Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
15/02/2024, 19:58
Behavioral task
behavioral1
Sample
9e708c65193d624e6738f6b4d635f75a.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
General
- Target 9e708c65193d624e6738f6b4d635f75a.exe
- Size 97KB
- Sample240215-yp4pfafb8t
- SHA256 d4661f6e03b9911d223fbbb1eb7a36c3712988a98806b9bf53bc379e76d7257d
- MD5 9e708c65193d624e6738f6b4d635f75a
- SHA1 107d18e28e9a897e33d6542d840a38bc67773409
- SHA512 273362ca3d0ddbab93068f063aacb7ca7f665912c8858b4aab5a9452229f80a06cdf6732cdbecc4fb421828424c123aa77882db6d5e1c7fea0eff845247b7687
- SSDEEP 1536:EFOVOeEccdncvtROZffNjVMAczNeCt5cEbjZOGspfxwj6zJ0E:EFc+c1kNF5czNDwEb9sRxwuz+E
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation wscript.exe - Executes dropped EXE 3 IoCs
pid Process 1184 info2asp.exe 1128 iePlayer.exe 4740 Update.exe - Loads dropped DLL 1 IoCs
pid Process 1136 regsvr32.exe -
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/4968-20-0x0000000000400000-0x0000000000452000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "bhoRay2009 Class" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\NoExplorer = "1" regsvr32.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\baidu\info2asp.exe 9e708c65193d624e6738f6b4d635f75a.exe File created C:\Windows\baidu\ATLcom.dll 9e708c65193d624e6738f6b4d635f75a.exe File created C:\Windows\baidu\shortcut.js 9e708c65193d624e6738f6b4d635f75a.exe File created C:\Windows\baidu\iePlayer.exe 9e708c65193d624e6738f6b4d635f75a.exe File created C:\Windows\baidu\Update.exe 9e708c65193d624e6738f6b4d635f75a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
pid pid_target Process procid_target 4916 1184 WerFault.exe 84 3428 1128 WerFault.exe 89 1668 1128 WerFault.exe 89 - Modifies registry class 50 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ATLcom.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer\ = "ATLcom.bhoRay2009.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ = "IbhoRay2009" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9}\ = "ATLcom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\CLSID\ = "{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\VersionIndependentProgID\ = "ATLcom.bhoRay2009" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ = "bhoRay2009 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID\ = "{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ = "IbhoRay2009" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\ = "bhoRay2009 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\ = "ATLcom 1.0 ÀàÐÍ¿â" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\ = "bhoRay2009 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ATLcom.DLL\AppID = "{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\ProgID\ = "ATLcom.bhoRay2009.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DDD096FC-ADD6-4914-BCF7-4976E7BC66C9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\HELPDIR\ = "C:\\Windows\\baidu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B05CB5FE-1E22-43C7-93E2-4CF04C87B3CC}\InprocServer32\ = "C:\\Windows\\baidu\\ATLcom.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}\1.0\0\win32\ = "C:\\Windows\\baidu\\ATLcom.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLcom.bhoRay2009\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64C80684-8B59-459F-BFCA-356E28D79688}\TypeLib\ = "{B4ADFB5F-F6D4-4D00-A88E-B785E2BD2391}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64C80684-8B59-459F-BFCA-356E28D79688} regsvr32.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4968 wrote to memory of 1184 4968 9e708c65193d624e6738f6b4d635f75a.exe 84 PID 4968 wrote to memory of 1184 4968 9e708c65193d624e6738f6b4d635f75a.exe 84 PID 4968 wrote to memory of 1184 4968 9e708c65193d624e6738f6b4d635f75a.exe 84 PID 4968 wrote to memory of 4936 4968 9e708c65193d624e6738f6b4d635f75a.exe 88 PID 4968 wrote to memory of 4936 4968 9e708c65193d624e6738f6b4d635f75a.exe 88 PID 4968 wrote to memory of 4936 4968 9e708c65193d624e6738f6b4d635f75a.exe 88 PID 4968 wrote to memory of 1128 4968 9e708c65193d624e6738f6b4d635f75a.exe 89 PID 4968 wrote to memory of 1128 4968 9e708c65193d624e6738f6b4d635f75a.exe 89 PID 4968 wrote to memory of 1128 4968 9e708c65193d624e6738f6b4d635f75a.exe 89 PID 4936 wrote to memory of 1136 4936 wscript.exe 92 PID 4936 wrote to memory of 1136 4936 wscript.exe 92 PID 4936 wrote to memory of 1136 4936 wscript.exe 92 PID 4968 wrote to memory of 4740 4968 9e708c65193d624e6738f6b4d635f75a.exe 96 PID 4968 wrote to memory of 4740 4968 9e708c65193d624e6738f6b4d635f75a.exe 96 PID 4968 wrote to memory of 4740 4968 9e708c65193d624e6738f6b4d635f75a.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e708c65193d624e6738f6b4d635f75a.exe"C:\Users\Admin\AppData\Local\Temp\9e708c65193d624e6738f6b4d635f75a.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\baidu\info2asp.exeC:\Windows\baidu\info2asp.exe 0ECF425C63BA9ACDBA47BEF4ED729441538E3FFAE506BF8685FFA52FE21D7A64C3D0EA41F36DD2340A8740734E44CE417ADC55E55E2⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 5283⤵
- Program crash
PID:4916
-
-
-
C:\Windows\SysWOW64\wscript.exewscript.exe C:\Windows\baidu\shortcut.js //B2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\baidu\ATLcom.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1136
-
-
-
C:\Windows\baidu\iePlayer.exeC:\Windows\baidu\iePlayer.exe 0ECF425C63BA9ACDBA47BEF4ED729441538E3FFAE506BF8685FFA52FE21D7A64C3D0EA41F36DD2340A8740734E44CE417ADC55E55E2⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 4443⤵
- Program crash
PID:3428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 4443⤵
- Program crash
PID:1668
-
-
-
C:\Windows\baidu\Update.exeC:\Windows\baidu\Update.exe 0ECF425C63BA9ACDBA47BEF4ED729441538E3FFAE506BF8685FFA52FE21D7A64C3D0EA41F36DD2340A8740734E44CE417ADC55E55E2⤵
- Executes dropped EXE
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1184 -ip 11841⤵PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1128 -ip 11281⤵PID:4952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1128 -ip 11281⤵PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\baidu\ATLcom.dll
- Size 90KB
- SHA256 1e8febc754066269b7c5f22388f4d3b7b4a7a70d382a8ae6f5daffe35ebb014b
- MD5 8d8afbdd1977f3c5dc12775e56b7c319
- SHA1 44cc86024bccaa91e29936623696594befb0a025
- SHA512 d669ac2137daaeedc64cbb8c4817a9c02ba3d57f2db3e82ebaea6c12c7e55cb6d2db47ca488338da065af517c5a1b27ba4fd4da41805ebc219e2f4053d6693d6
- SSDEEP 1536:BDJKnlBhvUw0r3mdPUAklrZkgENtu67sPJmH+5fk4KY:BD2lLUjr3mBUhlrN67sPAe5fk4KY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\baidu\Update.exe
- Size 57KB
- SHA256 d1e609355222a3985ff0dd2fb8989e8be74032e4a6ea2d82592525116dbfbd6b
- MD5 e4c0db0561f859b0614d2dc8119e6ef7
- SHA1 d2749a469f5eb70dbd2247ab09393377706974bf
- SHA512 1b0e738e7436b798760c46d5422330909914e835bb6ae9611cbd6b861f8f8f4996a3c4e7c86e88448fca954920d27e310b665d80c6f0907e770a4d69de482966
- SSDEEP 1536:7LNdhMLxpd6QhNolfCoiqHkmLK1/w5jn:H7GLxrDGfZmw5z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\baidu\iePlayer.exe
- Size 64KB
- SHA256 f846d5eb0aa0c5bb648f0167ccde1cb2e882cafbb5f2a3737b7879a9c2b07505
- MD5 bcd7327919f9a78aeb5ea8e62705cb6d
- SHA1 1dcb15d024e634063ee2b05f15af59589b16ffff
- SHA512 f2b71ab5e1666882d9d8a640f81f9625ee95903278a2254697457d3cd2f4a6aaa490f77a06632d71658ffc37180b7b0a9e1dbc7ef33a2ec007f2464212af8e9b
- SSDEEP 768:ajyJko/mP5gUIIUx0ojyL0jcQQw+Y/aQhAr01bN/M/oJW5J9YKANX:ajyJR/ocCLgcPw+YZAyoP5Prq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\baidu\info2asp.exe
- Size 41KB
- SHA256 d1558f21145f2b285a56cd926d39c9dca03fe32657b54c6467b42e443e5217cb
- MD5 1000b47ffbae539166a0e996216ebb36
- SHA1 0803068acac00e9339fc1bcc4d2dca9752045f56
- SHA512 2e80199bf91bb3d29b21ca4d920e04f5bf212d887314326a072e62d8e8686ff8b4eb9923c6fb4ccb10d9ccd1906bda5c5018b553b480d12bc8c6bcc27a0ed5bb
- SSDEEP 768:bjqxE9NLLLs9YoVbTJxBaIUcw3RY8P6FsLIC6R30X4c:bjqxEfLoGo9z1w3RUbRJc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\baidu\shortcut.js
- Size 1KB
- SHA256 07e61ebf29c13a0ff3c17b491c2c2550baf1e9ba894b19e880cfa8b660f2bf7a
- MD5 c7ea49bd0568bf89f387f6c5b45163ec
- SHA1 6d694978c5c523ff460e890c6ea2aab43d8f615e
- SHA512 efd72c2f7c587e2fb2259e1864e47f528e9239453f4233383ac9a5f6205abed42313dc0c4fde8bc0cf686f3e94f14221a910e774194232ad31f4afef44d266b9
- MD5 SHA1 SHA512