Overview
overview
7Static
static
758342456b7...0b.exe
windows7-x64
358342456b7...0b.exe
windows10-2004-x64
3$APPDATA/C...er.dll
windows7-x64
7$APPDATA/C...er.dll
windows10-2004-x64
7$APPDATA/C...TV.dll
windows7-x64
1$APPDATA/C...TV.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Communicate.dll
windows7-x64
1Communicate.dll
windows10-2004-x64
1MSINET.dll
windows7-x64
1MSINET.dll
windows10-2004-x64
1PSPMencoder.exe
windows7-x64
7PSPMencoder.exe
windows10-2004-x64
7QvodPlayer.exe
windows7-x64
QvodPlayer.exe
windows10-2004-x64
VnetClinfo.dll
windows7-x64
1VnetClinfo.dll
windows10-2004-x64
1comdlg32.dll
windows7-x64
1comdlg32.dll
windows10-2004-x64
1images/list.js
windows7-x64
1images/list.js
windows10-2004-x64
1mod/CCTVPlayer.dll
windows7-x64
7mod/CCTVPlayer.dll
windows10-2004-x64
7mod/CCTVUp...ll.dll
windows7-x64
7mod/CCTVUp...ll.dll
windows10-2004-x64
7mod/Reli_CCTV.dll
windows7-x64
1mod/Reli_CCTV.dll
windows10-2004-x64
1Analysis
- max time kernel
147s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
13/01/2024, 06:23
Behavioral task
behavioral1
Sample
58342456b7c97c3e03988c90778b610b.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
58342456b7c97c3e03988c90778b610b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$APPDATA/CCTV/tv/CCTVPlayer.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
$APPDATA/CCTV/tv/CCTVPlayer.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
$APPDATA/CCTV/tv/Reli_CCTV.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$APPDATA/CCTV/tv/Reli_CCTV.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Communicate.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Communicate.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
MSINET.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
MSINET.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
PSPMencoder.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral18
Sample
PSPMencoder.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
QvodPlayer.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
QvodPlayer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
VnetClinfo.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
VnetClinfo.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
comdlg32.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
comdlg32.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
images/list.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
images/list.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
mod/CCTVPlayer.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
mod/CCTVPlayer.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
mod/CCTVUpdateInstall.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
mod/CCTVUpdateInstall.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
mod/Reli_CCTV.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
mod/Reli_CCTV.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target PSPMencoder.exe
- Size 2.5MB
- Sample240113-g5stfaebc6
- SHA256 31405f0862472d9877ee66fc592c5d50e0ec5e44725831932593088202cca642
- MD5 8464394f47d1b2b00944b6bd75ba5226
- SHA1 b3b02c06403a64f9d360225f7923f1e19c00a539
- SHA512 f413ed1a2f966e9364138b30f23320e9d531d7926013352d70c7896bb4b8fe926b76ec7546fcf1a50e5068624012312b275d5067f3f44c82b8a406c17c029cfe
- SSDEEP 49152:SQQ99NtzK6mlE+t7U20LlzFAhVf+5XWV6lFO9RC4LcWoRCdUPjRUir:aD+dU20LlzFAhVW5XWQLO9RoRCdUPjRJ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Registers COM server for autorun 1 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod\\CCTVPL~1.OCX" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod\\CCTVUpdateInstall.dll" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod\\CCTVPL~1.OCX" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32 regsvr32.exe -
resource yara_rule behavioral18/memory/4540-84-0x0000000010000000-0x00000000100F0000-memory.dmp upx behavioral18/memory/3412-86-0x0000000004620000-0x0000000004710000-memory.dmp upx behavioral18/memory/4752-88-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral18/memory/3412-112-0x0000000004620000-0x0000000004710000-memory.dmp upx behavioral18/memory/3412-124-0x0000000004620000-0x0000000004710000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: PSPMencoder.exe File opened (read-only) \??\T: PSPMencoder.exe File opened (read-only) \??\J: PSPMencoder.exe File opened (read-only) \??\L: PSPMencoder.exe File opened (read-only) \??\S: PSPMencoder.exe File opened (read-only) \??\B: PSPMencoder.exe File opened (read-only) \??\K: PSPMencoder.exe File opened (read-only) \??\O: PSPMencoder.exe File opened (read-only) \??\P: PSPMencoder.exe File opened (read-only) \??\R: PSPMencoder.exe File opened (read-only) \??\U: PSPMencoder.exe File opened (read-only) \??\V: PSPMencoder.exe File opened (read-only) \??\X: PSPMencoder.exe File opened (read-only) \??\H: PSPMencoder.exe File opened (read-only) \??\E: PSPMencoder.exe File opened (read-only) \??\G: PSPMencoder.exe File opened (read-only) \??\I: PSPMencoder.exe File opened (read-only) \??\N: PSPMencoder.exe File opened (read-only) \??\Q: PSPMencoder.exe File opened (read-only) \??\W: PSPMencoder.exe File opened (read-only) \??\Y: PSPMencoder.exe File opened (read-only) \??\A: PSPMencoder.exe File opened (read-only) \??\Z: PSPMencoder.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3D0D36F-23F8-4682-A195-74C92B03D4AF}\InprocServer32 PSPMencoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA4B0970-69E9-4323-AB2F-DBB33BDA414E}\1.0\HELPDIR PSPMencoder.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod\\CCTVPL~1.OCX" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB303E8E-BCBC-4E76-BC72-8D3C16D2FF08}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VNETCL~1.OCX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8821A59B-A115-430B-9F0D-089DB4F8B7F3}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8821A59D-A115-430B-9F0D-089DB4F8B7F3}\TypeLib\ = "{8821A59B-A115-430B-9F0D-089DB4F8B7F3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\Preferences\DT_Codecs PSPMencoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}\1.1\HELPDIR regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\MiscStatus\1\ = "131473" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8821A59C-A115-430B-9F0D-089DB4F8B7F3}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\Insertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3E675CE-A02E-4F3C-95C3-74BBA404814D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNETCLINFO.VnetClinfoCtrl.1\CLSID\ = "{FB303E8E-BCBC-4E76-BC72-8D3C16D2FF08}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB303E8E-BCBC-4E76-BC72-8D3C16D2FF08}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8821A59C-A115-430b-9F0D-089DB4F8B7F3}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\Control regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Component Categories regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BA792F-F1A6-403D-9BFA-641703E7223F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BA792F-F1A6-403D-9BFA-641703E7223F}\ = "_DVnetClinfo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6FB6E89-628F-4597-A52B-0AADBE5713CA}\1.0\0 PSPMencoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\ATLDownLoadProgressBar.DownLoadProgressBar.1\CLSID\ = "{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8821A59C-A115-430b-9F0D-089DB4F8B7F3}\ProgID\ = "HZP.ReliPlayer.CCTV.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLDownLoadProgressBar.DownLoadProgressBar\ = "CCTVUpdateInstall" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8821A59D-A115-430B-9F0D-089DB4F8B7F3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3E675CE-A02E-4F3C-95C3-74BBA404814D}\ = "_DVnetClinfoEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KOOPLAYER.CCTVPlayerCtrl.1\CLSID regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8821A59C-A115-430b-9F0D-089DB4F8B7F3} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod\\CCTVPL~1.OCX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B5BEEE2-1E16-4DE5-B69E-603581B6C018}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QvodInsert.oca" PSPMencoder.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ = "KooPlayer Control" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{432F118C-DB79-4561-9799-CC95EA78208B} PSPMencoder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KOOPLAYER.CCTVPlayerCtrl.1\CLSID\ = "{C728DAB8-FDF5-4CD7-89DD-879D25794C77}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8821A59D-A115-430B-9F0D-089DB4F8B7F3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib\ = "{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNETCLINFO.VnetClinfoCtrl.1\Insertable\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B5BEEE2-1E16-4DE5-B69E-603581B6C018}\1.0\0 PSPMencoder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ = "KooPlayer Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C728DAB8-FDF5-4CD7-89DD-879D25794C77}\ProgID\ = "KOOPLAYER.CCTVPlayerCtrl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HZP.ReliPlayer.CCTV.1\CLSID\ = "{8821A59C-A115-430b-9F0D-089DB4F8B7F3}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\TypeLib\{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mod" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{38943A5A-33BB-4D28-909A-BF52B994D26A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B5BEEE2-1E16-4DE5-B69E-603581B6C018}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" PSPMencoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8821A59B-A115-430B-9F0D-089DB4F8B7F3}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\TypeLib\ = "{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Interface\{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}\ = "_DKooPlayerEvents" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\CLSID\{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}\Insertable regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\WOW6432Node\Interface\{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80F1D1E4-9D20-4501-B0F1-196A6B302060}\ = "_DKooPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8821A59C-A115-430b-9F0D-089DB4F8B7F3}\InprocServer32 regsvr32.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 3412 PSPMencoder.exe Token: SeCreatePagefilePrivilege 3412 PSPMencoder.exe Token: SeShutdownPrivilege 3412 PSPMencoder.exe Token: SeCreatePagefilePrivilege 3412 PSPMencoder.exe Token: SeShutdownPrivilege 3412 PSPMencoder.exe Token: SeCreatePagefilePrivilege 3412 PSPMencoder.exe Token: SeShutdownPrivilege 3412 PSPMencoder.exe Token: SeCreatePagefilePrivilege 3412 PSPMencoder.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3412 PSPMencoder.exe 3412 PSPMencoder.exe - Suspicious use of SetWindowsHookEx 27 IoCs
pid Process 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe 3412 PSPMencoder.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1060 3412 PSPMencoder.exe 90 PID 3412 wrote to memory of 1060 3412 PSPMencoder.exe 90 PID 3412 wrote to memory of 1060 3412 PSPMencoder.exe 90 PID 3412 wrote to memory of 2296 3412 PSPMencoder.exe 92 PID 3412 wrote to memory of 2296 3412 PSPMencoder.exe 92 PID 3412 wrote to memory of 2296 3412 PSPMencoder.exe 92 PID 3412 wrote to memory of 1388 3412 PSPMencoder.exe 93 PID 3412 wrote to memory of 1388 3412 PSPMencoder.exe 93 PID 3412 wrote to memory of 1388 3412 PSPMencoder.exe 93 PID 3412 wrote to memory of 1252 3412 PSPMencoder.exe 94 PID 3412 wrote to memory of 1252 3412 PSPMencoder.exe 94 PID 3412 wrote to memory of 1252 3412 PSPMencoder.exe 94 PID 3412 wrote to memory of 4736 3412 PSPMencoder.exe 95 PID 3412 wrote to memory of 4736 3412 PSPMencoder.exe 95 PID 3412 wrote to memory of 4736 3412 PSPMencoder.exe 95 PID 4736 wrote to memory of 4704 4736 cmd.exe 100 PID 4736 wrote to memory of 4704 4736 cmd.exe 100 PID 4736 wrote to memory of 4704 4736 cmd.exe 100 PID 1252 wrote to memory of 4540 1252 cmd.exe 99 PID 1252 wrote to memory of 4540 1252 cmd.exe 99 PID 1252 wrote to memory of 4540 1252 cmd.exe 99 PID 1388 wrote to memory of 4752 1388 cmd.exe 101 PID 1388 wrote to memory of 4752 1388 cmd.exe 101 PID 1388 wrote to memory of 4752 1388 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\PSPMencoder.exe"C:\Users\Admin\AppData\Local\Temp\PSPMencoder.exe"1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\Temp\QvodInsert.dll" /s2⤵PID:1060
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\Temp\VnetClinfo.ocx" /s2⤵
- Modifies registry class
PID:2296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regtvdllCCTVUpdateInstall.dll.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\Temp\mod\CCTVUpdateInstall.dll" /s3⤵
- Registers COM server for autorun
- Modifies registry class
PID:4752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regtvdllCCTVPlayer.ocx.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\Temp\mod\CCTVPlayer.ocx" /s3⤵
- Registers COM server for autorun
- Modifies registry class
PID:4540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regtvdllReli_CCTV.dll.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\Temp\mod\Reli_CCTV.dll" /s3⤵
- Modifies registry class
PID:4704
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\QvodCfg.ini
- Size 292B
- SHA256 b315b489492b336207dea7f9a956d1da68405ddac8f5e0b81b14d5dead1e1f29
- MD5 a671d3d075bd4fb6e24efbd2ff6b984a
- SHA1 ec6cc7b141cdd5cd45a198dd20878f8038364040
- SHA512 bc194acfd64d274febee0d6876544c3a3ee759f84ecc0c4b098d1a88d2e26405f6c4d19d320b7ca63ff94f1e07e798eabbfbc3bebcf38489599c9b60207a56b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\config.dll
- Size 185B
- SHA256 207ccf7b56f8a780d2cc2b744d32e52fdd4ce6074ca94ad4153160469f7e99ad
- MD5 3a03fd02ec2c4a8594040d25e1234ec2
- SHA1 41c9dbc98f14f04bd88b2149d615f96758bbddb1
- SHA512 a5a3d4c8de44eb81fbf4d036809b12318f919a3941d9e99f8e8d7406c4eb4874deb274905a8d20cbf44c64b27e0b2d822cdde661e9ea88933c889e5c9e5e9461
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\regtvdllCCTVPlayer.ocx.bat
- Size 122B
- SHA256 cdc0acafbe9318790cc423af79b78dbe1312566177f7968f193f0538948ed31d
- MD5 c444d18db692685402218008375621d5
- SHA1 16df7100180f98f284f7e1e03b12ad2acd67bfbe
- SHA512 7ad2265cfb2995c738652accc6e4a52ca1b8360594e54687a01972954f6179ff7228ab1ab075387b7b2b14780b7b58235312288b39b781031a87e614ff5f4784
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\regtvdllCCTVUpdateInstall.dll.bat
- Size 136B
- SHA256 f049fa2c8465660a3b10db1ecb6bc9e0d2aaa1e5176ee2b90e1ac6fc1a561a75
- MD5 093157afd2189f85f6ff43f1c7d346f7
- SHA1 fa3bf14e8815b35ce8e7ee82d3007f06321c2b5e
- SHA512 df5b31570160516330f6a553dbe69ebb496107df6efa0023baa3f019fad7f5cd6da66c5a80116adbd344e3068086eba6068793c5309a1ee59b4c5306bb6ba62a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\regtvdllReli_CCTV.dll.bat
- Size 120B
- SHA256 414e23a013713aadcc561d23d04f62c95b8f74c47fef2cdd6e1c67baae4db06f
- MD5 a3b3e0b89cf93ff854bac31c0f5dd47e
- SHA1 0d92e673cc424d60eab529d8af01148fb106825b
- SHA512 d98f8826f43a1642c23110b2c21538a145ae2ce54379deb6f55c2a291a3726337c48b519631dee7904be7810e08d21f7d3434024cda1bb1220997ec397583c61
- MD5 SHA1 SHA512