Overview
overview
8Static
static
Csrsrv.OCX.exe
windows7-x64
1Csrsrv.OCX.exe
windows10-2004-x64
1SkinH.dll
windows7-x64
3SkinH.dll
windows10-2004-x64
3TOMCTML32.OCX.exe
windows7-x64
8TOMCTML32.OCX.exe
windows10-2004-x64
8qq空间�...��.exe
windows7-x64
3qq空间�...��.exe
windows10-2004-x64
3科威软件园.url
windows7-x64
1科威软件园.url
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
Csrsrv.OCX.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Csrsrv.OCX.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
SkinH.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
SkinH.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
TOMCTML32.OCX.exe
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
TOMCTML32.OCX.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
qq空间刷人气大师.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
qq空间刷人气大师.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
科威软件园.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
科威软件园.url
Resource
win10v2004-20221111-en
General
-
Target
Csrsrv.OCX.exe
-
Size
40KB
-
MD5
86a4504ac7222a34d58f9153c806de3f
-
SHA1
35a53704bf8464746b350d8bceccecb61851d02f
-
SHA256
da5d307505b4cb3b89d12ce6723713e702bed7705428d1e5df786efea052e1f3
-
SHA512
50d9a31a976edffaa5ff7fd3d01ba26b7ba0fae6539f21bde52bd155e7a81773eb8beb9e05ae6467ab2bcc193813d0f74ae2c8672822e636eb3d06150ccc6975
-
SSDEEP
768:ATI+fOM1iMszz14yEUIr/WMsOfOM1QtT:6ICOM+a/ROMmZ
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4988 Csrsrv.OCX.exe 4988 Csrsrv.OCX.exe