Overview
overview
10Static
static
7GongShaFuZ...ll.dll
windows7-x64
1GongShaFuZ...ll.dll
windows10-2004-x64
1GongShaFuZ...LE.dll
windows7-x64
1GongShaFuZ...LE.dll
windows10-2004-x64
3GongShaFuZ...SG.dll
windows7-x64
1GongShaFuZ...SG.dll
windows10-2004-x64
3GongShaFuZ...AD.dll
windows7-x64
1GongShaFuZ...AD.dll
windows10-2004-x64
1GongShaFuZ...LL.dll
windows7-x64
1GongShaFuZ...LL.dll
windows10-2004-x64
1GongShaFuZ...OU.dll
windows7-x64
7GongShaFuZ...OU.dll
windows10-2004-x64
7GongShaFuZ...ER.dll
windows7-x64
1GongShaFuZ...ER.dll
windows10-2004-x64
1GongShaFuZ...ON.dll
windows7-x64
1GongShaFuZ...ON.dll
windows10-2004-x64
1GongShaFuZ...OW.dll
windows7-x64
1GongShaFuZ...OW.dll
windows10-2004-x64
3GongShaFuZ...ll.dll
windows7-x64
10GongShaFuZ...ll.dll
windows10-2004-x64
10GongShaFuZ...dm.dll
windows7-x64
10GongShaFuZ...dm.dll
windows10-2004-x64
10GongShaFuZ...lp.doc
windows7-x64
4GongShaFuZ...lp.doc
windows10-2004-x64
1GongShaFuZ....3.exe
windows7-x64
1GongShaFuZ....3.exe
windows10-2004-x64
1GongShaFuZ...er.exe
windows7-x64
1GongShaFuZ...er.exe
windows10-2004-x64
3GongShaFuZ...��.url
windows7-x64
1GongShaFuZ...��.url
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 09:55
Behavioral task
behavioral1
Sample
GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
GongShaFuZhu13/游迅网.url
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
GongShaFuZhu13/游迅网.url
Resource
win10v2004-20231215-en
General
-
Target
GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
-
Size
84KB
-
MD5
a2d61eff3148f2c70404927c0146306e
-
SHA1
cd9f8247d726a9b437a49a5824dbad9b1a6928a7
-
SHA256
7f5183494801b0b4314fe387589b7d5d41e03025dff3dde70f7c7e09723ef5c1
-
SHA512
d2eff12a8baa1911ec2f28c43243afb7fcbbe3e6cdeb799364db95089fd370dc8f30b49c7ea3eb81ae4b846e29860428a84c96497ecdb1f5f928200605fc5e00
-
SSDEEP
1536:I2FWCT03n3KYFcZvi5/0LI6LdEavoWZpEkt/Edm50E:lFWCT03n3KyyqmJFbpEOE0C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2044 regsvr32Srv.exe 2516 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 3048 regsvr32.exe 2044 regsvr32Srv.exe -
resource yara_rule behavioral19/memory/2044-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral19/memory/2516-19-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral19/memory/3048-3-0x0000000000130000-0x000000000015E000-memory.dmp upx behavioral19/files/0x000a000000014825-1.dat upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32Srv.exe regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px1A83.tmp regsvr32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411042422" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{698C4CC1-AF9E-11EE-8221-D669B05BD432} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\CLSID\ = "{34531331-126E-4FC8-B430-1C6143484AA9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GongShaFuZhu13\\?x1?????\\xgs\\RegDll.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\ = "QMPlugin.RegDll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ = "QMPlugin.RegDll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMPlugin.RegDll\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\ProgID\ = "QMPlugin.RegDll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{34531331-126E-4FC8-B430-1C6143484AA9}\InprocServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2516 DesktopLayer.exe 2516 DesktopLayer.exe 2516 DesktopLayer.exe 2516 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2920 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2920 iexplore.exe 2920 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 2004 wrote to memory of 3048 2004 regsvr32.exe 16 PID 3048 wrote to memory of 2044 3048 regsvr32.exe 20 PID 3048 wrote to memory of 2044 3048 regsvr32.exe 20 PID 3048 wrote to memory of 2044 3048 regsvr32.exe 20 PID 3048 wrote to memory of 2044 3048 regsvr32.exe 20 PID 2044 wrote to memory of 2516 2044 regsvr32Srv.exe 19 PID 2044 wrote to memory of 2516 2044 regsvr32Srv.exe 19 PID 2044 wrote to memory of 2516 2044 regsvr32Srv.exe 19 PID 2044 wrote to memory of 2516 2044 regsvr32Srv.exe 19 PID 2516 wrote to memory of 2920 2516 DesktopLayer.exe 18 PID 2516 wrote to memory of 2920 2516 DesktopLayer.exe 18 PID 2516 wrote to memory of 2920 2516 DesktopLayer.exe 18 PID 2516 wrote to memory of 2920 2516 DesktopLayer.exe 18 PID 2920 wrote to memory of 2576 2920 iexplore.exe 17 PID 2920 wrote to memory of 2576 2920 iexplore.exe 17 PID 2920 wrote to memory of 2576 2920 iexplore.exe 17 PID 2920 wrote to memory of 2576 2920 iexplore.exe 17
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\xgs\RegDll.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\xgs\RegDll.dll2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\regsvr32Srv.exeC:\Windows\SysWOW64\regsvr32Srv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2044
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564ed7951d2c255471b578aabbbdce08a
SHA1bcc008f6649c723a6a1bc0a471a31c2cfac7ee14
SHA2569d805a094a5ec2ae1b5e9e4196cacdb7957c65f7d2a91c086882e84ab4da379a
SHA512680e8936be7302fe257d5df3f4f82e7e86561313bc53834c5e73b8741d0b509c922157c22d9eb884fd4bcb09e75b6056e800964e0c07ace3c44e6e7a1fafb60e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd668aac2d3575d13387853d811624e9
SHA189bd64ce02ef78f45f5068d42d8fa0e3f6239011
SHA256ddd50ce6d0869c2dd0661719ffc09d6692122dc3fa4e2be802356db021b75d5f
SHA512c936354234ea38d60b783fa58557b3bb5db16891257ec36b39fa9e8deef9707bada47a3b19897dada9a6560acaeb4d944da97c88132c20deae4df8953ae117a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a994a77e4295157344c8a96b49fb702
SHA1f4ff49a8eb7abea0850143bc5d10f4db4c220a7c
SHA25638290ac2807bdd5e16efe8d794e88a8bf811dfc0b1b6a26d93b39a73bddcc548
SHA51228238ef074c5f405bad84d53d381324b94593521d32b55dff1f3689f0818fce793b90a9b7dcbfd7988b10914eac79b47743f05137fbe88c2f189a24fbeb06ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53be53307867b8428dc487cbca920cdb8
SHA19b498b5b9ed3fa4271d78ba396bcee850f52169d
SHA256a4ba765d464bee0417fc708fe5a284fe00a20163537ae68ae1870b0ec142880c
SHA5128b99a7eaffb90ebf79d8e015014fa10bff9cad0b4151b0e22878d062cafdec2e44d5d1b05106b9261b5440434748d1d9afa8e565d11924370bf3ca969c4b9899