Overview
overview
7Static
static
7PPNTV_V4.0_Setup.exe
windows7-x64
7PPNTV_V4.0_Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$SYSDIR/Fo...TV.dll
windows7-x64
1$SYSDIR/Fo...TV.dll
windows10-2004-x64
1$SYSDIR/KCharUtil.dll
windows7-x64
3$SYSDIR/KCharUtil.dll
windows10-2004-x64
3$SYSDIR/KN...nt.dll
windows7-x64
1$SYSDIR/KN...nt.dll
windows10-2004-x64
1$SYSDIR/KTxtLog.dll
windows7-x64
1$SYSDIR/KTxtLog.dll
windows10-2004-x64
3$SYSDIR/UC...re.dll
windows7-x64
3$SYSDIR/UC...re.dll
windows10-2004-x64
3$SYSDIR/UC...rl.dll
windows7-x64
1$SYSDIR/UC...rl.dll
windows10-2004-x64
1$SYSDIR/UC...et.dll
windows7-x64
1$SYSDIR/UC...et.dll
windows10-2004-x64
3$SYSDIR/forcetv.dll
windows7-x64
1$SYSDIR/forcetv.dll
windows10-2004-x64
1$SYSDIR/p2pgrid.dll
windows7-x64
1$SYSDIR/p2pgrid.dll
windows10-2004-x64
1$SYSDIR/ppshell.exe
windows7-x64
1$SYSDIR/ppshell.exe
windows10-2004-x64
1$WINDIR/Fo...TV.dll
windows7-x64
1$WINDIR/Fo...TV.dll
windows10-2004-x64
1$WINDIR/KN...nt.dll
windows7-x64
1$WINDIR/KN...nt.dll
windows10-2004-x64
1$WINDIR/KTxtLog.dll
windows7-x64
1$WINDIR/KTxtLog.dll
windows10-2004-x64
3$WINDIR/forcetv.dll
windows7-x64
1$WINDIR/forcetv.dll
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/03/2024, 06:49
Behavioral task
behavioral1
Sample
PPNTV_V4.0_Setup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
PPNTV_V4.0_Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$SYSDIR/ForceGridTV.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
$SYSDIR/ForceGridTV.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$SYSDIR/KCharUtil.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$SYSDIR/KCharUtil.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$SYSDIR/KNetClient.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$SYSDIR/KNetClient.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/KTxtLog.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/KTxtLog.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$SYSDIR/UCLiveCore.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$SYSDIR/UCLiveCore.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$SYSDIR/UCLiveCtrl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$SYSDIR/UCLiveCtrl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$SYSDIR/UCLiveSocket.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
$SYSDIR/UCLiveSocket.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$SYSDIR/forcetv.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
$SYSDIR/forcetv.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$SYSDIR/p2pgrid.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
$SYSDIR/p2pgrid.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$SYSDIR/ppshell.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
$SYSDIR/ppshell.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$WINDIR/ForceGridTV.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral26
Sample
$WINDIR/ForceGridTV.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$WINDIR/KNetClient.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral28
Sample
$WINDIR/KNetClient.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$WINDIR/KTxtLog.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
$WINDIR/KTxtLog.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$WINDIR/forcetv.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
$WINDIR/forcetv.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target $SYSDIR/ppshell.exe
- Size 312KB
- Sample240304-hll28acd21
- SHA256 216bd1bceb7373dc830c8ba519bde636a42e345fcf87b6e069d8d10ad41421a3
- MD5 f83b75eed7333d314dfad747a363e975
- SHA1 f919bc23ab84ec93c1d1e0005a3b09f7e1ccc0d2
- SHA512 d97e55af5d605c1b430d2ef84fd699b96ae6ab954c4f11d46059885d5fd3f5d2b3452dff9fe7e2fa7fba456d5318852b892289bdbe594338db14dbdad04f2dc0
- SSDEEP 6144:9edx/owg4Q65pf98KCnFkOt/0fBBkZKdmLc9zxt68+sNb1EPI:9wfQ+f98KCFH0fBBkZsmLc9zxt68+mEw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565} ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403} ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\p2pgrid.DLL\AppID = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\Version\ = "1.0" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ProxyStubClsid32 ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\TypeLib ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\0\win32 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\p2pgrid.dll" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject\CLSID ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\VersionIndependentProgID ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\MiscStatus\ = "0" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\HELPDIR ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80} ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\TypeLib ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\TypeLib\Version = "1.0" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject.1 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject\ = "CP2PGridObject Object" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\MiscStatus\1 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject.1\CLSID\ = "{AF4DC364-85B1-48F7-A3CD-AB232A834565}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\p2pgrid.dll" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\0 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\HELPDIR\ ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\TypeLib\Version = "1.0" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\ProgID\ = "p2pgrid.P2PGridObject.1" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\VersionIndependentProgID\ = "p2pgrid.P2PGridObject" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\p2pgrid.dll, 1" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\MiscStatus\1\ = "131473" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\TypeLib\ = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\ = "_IP2PGridObjectEvents" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\TypeLib\Version = "1.0" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject\CLSID\ = "{AF4DC364-85B1-48F7-A3CD-AB232A834565}" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\TypeLib ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\ = "p2pgrid" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject.1\ = "CP2PGridObject Object" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\ProgID ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\FLAGS ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A} ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\TypeLib\ = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ProxyStubClsid32 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\TypeLib\ = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\p2pgrid.DLL ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\Control ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\ = "_IP2PGridObjectEvents" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\TypeLib\ = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ = "IP2PGridObject" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject.1\CLSID ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\ToolboxBitmap32 ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\Version ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80} ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\TypeLib\ = "{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2pgrid.P2PGridObject\CurVer\ = "p2pgrid.P2PGridObject.1" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DEF1725-BE14-4723-823E-7C7724386E80}\ProxyStubClsid32 ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\InprocServer32 ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\InprocServer32\ThreadingModel = "apartment" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A} ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0\ = "p2pgrid 1.0 ÀàÐÍ¿â" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C643C89A-18DB-4B02-A219-04C3F44DC403}\ = "IP2PGridObject" ppshell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF4DC364-85B1-48F7-A3CD-AB232A834565}\ = "CP2PGridObject Object" ppshell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B6D3D22-FF18-4F77-AFE8-E4D40A792A3A}\1.0 ppshell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4968 ppshell.exe 4968 ppshell.exe