d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/乐刷助手.exe
Size

5.9MB
MD5

4a7a929a6a74aefc34efa3c1c3f65c50
SHA1

504c45066a2d16676ab2312848e8f0010f112bd5
SHA256

e8676cd97a26acfeb447295014a7cd29832b1ec78fb0100b74c72335ffbab193
SHA512

99767a262614fb25271c4612e4ad0191fc6b596ae5e3ee60df44b0b0e68afce9b6f5d5a39af9c6b662cfb2aea5e351bc27e44f86e0302d52647952614c2e4d1a
SSDEEP

98304:L+SFODqDmk48wp3WJuWVDybvrIWsfZkhrLCujyTf2cA0Vi6BzOER96+OkOEwOERo:LGDqKksRWsbUWsfyK2ctigzOER96+OkV

Score

7^/10

upx vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2556	regsvr32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral27/memory/1708-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-51-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-48-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-44-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-42-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-40-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-36-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-29-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-19-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-17-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-11-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral27/memory/1708-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral27/files/0x0010000000015c5d-62.dat	vmprotect
behavioral27/memory/2556-64-0x0000000073D30000-0x0000000074583000-memory.dmp	vmprotect
behavioral27/memory/2556-66-0x0000000073D30000-0x0000000074583000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Registration.bat	乐刷助手.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR\ = "c:\\ZCB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID\ = "REGCOM.Register"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\ = "ZCBLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID\ = "{FDADFBD5-B162-42D3-AC79-21C88F8888BE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1708	乐刷助手.exe
1708	乐刷助手.exe
1708	乐刷助手.exe
1708	乐刷助手.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2668	1708	乐刷助手.exe	28
PID 1708 wrote to memory of 2668	1708	乐刷助手.exe	28
PID 1708 wrote to memory of 2668	1708	乐刷助手.exe	28
PID 1708 wrote to memory of 2668	1708	乐刷助手.exe	28
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30
PID 2668 wrote to memory of 2556	2668	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe
"C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Registration.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 c:\ZCB\ZCB.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Registration.bat

Filesize
82B

MD5
d68915023640e63dac11b6c7a1dfa07b

SHA1
afac4d14e71d4474739455d71b197034edeef58a

SHA256
cb9f09b410fc1af8441fa70d4360f723afc3fbf3e2e23c413c43e5e25ef82937

SHA512
59a4a21c5c2a34c32267cb9bdb8536dd4122953727f85fe76bad7964f07108ee6d41e19523b310f190ddf2854324d48a3b57ad3b08ec4fd4926a0290370d8a01

Download Submit
\??\c:\ZCB\ZCB.dll

Filesize
3.6MB

MD5
679820559727944c864d3bdd4768a43f

SHA1
1fdbf2bc3e3b3134a7c6ffe4274651a872a829e5

SHA256
920c57348a1a1925c7ade23f27eba93eb84827c39381306423a02cbb79a4dfa6

SHA512
40db0fe36df37859d1a78da477ba9967cae93dccaf2caa07bd895c4a73bab019b71038569e3b17cb9b09350b79fe2199fc6bbba23a79ff4017072965b94b3e38

Download Submit
memory/1708-17-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-42-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-40-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-29-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-19-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-44-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-36-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-11-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-48-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1708-51-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2556-64-0x0000000073D30000-0x0000000074583000-memory.dmp

Filesize
8.3MB

Download
memory/2556-66-0x0000000073D30000-0x0000000074583000-memory.dmp

Filesize
8.3MB

Download