f13ee983f7b7f9f30fc383b1923438dec4915dbed94d829e267d2940edca09c7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

精易编程助手.exe
Size

671KB
MD5

d0b2287a0ba3c3810f64c6e212f1ca62
SHA1

286a74915d26ed5773cb57d03dd6623906c22260
SHA256

a66d9b8ee0032354d971519d97f16a46224d580d11e025cc1b4b48085c050612
SHA512

3a797007fae207a5593e1f365b6c83e03268866e4a8d33bcc04489dc6991a69051ddf894da233e5bff94aa9b825d81f4c324123049e885f527a044a17c3ca0e8
SSDEEP

12288:DfhdYgJ+rqbNiynQgp20G0msmGXSRoDFgQXBLXyblGp/SmfPQiToS:DfhdYgJbHQgp20G0ms5XSRoDFg4XybUL

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4892	regsvr32.exe
1744	精易编程助手.exe
1744	精易编程助手.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral10/memory/1744-0-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral10/memory/1744-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral10/memory/1744-13-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-15-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-17-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-18-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-20-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-22-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-24-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-26-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-28-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-30-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-32-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-34-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-36-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-38-0x0000000000400000-0x0000000000748000-memory.dmp	upx
behavioral10/memory/1744-40-0x0000000000400000-0x0000000000748000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DiDaGrid.ocx	精易编程助手.exe
File created	C:\Windows\SysWOW64\DiDaGrid.ocx	精易编程助手.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\ = "DiDaGrid Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\HELPDIR\ = "C:\\Windows\\system32"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\DiDaGrid.ocx, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DIDAGRID.DiDaGridCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DIDAGRID.DiDaGridCtrl.1\ = "DiDaGrid Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DEF539E-66A7-496A-BBAD-7E33A31647D5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DEF539E-66A7-496A-BBAD-7E33A31647D5}\ = "DiDaGrid Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DIDAGRID.DiDaGridCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ = "_DDiDaGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib\ = "{BDD5E40E-8C87-473B-8027-A7D8A81CE564}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DEF539E-66A7-496A-BBAD-7E33A31647D5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\ = "DiDaGrid Control For Free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ = "_DDiDaGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\TypeLib\ = "{BDD5E40E-8C87-473B-8027-A7D8A81CE564}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib\ = "{BDD5E40E-8C87-473B-8027-A7D8A81CE564}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\InprocServer32\ = "C:\\Windows\\SysWow64\\DiDaGrid.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\DiDaGrid.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ = "_DDiDaGridEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3DEF539E-66A7-496A-BBAD-7E33A31647D5}\InprocServer32\ = "C:\\Windows\\SysWow64\\DiDaGrid.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib\ = "{BDD5E40E-8C87-473B-8027-A7D8A81CE564}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ = "_DDiDaGridEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDD5E40E-8C87-473B-8027-A7D8A81CE564}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\ProgID\ = "DIDAGRID.DiDaGridCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DIDAGRID.DiDaGridCtrl.1\CLSID\ = "{0F1447E7-E416-4691-9FEC-A8C4E1ACFB7D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3AE4BB27-46B9-46A0-8817-A3AF282B4BEC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A50A9EDF-9879-49E3-A09B-333FBA4E0D3D}\TypeLib\ = "{BDD5E40E-8C87-473B-8027-A7D8A81CE564}"	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	精易编程助手.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1744	精易编程助手.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1744	精易编程助手.exe
1744	精易编程助手.exe
1744	精易编程助手.exe
1744	精易编程助手.exe
1744	精易编程助手.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4892	1744	精易编程助手.exe	84
PID 1744 wrote to memory of 4892	1744	精易编程助手.exe	84
PID 1744 wrote to memory of 4892	1744	精易编程助手.exe	84

C:\Users\Admin\AppData\Local\Temp\精易编程助手.exe
"C:\Users\Admin\AppData\Local\Temp\精易编程助手.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\Windows\system32\DiDaGrid.ocx /s
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DiDaGrid.ocx

Filesize
840KB

MD5
b4f3df7bcb8b0031629911e5b4f89ee9

SHA1
f80ffcbf144ab85901941f5fb66f1b22a346475f

SHA256
ef2dc1bba4ed93e99d37afe3097e5be917fbb1bacac7df3c24c9146d097dd5d9

SHA512
4f2d80ae45bee18b1f8dee35a6c21b1a5ac772c5d96b0cabb602603d06c387e59e6c5a11598b44a9d5090279ce1b11e44c362b88950e1139ee4c201e24107fce

Download Submit
memory/1744-20-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-36-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1744-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1744-11-0x000000000F720000-0x000000000F7F4000-memory.dmp

Filesize
848KB

Download
memory/1744-13-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-15-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-22-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-40-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-5-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/1744-17-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-24-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-26-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-28-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-30-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-32-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-34-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-0-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-38-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/1744-18-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download