a0ce70b53ce4acac01772a7a237a8f30ba0b000aa4995e3e761c0a9f17a502d5

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PPVod/PPVod.exe
Size

352KB
MD5

5f06d6d9dd032ce8ede4c50f12d53d22
SHA1

6cb34bfa697717b9cbe957bccdd7017c5c5137be
SHA256

598b23fb3f462d72c5211e1fcbb996b2864601e52829a77c84c0401e93571b5f
SHA512

bcc10150c0a8223e431751eb9e7b130a52290b47fb2c9d93fd98a202139445adb1b63da835212f41d7d8fe6ba23c119380ab898ce7cac7871aaae04d472eb416
SSDEEP

6144:l7XjNlgUoyXplLIA1y7xK64zeyG91xQ3cpKAkV5H:ZXJboyZn1eg64zo1xQuK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	884	WerFault.exe	27

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\shell\open	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PPVod\\PPVod.exe\" -qvodurl \"%1\""	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\shell	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PPVod\\PPVod.exe\" -qvodurl \"%1\""	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\shell	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK\6.0\Preferences\ServerTimeOut\ = "300"	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PPVod\\PPVod.exe,0"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\shell	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\shell\open	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0\Preferences	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0\Preferences\DistCode\ = "R31CND_QVOD"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\shell\open\command	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell\open\command	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK\6.0\Preferences\ConnectionTimeout\ = "300"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\shell\open\command	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.!tv\ = "Î´Íê³ÉQVODÏÂÔØÎÄ¼þ"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealPlayer\6.0\Preferences\DistCode	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0\Preferences\DistCode	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\ = "URL:QVOD Protocol"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.!tv	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\ConnectionTimeout	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK\6.0	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\URL Protocol	PPVod.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\ServerTimeOut	PPVod.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\ConnectionTimeout	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\ = "Qvodbt File"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PPVod\\PPVod.exe\" -btfile \"%1\""	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mem	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\ = "ÊµÊ±Á÷Ð\u00adÒé"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\Content Type = "application/x-bittorrent"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\shell\open	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mem\ = "QVODÏÂÔØ½ø¶ÈÎÄ¼þ"	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK\6.0\Preferences\ConnectionTimeout	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\ServerTimeOut	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\DefaultIcon	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\shell\open\command	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bt\ = "Î´Íê³ÉµÄBTÏÂÔØÎÄ¼þ"	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.torrent\ = "Qvodbt"	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\shell\ = "open"	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QVOD\URL Protocol	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\shell\open	PPVod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Qvodbt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PPVod\\PPVod.exe\" -btfile \"%1\""	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bt	PPVod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealMediaSDK\6.0\Preferences	PPVod.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
884	PPVod.exe
884	PPVod.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2628	884	PPVod.exe	29
PID 884 wrote to memory of 2628	884	PPVod.exe	29
PID 884 wrote to memory of 2628	884	PPVod.exe	29
PID 884 wrote to memory of 2628	884	PPVod.exe	29

C:\Users\Admin\AppData\Local\Temp\PPVod\PPVod.exe
"C:\Users\Admin\AppData\Local\Temp\PPVod\PPVod.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 924
  2⤵
  - Program crash
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-0-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/884-1-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads