Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
4a5881510b389c117ceefd6ebd7ac781.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a5881510b389c117ceefd6ebd7ac781.exe
Resource
win10v2004-20231222-en
General
-
Target
4a5881510b389c117ceefd6ebd7ac781.exe
-
Size
1.8MB
-
MD5
4a5881510b389c117ceefd6ebd7ac781
-
SHA1
3da55e46f30e773cb1be090c75105994c96c18b0
-
SHA256
e24e506c5f0e94aff89f5623a3d948aaaf9a1a511656793dc9937cfe04e36ba1
-
SHA512
c1f572d732687f45c7660753717de42b799f663f8aac5b1be0bc56c0118d6e09a0d5d579f3653960336f353fe38365f9f5c3d876a7d29d3c87ddf336125c1177
-
SSDEEP
49152:4uIwAxgmP8D9D2ufHU9XFg75oQcxwKFvCWqj9N9JLZ:4uZ99SsU9XidIwwS7bV
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1948 T8SETUP.EXE 2772 v4srchmn.exe 2576 v4barsvc.exe 3020 v4barsvc.exe 2176 v4brmon.exe 2468 v4HighIn.exe 2992 v4barsvc.exe -
Loads dropped DLL 53 IoCs
pid Process 1848 4a5881510b389c117ceefd6ebd7ac781.exe 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 2772 v4srchmn.exe 2772 v4srchmn.exe 2772 v4srchmn.exe 1948 T8SETUP.EXE 2576 v4barsvc.exe 2576 v4barsvc.exe 1948 T8SETUP.EXE 1948 T8SETUP.EXE 3020 v4barsvc.exe 3020 v4barsvc.exe 1948 T8SETUP.EXE 1948 T8SETUP.EXE 2176 v4brmon.exe 2176 v4brmon.exe 2176 v4brmon.exe 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 2468 v4HighIn.exe 2468 v4HighIn.exe 2468 v4HighIn.exe 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1848 4a5881510b389c117ceefd6ebd7ac781.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Wow6432Node\CLSID\{e7472076-ff9d-4325-8eaf-613572008758}\InprocServer32 T8SETUP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Wow6432Node\CLSID\{e7472076-ff9d-4325-8eaf-613572008758}\InprocServer32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\v4SrcAs.dll" T8SETUP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Wow6432Node\CLSID\{e7472076-ff9d-4325-8eaf-613572008758}\InprocServer32\ThreadingModel = "Apartment" T8SETUP.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DictionaryBoss Search Scope Monitor = "\"C:\\PROGRA~2\\DICTIO~1\\bar\\1.bin\\v4srchmn.exe\" /m=2 /w /h" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DictionaryBoss Browser Plugin Loader = "C:\\PROGRA~2\\DICTIO~1\\bar\\1.bin\\v4brmon.exe" T8SETUP.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{58376892-60e7-4f63-aca0-0f686af554d6} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{58376892-60e7-4f63-aca0-0f686af554d6}\ T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6eb534fb-2001-45c4-b860-bc904865a379} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6eb534fb-2001-45c4-b860-bc904865a379}\ T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58376892-60e7-4f63-aca0-0f686af554d6} T8SETUP.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{58376892-60e7-4f63-aca0-0f686af554d6} T8SETUP.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\NPv4Stub.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4htmlmu.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4httpct.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4tpinst.dll T8SETUP.EXE File opened for modification C:\Program Files\Internet Explorer\msimg32.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brmon.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regiet.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4feedmg.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrchMn.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\IE9Mesg\COMMON.T8S T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\Settings\s_pid.dat T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4auxstb.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4dlghk.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4reghk.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\T8RES.DLL T8SETUP.EXE File opened for modification C:\Program Files\Internet Explorer\ieuser.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brstub.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brstub.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4dyn.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regiet.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4barsvc.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brmon.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4datact.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4datact.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4impipe.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4uabtn.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4bar.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4bar.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4highin.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4htmlmu.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4idle.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4sknlcr.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4mlbtn.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4mlbtn.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\INSTALL.RDF T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\LOGO.BMP T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4auxstb.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4html.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4html.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4medint.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regfft.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skplay.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrchMn.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\installKeys.js T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\CHROME.MANIFEST T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4barsvc.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4ieovr.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4radio.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4httpct.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4idle.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4radio.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4script.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\Message\COMMON.T8S T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\chrome\v4ffxtbr.jar T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\gen1\COMMON.T8S T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4dlghk.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4highin.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4medint.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4Plugin.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skin.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skplay.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4msg.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4reghk.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4sknlcr.dll T8SETUP.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{e7472076-ff9d-4325-8eaf-613572008758} T8SETUP.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66222c2f-e3da-46fe-ac02-b30ba0daa13a}\Policy = "3" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66222c2f-e3da-46fe-ac02-b30ba0daa13a} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66222c2f-e3da-46fe-ac02-b30ba0daa13a}\AppPath = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{272143f8-3dbe-424c-949f-20acd11e5a6d}\AppName = "v4SkPlay.exe" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{272143f8-3dbe-424c-949f-20acd11e5a6d}\AppPath = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd}\AppName = "v4impipe.exe" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd}\AppPath = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{272143f8-3dbe-424c-949f-20acd11e5a6d}\Policy = "3" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c7d153b1-5602-41a4-a012-06165b4b0c53}\AppName = "v4SlSrch.exe" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{163a7621-d9a7-4595-bd0c-ca2d34425c35} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66222c2f-e3da-46fe-ac02-b30ba0daa13a}\AppName = "v4SrchMn.exe" T8SETUP.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{163a7621-d9a7-4595-bd0c-ca2d34425c35}\Policy = "3" T8SETUP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{163a7621-d9a7-4595-bd0c-ca2d34425c35}\AppPath = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{272143f8-3dbe-424c-949f-20acd11e5a6d} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{3042df7a-e900-4389-9b94-923df0daa57e} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{163a7621-d9a7-4595-bd0c-ca2d34425c35}\AppName = "v4medint.exe" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c7d153b1-5602-41a4-a012-06165b4b0c53} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c7d153b1-5602-41a4-a012-06165b4b0c53}\AppPath = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c7d153b1-5602-41a4-a012-06165b4b0c53}\Policy = "3" T8SETUP.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\UrlSearchHooks T8SETUP.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd}\Policy = "3" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar T8SETUP.EXE -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run T8SETUP.EXE Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run T8SETUP.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run T8SETUP.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2c72f7a5-8160-4024-94d8-e0995d547bb0}\InprocServer32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\v4dyn.dll" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.MultipleButton\CurVer T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5b610696-32b6-416c-bf5c-ca4f60a345dd}\MiscStatus\1 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.UrlAlertButton.1 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{045c5f24-9e13-4ea8-ab93-fddab34f3fa5}\InprocServer32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1479029-BACC-4C9A-8C15-D857A2974E27}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ED49DF44-2DC8-4CFC-8510-DAF4DFCC5F40}\TypeLib\ = "{696D3B4F-71EF-41CC-96FF-342317E644DE}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.ScriptButton\CLSID T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5b610696-32b6-416c-bf5c-ca4f60a345dd}\MiscStatus\1\ = "131473" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5b610696-32b6-416c-bf5c-ca4f60a345dd}\Version\ = "1.0" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED49DF44-2DC8-4CFC-8510-DAF4DFCC5F40}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BD5AE73-FDA3-469B-9358-D4EDA7123370}\TypeLib T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.Radio.1\ T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BECF6AB-82E3-4E58-9E73-78565FFE5C05}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9D14CAF3-88C2-4C9A-AE73-FE77C2A5697D}\1.0\0\win32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A44A538-73FC-4D86-83DB-68ACE71E5FE8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{696D3B4F-71EF-41CC-96FF-342317E644DE}\1.0\HELPDIR T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DDD8F3F-3774-484C-938C-4D9AB3A5F575}\TypeLib\ = "{4DE8B15E-E379-482A-81C5-CD99EB8CEF40}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2c72f7a5-8160-4024-94d8-e0995d547bb0}\InprocServer32\ThreadingModel = "Apartment" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9378167C-FAC6-4DFB-BD4F-F7C195D2B1E4}\1.0\0\win32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\t8res.dll\\1506" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{b4ea8204-ee81-4f73-a240-ec4aeb8ad3de}\InprocServer32\ThreadingModel = "Apartment" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e001b32e-5acb-4cce-9910-2d379ce0a6d6}\InprocServer32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E79601CE-6CB5-4A4C-A643-A9FEC2C136F5}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9A402FD-82C8-4743-991E-BC77E62DA0E5}\ProgID\ = "DictionaryBoss.HTMLMenu.1" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0270C2C5-40BD-4CFF-B0DF-79AD2E283AD3}\TypeLib\ = "{696D3B4F-71EF-41CC-96FF-342317E644DE}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE9F4D06-3A23-4F1A-902F-D9E113793576}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7448C04F-A2EC-43F8-B42C-49001A49A199}\ = "SKINWINDOW_INTERFACE" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\MiscStatus T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eb2049f6-9dfa-4e51-b2a1-fc5a6e596c80}\ProgID\ = "DictionaryBoss.HTMLPanel.1" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE17CD12-2988-47B4-86E3-640288DE42CB}\ = "IHttpControlEvents" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A525B28E-04EE-455F-8C17-3A0273EBEA2C}\1.0\0\win32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{934894D3-9DF1-4063-BE0B-4246762A87D8}\TypeLib\Version = "1.0" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{715321aa-a1fc-4058-8ffa-668d687b6e32}\ T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{715321aa-a1fc-4058-8ffa-668d687b6e32}\ProgID\ = "DictionaryBoss.Radio.1" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82481cff-738f-4410-bffb-77595d5d9faa}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SkinLauncherSettings T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}\1.0 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{08855E67-37D6-48CC-B59E-A010D658A7BB}\TypeLib\ = "{6C367B45-0824-419A-AF7F-157665B56ABA}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{19C920DF-88F9-44F8-A17E-A35A12D60525} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{317D0A60-985E-4C4D-BA9B-8D1026665EA9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{488c2712-1482-42ad-bc4d-681e5832f0c2}\TypeLib\ = "{d1479029-bacc-4c9a-8c15-d857a2974e27}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eb2049f6-9dfa-4e51-b2a1-fc5a6e596c80}\InprocServer32\ThreadingModel = "Apartment" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BECF6AB-82E3-4E58-9E73-78565FFE5C05}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9378167C-FAC6-4DFB-BD4F-F7C195D2B1E4}\1.0 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{806AADCB-C4D7-4545-954B-5E6C2952CE79}\ = "POPUPMENU_INTERFACE" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{715321aa-a1fc-4058-8ffa-668d687b6e32}\ProgID T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D43161C-85D1-460D-B835-342DEABD978D}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.XMLSessionPlugin\CLSID\ = "{6d0c6f55-e3eb-4d6b-8f52-996b4da196d9}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BD5AE73-FDA3-469B-9358-D4EDA7123370}\ = "ITemplateXMLElement" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C0CFCBE-D7E4-4778-8BFD-3A8D8B5A9CCD}\TypeLib\Version = "1.0" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73a7cce6-ff3a-4c7f-9a3e-db9bd92be292}\Control T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\MiscStatus\1 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{da08805b-ba32-426b-ad14-ecac8235a8aa}\Programmable T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73a7cce6-ff3a-4c7f-9a3e-db9bd92be292}\InprocServer32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\v4skin.dll" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{696D3B4F-71EF-41CC-96FF-342317E644DE}\1.0 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A436C6EC-9040-4322-AB62-BDB9E81E2F6C}\1.0\0\win32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\t8res.dll\\405" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{806AADCB-C4D7-4545-954B-5E6C2952CE79}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SettingsPlugin\CurVer\ = "DictionaryBoss.SettingsPlugin.1" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2499090-ACE6-48A0-ADD9-19FF13B69657}\1.0\ = "TEMPLATEHTMLMenuLib" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6d0c6f55-e3eb-4d6b-8f52-996b4da196d9}\InprocServer32 T8SETUP.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE 1948 T8SETUP.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1948 T8SETUP.EXE Token: SeBackupPrivilege 1948 T8SETUP.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2772 v4srchmn.exe 2176 v4brmon.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1848 wrote to memory of 1948 1848 4a5881510b389c117ceefd6ebd7ac781.exe 22 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2772 1948 T8SETUP.EXE 21 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 2576 1948 T8SETUP.EXE 20 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 3020 1948 T8SETUP.EXE 19 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2176 1948 T8SETUP.EXE 18 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17 PID 1948 wrote to memory of 2468 1948 T8SETUP.EXE 17
Processes
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exeC:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe1⤵
- Executes dropped EXE
PID:2992
-
C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4HighIn.exe"C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4HighIn.exe" v4tpinst.dll,#51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4brmon.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4brmon.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2176
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe" -install1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe" -remove1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4srchmn.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4srchmn.exe" /m=2 /w /h /r1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2772
-
C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE"C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE" /p=XQ/n="DictionaryBoss"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4a5881510b389c117ceefd6ebd7ac781.exe"C:\Users\Admin\AppData\Local\Temp\4a5881510b389c117ceefd6ebd7ac781.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848