Overview
overview
10Static
static
InstallerAppSetup.exe
windows7-x64
10InstallerAppSetup.exe
windows10-2004-x64
10Uses of Ad...ex.dll
windows7-x64
8Uses of Ad...ex.dll
windows10-2004-x64
8Uses of Ad...0x.exe
windows7-x64
Uses of Ad...0x.exe
windows10-2004-x64
Uses of Ad...ir.exe
windows7-x64
Uses of Ad...ir.exe
windows10-2004-x64
Uses of Ad...3x.exe
windows7-x64
Uses of Ad...3x.exe
windows10-2004-x64
Uses of Ad...31.exe
windows7-x64
Uses of Ad...31.exe
windows10-2004-x64
Uses of Ad...10.exe
windows7-x64
Uses of Ad...10.exe
windows10-2004-x64
Uses of Ad...ex.dll
windows7-x64
1Uses of Ad...ex.dll
windows10-2004-x64
1Uses of Ad...ex.dll
windows7-x64
8Uses of Ad...ex.dll
windows10-2004-x64
8Uses of Ad...0x.exe
windows7-x64
Uses of Ad...0x.exe
windows10-2004-x64
Uses of Ad...ir.exe
windows7-x64
Uses of Ad...ir.exe
windows10-2004-x64
Uses of Ad...ex.dll
windows7-x64
1Uses of Ad...ex.dll
windows10-2004-x64
1Uses of Ad...0x.exe
windows7-x64
Uses of Ad...0x.exe
windows10-2004-x64
Uses of Ad...ir.exe
windows7-x64
Uses of Ad...ir.exe
windows10-2004-x64
Uses of Ad...3x.exe
windows7-x64
Uses of Ad...3x.exe
windows10-2004-x64
Uses of Ad...31.exe
windows7-x64
Uses of Ad...31.exe
windows10-2004-x64
Analysis
-
max time kernel
25s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-01-2023 00:13
Static task
static1
Behavioral task
behavioral1
Sample
InstallerAppSetup.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
InstallerAppSetup.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/bhkspex.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral4
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/bhkspex.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/cx2310x.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral6
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/cx2310x.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/cxpolir.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/cxpolir.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/saa713x.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral10
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/saa713x.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/saa7231.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral12
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/saa7231.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/ttm6010.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral14
Sample
Uses of Additional Files/WinAll/BeholdTV/amd64/ttm6010.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Uses of Additional Files/WinAll/BeholdTV/bhkspex.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral16
Sample
Uses of Additional Files/WinAll/BeholdTV/bhkspex.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Uses of Additional Files/WinAll/BeholdTV/bhkspex.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral18
Sample
Uses of Additional Files/WinAll/BeholdTV/bhkspex.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Uses of Additional Files/WinAll/BeholdTV/cx2310x.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
Uses of Additional Files/WinAll/BeholdTV/cx2310x.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Uses of Additional Files/WinAll/BeholdTV/cxpolir.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral22
Sample
Uses of Additional Files/WinAll/BeholdTV/cxpolir.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/bhkspex.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral24
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/bhkspex.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/cx2310x.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral26
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/cx2310x.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/cxpolir.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral28
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/cxpolir.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/saa713x.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral30
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/saa713x.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/saa7231.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral32
Sample
Uses of Additional Files/WinAll/BeholdTV/i386/saa7231.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
Uses of Additional Files/WinAll/BeholdTV/amd64/bhkspex.dll
-
Size
103KB
-
MD5
d78686b8130fec68e1a75cec4d2962ae
-
SHA1
1816da02e7f8f678b11e4152d56b8af9a9c10469
-
SHA256
051be9377f04204ec5df434c451231bceca75b04c230b229160b3e27acfc4484
-
SHA512
883b89182b48018eea8d9dc77e65fadb769545579f175b5f4360f8d30669f32f748165310609b46c0bfdb628789b089f405aa94cc0a61d4221b83700706bdc44
-
SSDEEP
3072:p8N/5h8XgEu5C2QltfiNW/cp/gi/uRcEgZF0IIRlVNgZ:hmgi2RcEgHIRV
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32 regsvr32.exe -
Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\ = "BHKSPEX Digital Capture Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\ = "BHKSPEX Empress Base Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\ = "BHKSPEX Clara Stats Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\ = "BHKSPEX DVB Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\ = "BHKSPEX Clara Base Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71}\ = "BHKSPEX Empress Advanced Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D0B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF0D4D2B-0216-4667-9C3A-DFE51528B355}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768}\ = "BHKSPEX Analog Capture Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A98-81FF-4413-B723-A3BC5897DE71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7A88-81FF-4413-B723-A3BC5897DE71}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71}\ = "BHKSPEX Empress Stats Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D47A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D48A-AF8A-40B0-AD1C-9A37F9A15768}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uses of Additional Files\\WinAll\\BeholdTV\\amd64\\bhkspex.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{372E7AA8-81FF-4413-B723-A3BC5897DE71} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1150D46A-AF8A-40B0-AD1C-9A37F9A15768} regsvr32.exe