Analysis
-
max time kernel
0s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
4a5881510b389c117ceefd6ebd7ac781.exe
Resource
win7-20231215-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a5881510b389c117ceefd6ebd7ac781.exe
Resource
win10v2004-20231222-en
8 signatures
150 seconds
General
-
Target
4a5881510b389c117ceefd6ebd7ac781.exe
-
Size
1.8MB
-
MD5
4a5881510b389c117ceefd6ebd7ac781
-
SHA1
3da55e46f30e773cb1be090c75105994c96c18b0
-
SHA256
e24e506c5f0e94aff89f5623a3d948aaaf9a1a511656793dc9937cfe04e36ba1
-
SHA512
c1f572d732687f45c7660753717de42b799f663f8aac5b1be0bc56c0118d6e09a0d5d579f3653960336f353fe38365f9f5c3d876a7d29d3c87ddf336125c1177
-
SSDEEP
49152:4uIwAxgmP8D9D2ufHU9XFg75oQcxwKFvCWqj9N9JLZ:4uZ99SsU9XidIwwS7bV
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1568 T8SETUP.EXE 3808 v4srchmn.exe 5100 v4barsvc.exe 3992 v4barsvc.exe -
Loads dropped DLL 7 IoCs
pid Process 1568 T8SETUP.EXE 1568 T8SETUP.EXE 1568 T8SETUP.EXE 1568 T8SETUP.EXE 1568 T8SETUP.EXE 3808 v4srchmn.exe 1568 T8SETUP.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DictionaryBoss Search Scope Monitor = "\"C:\\PROGRA~2\\DICTIO~1\\bar\\1.bin\\v4srchmn.exe\" /m=2 /w /h" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DictionaryBoss Browser Plugin Loader = "C:\\PROGRA~2\\DICTIO~1\\bar\\1.bin\\v4brmon.exe" T8SETUP.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4htmlmu.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4reghk.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4uabtn.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4bar.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skplay.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrcAs.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrchMn.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\CHROME.MANIFEST T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4bar.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4datact.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regfft.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4feedmg.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4html.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4uabtn.dll T8SETUP.EXE File opened for modification C:\Program Files\Internet Explorer\msimg32.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4radio.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skplay.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4barsvc.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4datact.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4idle.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4mlbtn.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4impipe.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4radio.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\INSTALL.RDF T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\LOGO.BMP T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4feedmg.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4impipe.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4sknlcr.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\NPv4Stub.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4Plugin.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4Plugin.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\T8RES.DLL T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4hkstub.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4medint.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skin.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4auxstb.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brstub.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4dlghk.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4hkstub.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrcAs.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brmon.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4brstub.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4skin.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4sknlcr.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\T8RES.DLL T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4SrchMn.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4tpinst.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4highin.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4highin.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4html.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4medint.exe T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4msg.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4msg.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regfft.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4reghk.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4barsvc.exe T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4dyn.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4idle.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4mlbtn.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regiet.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4script.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4ieovr.dll T8SETUP.EXE File created C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4ieovr.dll T8SETUP.EXE File opened for modification C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4regiet.dll T8SETUP.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\0\win32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\0\win32\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin\\t8res.dll\\626" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7D153B1-5602-41A4-A012-06165B4B0C53} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73A92446-8E2A-4B4D-8BFB-FA18F6B1C9A8} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\FLAGS T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\ = "ITemplateBarControl" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\TypeLib\Version = "1.0" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\ T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\InprocServer32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\MiscStatus\ = "0" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\VersionIndependentProgID\ = "DictionaryBoss.SettingsPlugin" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\TypeLib\Version = "1.0" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SettingsPlugin.1\ T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\Version T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{73A92446-8E2A-4B4D-8BFB-FA18F6B1C9A8}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SettingsPlugin\CLSID T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73A92446-8E2A-4B4D-8BFB-FA18F6B1C9A8}\TypeLib T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7D153B1-5602-41A4-A012-06165B4B0C53}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\TypeLib\Version = "1.0" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\ = "ITemplateBarMenu" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\HELPDIR T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A61E8B4-1D41-43FC-8237-AAAF8755317B}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\MiscStatus\1\ = "131473" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\Version\ = "1.0" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7D153B1-5602-41A4-A012-06165B4B0C53} T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\TypeLib T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\MiscStatus\1 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\ = "SEARCHSCOPE_INTERFACE" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\TypeLib T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3042df7a-e900-4389-9b94-923df0daa57e}\InprocServer32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ = "ITemplateBarButtonRect" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\TypeLib T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476C9DB6-2846-4507-A4FC-B95B9D84637C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\0 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7D153B1-5602-41A4-A012-06165B4B0C53}\ProxyStubClsid32 T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7D153B1-5602-41A4-A012-06165B4B0C53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73A92446-8E2A-4B4D-8BFB-FA18F6B1C9A8} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\FLAGS\ = "0" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8eb0aaa0-2ffe-4326-8331-efe2d5d15ec7}\TypeLib\ = "{1a033ae8-0d4d-4ec8-a4a9-47bbe0b6489b}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ProxyStubClsid32 T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{264E97DD-7AD7-442B-87A8-F9EC4819E47B} T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SettingsPlugin\ T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DictionaryBoss.SettingsPlugin\CurVer T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\DictionaryBoss\\bar\\1.bin" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF14F9E4-44C9-4CAB-88CE-A4E8221D0206}\ = "ITemplateBarButtonRect" T8SETUP.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73A92446-8E2A-4B4D-8BFB-FA18F6B1C9A8}\TypeLib\ = "{1A033AE8-0D4D-4EC8-A4A9-47BBE0B6489B}" T8SETUP.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3042df7a-e900-4389-9b94-923df0daa57e} T8SETUP.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3808 v4srchmn.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1568 1964 4a5881510b389c117ceefd6ebd7ac781.exe 28 PID 1964 wrote to memory of 1568 1964 4a5881510b389c117ceefd6ebd7ac781.exe 28 PID 1964 wrote to memory of 1568 1964 4a5881510b389c117ceefd6ebd7ac781.exe 28 PID 1568 wrote to memory of 3808 1568 T8SETUP.EXE 26 PID 1568 wrote to memory of 3808 1568 T8SETUP.EXE 26 PID 1568 wrote to memory of 3808 1568 T8SETUP.EXE 26 PID 1568 wrote to memory of 5100 1568 T8SETUP.EXE 25 PID 1568 wrote to memory of 5100 1568 T8SETUP.EXE 25 PID 1568 wrote to memory of 5100 1568 T8SETUP.EXE 25 PID 1568 wrote to memory of 3992 1568 T8SETUP.EXE 19 PID 1568 wrote to memory of 3992 1568 T8SETUP.EXE 19 PID 1568 wrote to memory of 3992 1568 T8SETUP.EXE 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5881510b389c117ceefd6ebd7ac781.exe"C:\Users\Admin\AppData\Local\Temp\4a5881510b389c117ceefd6ebd7ac781.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE"C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE" /p=XQ/n="DictionaryBoss"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568
-
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe" -install1⤵
- Executes dropped EXE
PID:3992
-
C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4HighIn.exe"C:\Program Files (x86)\DictionaryBoss\bar\1.bin\v4HighIn.exe" v4tpinst.dll,#51⤵PID:4560
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exeC:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe1⤵PID:1656
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4brmon.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4brmon.exe"1⤵PID:2328
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4barsvc.exe" -remove1⤵
- Executes dropped EXE
PID:5100
-
C:\PROGRA~2\DICTIO~1\bar\1.bin\v4srchmn.exe"C:\PROGRA~2\DICTIO~1\bar\1.bin\v4srchmn.exe" /m=2 /w /h /r1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3808