d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
133s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/乐刷助手.exe
Size

5.9MB
MD5

4a7a929a6a74aefc34efa3c1c3f65c50
SHA1

504c45066a2d16676ab2312848e8f0010f112bd5
SHA256

e8676cd97a26acfeb447295014a7cd29832b1ec78fb0100b74c72335ffbab193
SHA512

99767a262614fb25271c4612e4ad0191fc6b596ae5e3ee60df44b0b0e68afce9b6f5d5a39af9c6b662cfb2aea5e351bc27e44f86e0302d52647952614c2e4d1a
SSDEEP

98304:L+SFODqDmk48wp3WJuWVDybvrIWsfZkhrLCujyTf2cA0Vi6BzOER96+OkOEwOERo:LGDqKksRWsbUWsfyK2ctigzOER96+OkV

Score

7^/10

upx vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
784	regsvr32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral28/memory/3620-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-37-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-41-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-45-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-31-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-27-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-43-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-5-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-35-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-30-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-19-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral28/memory/3620-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral28/files/0x000a0000000232d5-52.dat	vmprotect
behavioral28/memory/784-54-0x0000000074080000-0x00000000748D3000-memory.dmp	vmprotect
behavioral28/memory/784-55-0x0000000074080000-0x00000000748D3000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Registration.bat	乐刷助手.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\ = "ZCBLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR\ = "c:\\ZCB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID\ = "REGCOM.Register.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID\ = "REGCOM.Register"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID\ = "{FDADFBD5-B162-42D3-AC79-21C88F8888BE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3620	乐刷助手.exe
3620	乐刷助手.exe
3620	乐刷助手.exe
3620	乐刷助手.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3524	3620	乐刷助手.exe	103
PID 3620 wrote to memory of 3524	3620	乐刷助手.exe	103
PID 3620 wrote to memory of 3524	3620	乐刷助手.exe	103
PID 3524 wrote to memory of 784	3524	cmd.exe	105
PID 3524 wrote to memory of 784	3524	cmd.exe	105
PID 3524 wrote to memory of 784	3524	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe
"C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Registration.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 c:\ZCB\ZCB.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Registration.bat

Filesize
82B

MD5
d68915023640e63dac11b6c7a1dfa07b

SHA1
afac4d14e71d4474739455d71b197034edeef58a

SHA256
cb9f09b410fc1af8441fa70d4360f723afc3fbf3e2e23c413c43e5e25ef82937

SHA512
59a4a21c5c2a34c32267cb9bdb8536dd4122953727f85fe76bad7964f07108ee6d41e19523b310f190ddf2854324d48a3b57ad3b08ec4fd4926a0290370d8a01

Download Submit
\??\c:\ZCB\ZCB.dll

Filesize
3.6MB

MD5
679820559727944c864d3bdd4768a43f

SHA1
1fdbf2bc3e3b3134a7c6ffe4274651a872a829e5

SHA256
920c57348a1a1925c7ade23f27eba93eb84827c39381306423a02cbb79a4dfa6

SHA512
40db0fe36df37859d1a78da477ba9967cae93dccaf2caa07bd895c4a73bab019b71038569e3b17cb9b09350b79fe2199fc6bbba23a79ff4017072965b94b3e38

Download Submit
memory/784-55-0x0000000074080000-0x00000000748D3000-memory.dmp

Filesize
8.3MB

Download
memory/784-54-0x0000000074080000-0x00000000748D3000-memory.dmp

Filesize
8.3MB

Download
memory/3620-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-5-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-31-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-27-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-43-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-45-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-35-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-30-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-19-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-41-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-37-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3620-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download