Overview
overview
10Static
static
31408_cn_V8...er.exe
windows7-x64
31408_cn_V8...er.exe
windows10-2004-x64
101408_cn_V8...er.exe
windows7-x64
31408_cn_V8...er.exe
windows10-2004-x64
101408_cn_V8...VR.exe
windows7-x64
31408_cn_V8...VR.exe
windows10-2004-x64
101408_cn_V8...lt.htm
windows7-x64
71408_cn_V8...lt.htm
windows10-2004-x64
11408_cn_V8...de.exe
windows7-x64
31408_cn_V8...de.exe
windows10-2004-x64
31408_cn_V8...ew.dll
windows7-x64
11408_cn_V8...ew.dll
windows10-2004-x64
11408_cn_V8...ew.exe
windows7-x64
31408_cn_V8...ew.exe
windows10-2004-x64
101408_cn_V8...rs.exe
windows7-x64
31408_cn_V8...rs.exe
windows10-2004-x64
101408_cn_V8...up.exe
windows7-x64
31408_cn_V8...up.exe
windows10-2004-x64
101408_cn_V8...20.sys
windows7-x64
11408_cn_V8...20.sys
windows10-2004-x64
11408_cn_V8...oo.exe
windows7-x64
31408_cn_V8...oo.exe
windows10-2004-x64
101408_cn_V8...lp.chm
windows7-x64
11408_cn_V8...lp.chm
windows10-2004-x64
11408_cn_V8...er.exe
windows7-x64
11408_cn_V8...er.exe
windows10-2004-x64
101408_cn_V8...��.doc
windows7-x64
41408_cn_V8...��.doc
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 08:45
Static task
static1
Behavioral task
behavioral1
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVP/Net Player.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVP/Net Player.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR Player.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral4
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR Player.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/DVR.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/DVR.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/default.htm
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/default.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/encode.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/encode.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/InstallDrivers.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/InstallDrivers.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/Setup.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/Setup.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/driver/cx25820.sys
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/driver/cx25820.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/foo.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/foo.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/help.chm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/help.chm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/merger.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/merger.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/常见问题解决方法.doc
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral28
Sample
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/常见问题解决方法.doc
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.dll
-
Size
736KB
-
MD5
6d50265fe4d14e0ddae1b73aed37e864
-
SHA1
2505ef562b6861bc1189967c88e0453797a88df8
-
SHA256
68da49bcd3c1105405297b5420ae86529aec7067d6cd8427d30be577cb6b9ced
-
SHA512
61a6e63c20b10a8b9877f3d3590e06cf0f3f1d25ddd708fc5c4f135c899f212216612ef80b95c8d600d224ab080f50032a34db1281e34d2221f580db9d4949c9
-
SSDEEP
6144:UwQOAxBfnUDiNk5jtgf9NVmXNcc4g9xHE4i/eXXeuQeewQee7QeesQeezPQeefQJ:TiNst49N+cczk//eOhE2522xjXW
Malware Config
Signatures
-
Modifies registry class 56 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\ = "ATLFire 3.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\1\ = "131473" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\CLSID\ = "{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ProgID\ = "ATLFire.WebView2.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\VersionIndependentProgID\ = "ATLFire.WebView2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\ = "WebView2 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\ = "WebView2 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Insertable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ = "WebView2 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CLSID\ = "{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll, 101" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ = "IWebView2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CurVer\ = "ATLFire.WebView2.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ = "IWebView2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe PID 1740 wrote to memory of 2236 1740 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\webview.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\webview.dll2⤵
- Modifies registry class
PID:2236