Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 23:08
Behavioral task
behavioral1
Sample
44ab29f8c98db8d038badf81d2bc7737.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
General
-
Target
44ab29f8c98db8d038badf81d2bc7737.exe
-
Size
321KB
-
MD5
44ab29f8c98db8d038badf81d2bc7737
-
SHA1
8a8335a9fe633554f2651f57d3100c762ce18968
-
SHA256
14f8b870ea7830b828e2641f4fe8493a937c1fe1552d081dbdc3dd3a7ca6f10c
-
SHA512
7721eb3195e21e4dfd12cfd113c5d256796eec1e59f5b366da85aa86bc3ad301ea9b2a9e60c8ab44358d6146111ec3c0a03002ab26f6b3c5d74ae2450a36a5ef
-
SSDEEP
6144:OiLsNLop94KLMZ4hD2tUfBxboPRYG4SLRXUxVK:OiQNo9TYFtUJB9ANUxc
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2132 info2asp.exe 2484 iePlayer.exe 2628 Update.exe -
Loads dropped DLL 8 IoCs
pid Process 2964 44ab29f8c98db8d038badf81d2bc7737.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2964 44ab29f8c98db8d038badf81d2bc7737.exe 2636 regsvr32.exe 2964 44ab29f8c98db8d038badf81d2bc7737.exe -
resource yara_rule behavioral1/memory/2964-1-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/2964-27-0x0000000000400000-0x0000000000452000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iePlayer.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "bhoRay2009 Class" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\NoExplorer = "1" regsvr32.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\baidu\iePlayer.exe 44ab29f8c98db8d038badf81d2bc7737.exe File created C:\Windows\baidu\Update.exe 44ab29f8c98db8d038badf81d2bc7737.exe File created C:\Windows\baidu\info2asp.exe 44ab29f8c98db8d038badf81d2bc7737.exe File created C:\Windows\baidu\ATLcom.dll 44ab29f8c98db8d038badf81d2bc7737.exe File created C:\Windows\baidu\shortcut.js 44ab29f8c98db8d038badf81d2bc7737.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2996 2132 WerFault.exe 14 -
Modifies registry class 50 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer\ = "ATLcom.bhoRay2009.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "bhoRay2009 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR\ = "C:\\Windows\\baidu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ = "IbhoRay2009" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9}\ = "ATLcom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32\ = "C:\\Windows\\baidu\\ATLcom.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ATLcom.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ = "C:\\Windows\\baidu\\ATLcom.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\ = "ATLcom 1.0 ÀàÐÍ¿â" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID\ = "{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ATLcom.DLL\AppID = "{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\CLSID\ = "{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ = "IbhoRay2009" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\ = "bhoRay2009 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\VersionIndependentProgID\ = "ATLcom.bhoRay2009" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ProgID\ = "ATLcom.bhoRay2009.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\ = "bhoRay2009 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0 regsvr32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 iePlayer.exe 2484 iePlayer.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2132 2964 44ab29f8c98db8d038badf81d2bc7737.exe 14 PID 2964 wrote to memory of 2132 2964 44ab29f8c98db8d038badf81d2bc7737.exe 14 PID 2964 wrote to memory of 2132 2964 44ab29f8c98db8d038badf81d2bc7737.exe 14 PID 2964 wrote to memory of 2132 2964 44ab29f8c98db8d038badf81d2bc7737.exe 14 PID 2132 wrote to memory of 2996 2132 info2asp.exe 29 PID 2132 wrote to memory of 2996 2132 info2asp.exe 29 PID 2132 wrote to memory of 2996 2132 info2asp.exe 29 PID 2132 wrote to memory of 2996 2132 info2asp.exe 29 PID 2964 wrote to memory of 2608 2964 44ab29f8c98db8d038badf81d2bc7737.exe 30 PID 2964 wrote to memory of 2608 2964 44ab29f8c98db8d038badf81d2bc7737.exe 30 PID 2964 wrote to memory of 2608 2964 44ab29f8c98db8d038badf81d2bc7737.exe 30 PID 2964 wrote to memory of 2608 2964 44ab29f8c98db8d038badf81d2bc7737.exe 30 PID 2964 wrote to memory of 2484 2964 44ab29f8c98db8d038badf81d2bc7737.exe 31 PID 2964 wrote to memory of 2484 2964 44ab29f8c98db8d038badf81d2bc7737.exe 31 PID 2964 wrote to memory of 2484 2964 44ab29f8c98db8d038badf81d2bc7737.exe 31 PID 2964 wrote to memory of 2484 2964 44ab29f8c98db8d038badf81d2bc7737.exe 31 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2608 wrote to memory of 2636 2608 wscript.exe 32 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33 PID 2964 wrote to memory of 2628 2964 44ab29f8c98db8d038badf81d2bc7737.exe 33
Processes
-
C:\Windows\baidu\info2asp.exeC:\Windows\baidu\info2asp.exe 0ECF425C63BA9ACDBA47BCFCE0729441558839FCE551ED8286FFF72FBA452935C184EC17A33CD8610D82137E18439E1A7ADC55E55E1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 3082⤵
- Loads dropped DLL
- Program crash
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\44ab29f8c98db8d038badf81d2bc7737.exe"C:\Users\Admin\AppData\Local\Temp\44ab29f8c98db8d038badf81d2bc7737.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\wscript.exewscript.exe C:\Windows\baidu\shortcut.js //B2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\baidu\ATLcom.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2636
-
-
-
C:\Windows\baidu\iePlayer.exeC:\Windows\baidu\iePlayer.exe 0ECF425C63BA9ACDBA47BCFCE0729441558839FCE551ED8286FFF72FBA452935C184EC17A33CD8610D82137E18439E1A7ADC55E55E2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
C:\Windows\baidu\Update.exeC:\Windows\baidu\Update.exe 0ECF425C63BA9ACDBA47BCFCE0729441558839FCE551ED8286FFF72FBA452935C184EC17A33CD8610D82137E18439E1A7ADC55E55E2⤵
- Executes dropped EXE
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD58d8afbdd1977f3c5dc12775e56b7c319
SHA144cc86024bccaa91e29936623696594befb0a025
SHA2561e8febc754066269b7c5f22388f4d3b7b4a7a70d382a8ae6f5daffe35ebb014b
SHA512d669ac2137daaeedc64cbb8c4817a9c02ba3d57f2db3e82ebaea6c12c7e55cb6d2db47ca488338da065af517c5a1b27ba4fd4da41805ebc219e2f4053d6693d6
-
Filesize
1KB
MD5c7ea49bd0568bf89f387f6c5b45163ec
SHA16d694978c5c523ff460e890c6ea2aab43d8f615e
SHA25607e61ebf29c13a0ff3c17b491c2c2550baf1e9ba894b19e880cfa8b660f2bf7a
SHA512efd72c2f7c587e2fb2259e1864e47f528e9239453f4233383ac9a5f6205abed42313dc0c4fde8bc0cf686f3e94f14221a910e774194232ad31f4afef44d266b9
-
Filesize
57KB
MD52c4af8de5e96ad97393f18e67e545411
SHA10266f63b6a8bcdce96a1699466b5e181e2824d84
SHA256718bacf147034db41a2e076338dd709c8638559116a77f60ec0d26c897f22129
SHA5123e0a3802e26b570959a5b8e3c2593402a90be6574fe8062703a2a1772cf9ab68bd59ef2806d8b1afbaafe77a0470ce3e3610e39cbd6706c3d1f7533b6c2e993c
-
Filesize
64KB
MD5bcd7327919f9a78aeb5ea8e62705cb6d
SHA11dcb15d024e634063ee2b05f15af59589b16ffff
SHA256f846d5eb0aa0c5bb648f0167ccde1cb2e882cafbb5f2a3737b7879a9c2b07505
SHA512f2b71ab5e1666882d9d8a640f81f9625ee95903278a2254697457d3cd2f4a6aaa490f77a06632d71658ffc37180b7b0a9e1dbc7ef33a2ec007f2464212af8e9b
-
Filesize
41KB
MD51000b47ffbae539166a0e996216ebb36
SHA10803068acac00e9339fc1bcc4d2dca9752045f56
SHA256d1558f21145f2b285a56cd926d39c9dca03fe32657b54c6467b42e443e5217cb
SHA5122e80199bf91bb3d29b21ca4d920e04f5bf212d887314326a072e62d8e8686ff8b4eb9923c6fb4ccb10d9ccd1906bda5c5018b553b480d12bc8c6bcc27a0ed5bb