d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/乐刷助手.exe
Size

5.9MB
MD5

c012830576abea2a6234ad8e35846663
SHA1

8a060cda57ca9cd6487c70502d10b1398e5cf1ae
SHA256

72d02c04d0de471af3aedf04ddb792eeb143644f1bb2b43c8a6a44f40affd522
SHA512

b4fb3df20eca0d8d018aee15d06f697e233398cce8be2ae862dd1ae7d816f0443c6800a279b2d25e50afa860bf5068351913628c055d1f26b143018aa3dba9ed
SSDEEP

98304:L+SFODqDmk4qwp3WJuWVDybvrIWsfZkhrLCujyTf2cA0Vi6BzOER96+OkOEwOERo:LGDqKkmRWsbUWsfyK2ctigzOER96+OkV

Score

7^/10

upx vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2496	regsvr32.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral25/memory/2280-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-8-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-10-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-14-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-48-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-45-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-41-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-37-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-29-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-16-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral25/memory/2280-58-0x0000000010000000-0x000000001003D000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral25/files/0x0037000000014245-62.dat	vmprotect
behavioral25/memory/2496-64-0x0000000074440000-0x0000000074C93000-memory.dmp	vmprotect
behavioral25/memory/2496-66-0x0000000074440000-0x0000000074C93000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Registration.bat	乐刷助手.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\ = "ZCBLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR\ = "c:\\ZCB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID\ = "REGCOM.Register"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID\ = "{FDADFBD5-B162-42D3-AC79-21C88F8888BE}"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2280	乐刷助手.exe
2280	乐刷助手.exe
2280	乐刷助手.exe
2280	乐刷助手.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2664	2280	乐刷助手.exe	28
PID 2280 wrote to memory of 2664	2280	乐刷助手.exe	28
PID 2280 wrote to memory of 2664	2280	乐刷助手.exe	28
PID 2280 wrote to memory of 2664	2280	乐刷助手.exe	28
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30
PID 2664 wrote to memory of 2496	2664	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe
"C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Registration.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 c:\ZCB\ZCB.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Registration.bat

Filesize
82B

MD5
d68915023640e63dac11b6c7a1dfa07b

SHA1
afac4d14e71d4474739455d71b197034edeef58a

SHA256
cb9f09b410fc1af8441fa70d4360f723afc3fbf3e2e23c413c43e5e25ef82937

SHA512
59a4a21c5c2a34c32267cb9bdb8536dd4122953727f85fe76bad7964f07108ee6d41e19523b310f190ddf2854324d48a3b57ad3b08ec4fd4926a0290370d8a01

Download Submit
\??\c:\ZCB\ZCB.dll

Filesize
3.6MB

MD5
679820559727944c864d3bdd4768a43f

SHA1
1fdbf2bc3e3b3134a7c6ffe4274651a872a829e5

SHA256
920c57348a1a1925c7ade23f27eba93eb84827c39381306423a02cbb79a4dfa6

SHA512
40db0fe36df37859d1a78da477ba9967cae93dccaf2caa07bd895c4a73bab019b71038569e3b17cb9b09350b79fe2199fc6bbba23a79ff4017072965b94b3e38

Download Submit
memory/2280-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-8-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-10-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-14-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-48-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-45-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-41-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-37-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-29-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-16-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-58-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2280-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2496-64-0x0000000074440000-0x0000000074C93000-memory.dmp

Filesize
8.3MB

Download
memory/2496-66-0x0000000074440000-0x0000000074C93000-memory.dmp

Filesize
8.3MB

Download