Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 08:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1306386da358611407940f89342ca83b.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1306386da358611407940f89342ca83b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
1306386da358611407940f89342ca83b.exe
-
Size
4.6MB
-
MD5
1306386da358611407940f89342ca83b
-
SHA1
764cf6b5e38e02b553e637e3b3fa39387c15ab8e
-
SHA256
e8549034000f9633abb412a1cc7ef9b26d0d822a34890a91d32fedc386f0cce3
-
SHA512
d4dbd6ccbf6fe7bd5077f72323be0f61f51e377404696dc1c10177470e92424d8a39585bdcbe59dbb509a8f7869396f897c508b263a1ece502af2d9a329935ec
-
SSDEEP
98304:xa48Y1rxBxNw2MFVqN39+904/Wj9VcSm/IAWZGH9x1KEfYJ2nwftHVNYe/ValT:448YpPxYvqN90p/WMnIxUxwEfYJ2ncru
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 1306386da358611407940f89342ca83b.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation DuoMi.exe -
Executes dropped EXE 4 IoCs
pid Process 3320 DuoMi.exe 5060 dmdeskbox.exe 4872 dmdeskinfo.exe 2648 DuoMi.exe -
Loads dropped DLL 64 IoCs
pid Process 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3868 1306386da358611407940f89342ca83b.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 5060 dmdeskbox.exe 5060 dmdeskbox.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe 2648 DuoMi.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\duomi = "C:\\Program Files (x86)\\DuoMi\\DuoMi.exe /hide" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\duomitip = "C:\\Program Files (x86)\\DuoMi\\dmdeskbox.exe /hide" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duomiData = "C:\\Program Files (x86)\\DuoMi\\DuoMi.exe /p2p" 1306386da358611407940f89342ca83b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: DuoMi.exe File opened (read-only) \??\k: DuoMi.exe File opened (read-only) \??\l: DuoMi.exe File opened (read-only) \??\r: DuoMi.exe File opened (read-only) \??\t: DuoMi.exe File opened (read-only) \??\e: DuoMi.exe File opened (read-only) \??\m: DuoMi.exe File opened (read-only) \??\n: DuoMi.exe File opened (read-only) \??\q: DuoMi.exe File opened (read-only) \??\s: DuoMi.exe File opened (read-only) \??\u: DuoMi.exe File opened (read-only) \??\j: DuoMi.exe File opened (read-only) \??\h: DuoMi.exe File opened (read-only) \??\p: DuoMi.exe File opened (read-only) \??\v: DuoMi.exe File opened (read-only) \??\x: DuoMi.exe File opened (read-only) \??\y: DuoMi.exe File opened (read-only) \??\b: DuoMi.exe File opened (read-only) \??\o: DuoMi.exe File opened (read-only) \??\w: DuoMi.exe File opened (read-only) \??\z: DuoMi.exe File opened (read-only) \??\i: DuoMi.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 DuoMi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\DuoMi\resource\ogg.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\Theme\Theme3.pth 1306386da358611407940f89342ca83b.exe File opened for modification C:\Program Files (x86)\DuoMi\data\pcuscfg.ini DuoMi.exe File created C:\Program Files (x86)\DuoMi\dmdesklyric.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\ErrorNotify.exe 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\codec\MPADecoder.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\duomi.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\mp4.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmcommon.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmsearch.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmmediainfo.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\flac.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmobject.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\Theme\Picture\ͼ¿á0.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\Theme\Picture\sum\ͼ¿á2_sum_.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmlyric.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmdeskbox.exe 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\codec\bass_flac.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\img\load.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\img\error2.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\img\logo.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\data\pcuscfg.ini DuoMi.exe File created C:\Program Files (x86)\DuoMi\dmplayer.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmplist.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\Error.html 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\Player_Loading.html 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmpnet.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\rmvb.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\Player_Error.html 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmplaycore.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\Loading.html 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\flv.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\didx.dat DuoMi.exe File created C:\Program Files (x86)\DuoMi\msvcp71.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\codec\DCBassSource.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\codec\oggsplitter.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\lyricBK.jpg 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\m4a.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\pth.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\wmv.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmlyricctrl.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\drvc.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\npduomi.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\ape.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\mp3.ico 1306386da358611407940f89342ca83b.exe File opened for modification C:\Program Files (x86)\DuoMi\data\cusconfig.ini 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\dmcbar.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\pncrt.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\config\ÂþÂþÌú¹ì.lsk 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\rm.ico 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\Theme\Theme5.pth 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\LyricSkin\»ÒÍÃ˹»ù.lsk 1306386da358611407940f89342ca83b.exe File opened for modification C:\Program Files (x86)\DuoMi\data\cusconfig.ini DuoMi.exe File created C:\Program Files (x86)\DuoMi\msvcr71.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\codec\bass_ape.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\config\ipsecdef.dat 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\wma.ico 1306386da358611407940f89342ca83b.exe File opened for modification C:\Program Files (x86)\DuoMi\config\cusconfig.ini 1306386da358611407940f89342ca83b.exe File opened for modification C:\Program Files (x86)\DuoMi\config\cusconfig.ini dmdeskinfo.exe File created C:\Program Files (x86)\DuoMi\dmup.dll 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\uninst.exe 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\LyricSkin\×Ô¶¨Òå.lsk 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\jquery.js 1306386da358611407940f89342ca83b.exe File created C:\Program Files (x86)\DuoMi\resource\img\error.jpg 1306386da358611407940f89342ca83b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" dmdeskinfo.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch dmdeskinfo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" dmdeskinfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Duomi.exe = "9000" DuoMi.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync dmdeskinfo.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\MiscStatus 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\TypeLib 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}\1.0\0\win32 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5}\TypeLib\ = "{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DuomiObj.DuomiObject\CLSID\ = "{267355F8-8583-4621-8AAC-A9A3901EC90F}" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\InprocServer32\ = "C:\\Program Files (x86)\\DuoMi\\dmobject.dll" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\DuoMi\\dmobject.dll, 1" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.pth\shell\opendm\command 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.MP3\shell\open 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.AAC\shell 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WAV\shell\opendm\command 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DuoMi\Shell\ 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.mp3\ = "duomi.MP3" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dmv\ = "duomi.dmv" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dmv\shell\open\ 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmv 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WMA\DefaultIcon 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DuomiObj.DuomiObject.1\ = "CDuomiObject Object" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\VersionIndependentProgID 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5}\TypeLib 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WMA\shell\opendm 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.FLAC\shell\opendm\command 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DuoMi\Shell\open\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" %1" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\TypeLib\ = "{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5}\TypeLib 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dpl\shell\open\ 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dpl\shell\opendm 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dpl\shell\opendm\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.pth\shell\open 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.MP3\shell\opendm\command 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WMA\shell\opendm\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\ToolboxBitmap32 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.flac\ = "duomi.FLAC" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dpl 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.AAC\shell\opendm\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WAV\shell\ 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WAV\shell\open 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}\1.0\ = "DuomiObj 1.0 Type Library" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5}\TypeLib\Version = "1.0" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dmv\shell\opendm\ = "ʹÓà ¶àÃ×ÒôÀÖ ²¥·Å" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dpl\ = "duomi.dpl" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.AAC\shell\ 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DuoMi\Shell 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DuomiObj.DuomiObject\CurVer 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.WAV 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.wav\ = "duomi.WAV" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WAV\shell\open\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C02C7725-399E-47F9-90E1-5CDDDD6C71A5} 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.pth\shell\opendm\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.MP3\shell\open\ 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.FLAC\shell\opendm\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F} 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.wma\ = "duomi.WMA" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.pth\shell\open\command\ = "\"C:\\Program Files (x86)\\DuoMi\\DuoMi.exe\" \"%1\"" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}\1.0\HELPDIR 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.dpl\shell\opendm\ = "Óà ¶àÃ×ÒôÀÖ ´ò¿ª" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.FLAC\shell 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DuomiObj.DuomiObject.1\CLSID\ = "{267355F8-8583-4621-8AAC-A9A3901EC90F}" 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{267355F8-8583-4621-8AAC-A9A3901EC90F}\Version\ = "1.0" 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}\1.0 1306386da358611407940f89342ca83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\duomi.WMA\shell\open\ 1306386da358611407940f89342ca83b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BBDD5D95-01EC-449E-9C7A-F85F61D28C50}\1.0\0 1306386da358611407940f89342ca83b.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe Token: 33 3320 DuoMi.exe Token: SeIncBasePriorityPrivilege 3320 DuoMi.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3320 DuoMi.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3320 DuoMi.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5060 dmdeskbox.exe 5060 dmdeskbox.exe 3320 DuoMi.exe 5060 dmdeskbox.exe 5060 dmdeskbox.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 3320 DuoMi.exe 4872 dmdeskinfo.exe 4872 dmdeskinfo.exe 3320 DuoMi.exe 3320 DuoMi.exe 3320 DuoMi.exe 2648 DuoMi.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3320 3868 1306386da358611407940f89342ca83b.exe 99 PID 3868 wrote to memory of 3320 3868 1306386da358611407940f89342ca83b.exe 99 PID 3868 wrote to memory of 3320 3868 1306386da358611407940f89342ca83b.exe 99 PID 3868 wrote to memory of 5060 3868 1306386da358611407940f89342ca83b.exe 98 PID 3868 wrote to memory of 5060 3868 1306386da358611407940f89342ca83b.exe 98 PID 3868 wrote to memory of 5060 3868 1306386da358611407940f89342ca83b.exe 98 PID 3320 wrote to memory of 4872 3320 DuoMi.exe 97 PID 3320 wrote to memory of 4872 3320 DuoMi.exe 97 PID 3320 wrote to memory of 4872 3320 DuoMi.exe 97 PID 3320 wrote to memory of 2648 3320 DuoMi.exe 101 PID 3320 wrote to memory of 2648 3320 DuoMi.exe 101 PID 3320 wrote to memory of 2648 3320 DuoMi.exe 101 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 1306386da358611407940f89342ca83b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIPI = "0" 1306386da358611407940f89342ca83b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1306386da358611407940f89342ca83b.exe"C:\Users\Admin\AppData\Local\Temp\1306386da358611407940f89342ca83b.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3868 -
C:\Program Files (x86)\DuoMi\dmdeskbox.exe"C:\Program Files (x86)\DuoMi\dmdeskbox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
C:\Program Files (x86)\DuoMi\DuoMi.exe"C:\Program Files (x86)\DuoMi\DuoMi.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\DuoMi\DuoMi.exe"C:\Program Files (x86)\DuoMi\DuoMi.exe" /p2p3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
-
C:\Program Files (x86)\DuoMi\dmdeskinfo.exe"C:\Program Files (x86)\DuoMi\dmdeskinfo.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4872
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
464KB
MD5f81a2916fecfea6cb3030247d6b2ef46
SHA18e9f47439eea0a513248cf1cdde6544af06d8214
SHA256b30db602370e8a1e9a5fc27fba7b8093172fdc552dd32c3851468c52e1554638
SHA512e4a2321bfd0c6e3d7042310ff1324fef5c40b7903a0e216e6b45bd57e52928cd6813d5828decf3d857338fde8fbd52ad13412c32ef56cd7d0277f191abedf3a3
-
Filesize
898KB
MD5cb03282a31338a34260465d21552169c
SHA1f7f7bc840024a2bbb0bcdaf46f48e82d19406b24
SHA2562b78e4f9bb8f4ae7c64b594c23eda3d4cca9a89815503ca36accfac772b4d6d9
SHA5120a7f8479db180d4ca8eada69ea25629b4a114b2176859f4172ff2d9ce8de844a493d4db27f0fd17e1d687c807c4086d49d47e3c42b69efa1754911610bf56bc1
-
Filesize
488KB
MD5561fa2abb31dfa8fab762145f81667c2
SHA1c8ccb04eedac821a13fae314a2435192860c72b8
SHA256df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
SHA5127d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
-
Filesize
664KB
MD54a8a7d3297e3e6c205825899dedd0186
SHA19f52b311f625135b3035fbcec51838061de7eb06
SHA256329ffc6bdba46f9f3da249727ae4dc561761b9b541085de2800affdb09db3eb2
SHA5128eb2b6936c251b0b318474f44ca41db2bf5ebaddcea8502f36e94f0941dd60adcf75db25db8910686f696d80132ad56760051ad9ed9929b7c992436ceb092676
-
Filesize
144KB
MD51ebd1a8de2525e6932e389a54d3bf392
SHA19927dec8dbaf5fd68828ecf2ca3092b98c77ec09
SHA256674ff51e887870b594f17fc52645f9988e4fbc7cdcdeac6964e164ee5ec6d31f
SHA51266606d88487675646d561d5fc4c2565aac5dfe32a6206be72f36d2622a6549347cc597ae57ea2f39577f5f57bd80e86caf182242368d7f1f9f2c00963915cde5
-
Filesize
40KB
MD59c68196558b44fe1f9c18771d7c646bc
SHA12b19191237746801d08842491d75ba0a564f8958
SHA25625485fb6572626a3a85caab5e63bac60c71a33502d18706994541f72689fec3c
SHA512516a961f7f56d8588a0bc765c80088abdd62f2776c98602a25418359cff6a45130adeed5de6420b7fadb4ade2927899f13b8989855adb206b15b5066a35dbc3c
-
Filesize
73KB
MD5824fc40bd871979a38101220a3e1faa1
SHA17fbe5ff358cc4c20ecb3c84219ce2cb43a40bcd9
SHA256de9cddad2d4757149ad30a7b9051a0233a1b95cb50ff514f04ffc92c4d0bcfa2
SHA51240e32018fec23a9c8f3537c6cb9815878b0a6f802b55e6fcb26bcee8203da27fa3fed88d0cdf5f7da881f0607a82f665f843f04d7b8072e10426ce4eed1e0e14
-
Filesize
92KB
MD59f521e572689d7142cdb75295e254dfc
SHA15d9a2ebdc515d5c75e2328f5c37ef6bcbcd1e320
SHA2564471039e713db2e48a7df2ce12444514a7ef9eef8ae8f1f8996e392008abd334
SHA5121b24403b3ee100f2b647033034847204f2c3b269c0f003adefc748e6b4f5f48ca40aceb4f1bd761c0753685c71b5aa4b49c9553b88ded795821071e33ca56d9a
-
Filesize
381KB
MD57cb12d5d248fee6bd5a90e8ecb3e7c56
SHA1408bfeae622b35daefe504f46218ceb0c0412fbc
SHA256cc3c2392eea952d218bf786613531d3d5f255d99dd2552195fe720174ac2986a
SHA512185ebc3b4b6cd6f2fc5574ec8e1263eca27eab4b28802575d21baf5fdb93e2afe6c9c5d244d9c7a798af811383d63fdc2176dacbe71cd82d09ef2b73163166a3
-
Filesize
340KB
MD586f1895ae8c5e8b17d99ece768a70732
SHA1d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA2568094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
SHA5123b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
-
Filesize
25KB
MD5758dad3b00dd72c0853ce77643eeb69d
SHA1b159453a2768d35b959edda5aa0ac2d441d92880
SHA256615ffa8f56d7eb49d6fda62c6bd0c54bb0ef8b9258409d77186dcbe5c9b30a8b
SHA5123e0d80018e9842fc24389a2a1a848bc1ab2eba4f412216196d24b54f2cf5944efac0929e91cb9c03d3f8f1e0452a6ad3ff9c2e272ad918c578c743ca0041ae7f
-
Filesize
25KB
MD5828586045f88de07f3f0c66baacca604
SHA16b60a06fa74b8446dd1064f3966636fd9f11765f
SHA256915e7c73162ef50df387f3246f4abc3ed3c6a3e4fe268e2463d9ef22d94b633b
SHA5123504ef82521d240425cb2cd5c9d26debe2c980487cd024ebbcda028f7db99faf726bfeedac4d647c55d5e09395a4ac46e41010e11b1d55f05d1c2b7b44b118fd
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
2KB
MD59410591a148871a6d0629cf25b94526f
SHA1be1e8b0fe8327f185136a0d2460a68f720484535
SHA256acc76e81f71e7f2ba58c36d678bc9ae4705e0187a3cdfa6d0025190467d9c0c7
SHA512465d3e418e769b907262e07cbca3d2c5132bf328431d456be09c059821be20a6d30106562d7ef0bfa93ca219b2abe57ee891d937419fc4b8840987b184b45df0