d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Size

222KB
MD5

a46ffaced8dd083a1daea0c70ac9cf6a
SHA1

af5d2c3e8273abf7b76b3c9886a3485fccd50bab
SHA256

d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d
SHA512

2db488ba73aa3d09fdcfa8864a2ba99195885fadfb3c8f3d60226bbd09724b6c52fe8991bfa5d49a3ed17413d8225ab8472c500b81da1682a69cd662118b8a94
SSDEEP

6144:Ru3dwQ0I26tvaZohGtH79vT/uNb4IPhaOOv:UNztymhAHREb4IPqv

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Progra~1\Baidu\bar\SET276F.tmp	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
File created	C:\Progra~1\Baidu\bar\SET276F.tmp	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
File opened for modification	C:\Progra~1\Baidu\bar\BaiDuBar.dll	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDULYRIC.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUNEWS.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUIMG.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 00	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUSEARCH.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUMP3.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUPOST.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDU_DIC.HTM"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\Contexts = 10	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\VersionIndependentProgID	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu\CLSID\ = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter\CurVer	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ThreadingModel = "Apartment"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\HELPDIR\ = "C:\\Progra~1\\Baidu\\bar\\"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1\CLSID\ = "{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1\CLSID\ = "{77FEF28E-EB96-44FF-B511-3185DEA48697}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu.1\ = "BaiduBar"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\CLSID\ = "{7C76C055-ED6E-4535-A70F-CD476E727F67}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\VersionIndependentProgID\ = "BaiduBarEx.DropTarget"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ = "°Ù¶È³¬¼¶ËÑ°Ô"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\Programmable	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ = "ITool"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\VersionIndependentProgID	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\ThreadingModel = "Apartment"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\CLSID\ = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE\CLSID	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\ProxyStubClsid32	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\ = "DropTarget Class"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\ProgID\ = "BaiduBarEx.DropTarget.1"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\FLAGS\ = "0"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\TypeLib	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\TypeLib\Version = "1.0"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ProgID	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1\ = "BandIE Class"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\0\win32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib\Version = "1.0"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\VersionIndependentProgID	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\Version = "1.0"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ = "IBandIE"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu.1\CLSID\ = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\VersionIndependentProgID\ = "BaiduBar.Baidu"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE\CurVer	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\HELPDIR	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CLSID\ = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}"	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeRestorePrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
Token: SeBackupPrivilege	908	d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe

C:\Users\Admin\AppData\Local\Temp\d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe
"C:\Users\Admin\AppData\Local\Temp\d4b166818586686f1aa315adcb996c261663f193234f0eb77813ebd4bf47526d.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BaiduBar.dll

Filesize
286KB

MD5
e4bc62a44704db1e93d4e839781d1920

SHA1
1e9dcd259beff683a81432bf2539b047700a2f9a

SHA256
e58dfa77619ef7d60c9f7ef40db74a81643ecf1886d1960be65578b18183b318

SHA512
3bbc9e0745406863c27e9cb98bdd403b192840d905a9bba9bb02e86581d16805292c197c8a79ae6ee2f22c1ddc50f763b6e4ae95d21a9055b94abeb17ccdef04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.inf

Filesize
593B

MD5
fc6646e02237f73a6133debcf65cdbcb

SHA1
b1230571e990644df7d941a5c50358e8d2356224

SHA256
1319980cef510399859f2fd86902e44b281dcb785e397b8cf24e86f6d8f790ec

SHA512
4899234faaeed29d474b691b06ed3ee846a6cae5a7f9ad968c5435a78e9f77a47a798d47f4c0c27bb4e4d64e71ebf077b663e4aecf687dc70ae57588a0a07fcc

Download Submit
\PROGRA~1\Baidu\bar\BaiDuBar.dll

Filesize
286KB

MD5
e4bc62a44704db1e93d4e839781d1920

SHA1
1e9dcd259beff683a81432bf2539b047700a2f9a

SHA256
e58dfa77619ef7d60c9f7ef40db74a81643ecf1886d1960be65578b18183b318

SHA512
3bbc9e0745406863c27e9cb98bdd403b192840d905a9bba9bb02e86581d16805292c197c8a79ae6ee2f22c1ddc50f763b6e4ae95d21a9055b94abeb17ccdef04

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
90KB

MD5
d553b62a8136d41289513c6405efea2d

SHA1
db48c3fd3993ff20511e47ffad14bfbdb9f438eb

SHA256
ce7cfb626807084186b248bbf2ef776eac086da936146f7d44956c2fcfaec1f8

SHA512
4a3767e8ac1e684a9a6eaced921b9599e34d5a4e83f034c7fe42bd8fd707a2b86f51ad485933fed5015554c3f9c4cf4b1357832964cc170d8cba86092fc9d2e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads