upx
behavioral1/memory/1504-66-0x000007FEFBDF0000-0x000007FEFBE5D000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

pid process

1204 regsvr32.exe
376 regsvr32.exe
1504 explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1204	regsvr32.exe
376	regsvr32.exe
1504	explorer.exe

Modifies registry class 44 IoCs

Processes:

explorer.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ = "ICarefreeIdentifier"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605620}\ = "ICarefreeIdentifier"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\ = "DDIF2B9 Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\ = "CarefreePluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Carefree\\plugin.dat"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-AFF3-F2B95F32D6CE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exeexplorer.exe

pid	process
968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe
1504	explorer.exe
1504	explorer.exe
968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1504 explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe
Token: 33	1844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1844	AUDIODG.EXE
Token: 33	1844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1844	AUDIODG.EXE
Token: SeShutdownPrivilege	1504	explorer.exe
Token: SeShutdownPrivilege	1504	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

explorer.exe

pid	process
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe
1504	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exeregsvr32.exe

description	pid	process	target process
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 968 wrote to memory of 1204	968	73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe
PID 1204 wrote to memory of 376	1204	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe
"C:\Users\Admin\AppData\Local\Temp\73b6e9ef24b30ad12677ec0138c6afd62b469142fc41bf3bb68760af804b3ab7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:376

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
7d827e24bc5f35d919b6935b72f7a312

SHA1
b21171c1f406d75f6bbdf0f8f0b80991bc5e575a

SHA256
9c57a7bcb12aa74796413e8b1968cf45951f0c30723cfa757ecd70312253ffb7

SHA512
b1995208855b0d93c17174c3defab4922c9c3fd2c7635336c66a057d7458d64996f6a3c3f625640e4b7c2a2dbb5d163629b0af17197379e3a0573c8c6a270d75

Download Submit
C:\Users\Admin\AppData\Roaming\SogouPinyin.local
Filesize
89B

MD5
6af3a7fe90a3506927855b11b6c8c956

SHA1
e83d35662298d9f5dfa3041da6d627c52042ed67

SHA256
e503cc5f9be994e7bf354ac2698f7207e4fb48738e6a6f82304558fb445cb706

SHA512
9f93e30613e59a5140d47ba4a8b24b16f2f4c80eb2b95f079f6374c1010c5c7c612980426166ec6017014ee4907d14d71f71577d5f77da629a9fa2bf57fb03a7

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
7d827e24bc5f35d919b6935b72f7a312

SHA1
b21171c1f406d75f6bbdf0f8f0b80991bc5e575a

SHA256
9c57a7bcb12aa74796413e8b1968cf45951f0c30723cfa757ecd70312253ffb7

SHA512
b1995208855b0d93c17174c3defab4922c9c3fd2c7635336c66a057d7458d64996f6a3c3f625640e4b7c2a2dbb5d163629b0af17197379e3a0573c8c6a270d75

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
7d827e24bc5f35d919b6935b72f7a312

SHA1
b21171c1f406d75f6bbdf0f8f0b80991bc5e575a

SHA256
9c57a7bcb12aa74796413e8b1968cf45951f0c30723cfa757ecd70312253ffb7

SHA512
b1995208855b0d93c17174c3defab4922c9c3fd2c7635336c66a057d7458d64996f6a3c3f625640e4b7c2a2dbb5d163629b0af17197379e3a0573c8c6a270d75

Download Submit
\Users\Admin\AppData\Roaming\Carefree\plugin.dat
Filesize
95KB

MD5
7d827e24bc5f35d919b6935b72f7a312

SHA1
b21171c1f406d75f6bbdf0f8f0b80991bc5e575a

SHA256
9c57a7bcb12aa74796413e8b1968cf45951f0c30723cfa757ecd70312253ffb7

SHA512
b1995208855b0d93c17174c3defab4922c9c3fd2c7635336c66a057d7458d64996f6a3c3f625640e4b7c2a2dbb5d163629b0af17197379e3a0573c8c6a270d75

Download Submit
memory/376-59-0x0000000000000000-mapping.dmp

Download
memory/376-60-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/968-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1204-55-0x0000000000000000-mapping.dmp

Download
memory/1504-62-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1504-65-0x000007FEFBDF0000-0x000007FEFBE5D000-memory.dmp

Filesize
436KB

Download
memory/1504-66-0x000007FEFBDF0000-0x000007FEFBE5D000-memory.dmp

Filesize
436KB

Download
memory/1504-67-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads