d52138cdf8524c5fcaef9770eaf300b4e820e8d002869789bd056b16afbc9da9

Analysis

max time kernel
134s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

乐刷助手(淘宝小号管理，拍单助手) 2.1.9/乐刷助手_原版.exe
Size

5.9MB
MD5

25f7e0e7bdb3ac229caca767bead1d1d
SHA1

08b91d7746e9072a149b3faae006748e2c5b9b83
SHA256

847ff143b3b989c90da576eafa778f531e192ddea59c6bef95096563cbd9a823
SHA512

c9a516a7241c0791ab61281ec10649df33fca3538a69dc63bb2b5cc81acccfd972075840169179f19901a6f33f6723a9394640bf32937589d6f9867b45bf0f68
SSDEEP

98304:VNSFODqDmk41wp3WJuWVDybvrIWsfZkhrLCujyTf2cA0Vi6BzOER96+OkOEwOERo:VNDqKknRWsbUWsfyK2ctigzOER96+OkV

Score

7^/10

upx vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3580	regsvr32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral30/memory/4764-0-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-30-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-36-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-47-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-44-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-46-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-42-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-40-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-39-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-34-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-33-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-28-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-26-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-25-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-22-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-16-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-14-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-8-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-10-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-3-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral30/memory/4764-2-0x0000000010000000-0x000000001003D000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral30/files/0x0005000000022ac3-53.dat	vmprotect
behavioral30/memory/3580-55-0x0000000074450000-0x0000000074CA3000-memory.dmp	vmprotect
behavioral30/memory/3580-56-0x0000000074450000-0x0000000074CA3000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Registration.bat	乐刷助手_原版.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\0\win32\ = "c:\\ZCB\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\ = "ZCBLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ = "ZCBPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.1\CLSID\ = "{FDADFBD5-B162-42D3-AC79-21C88F8888BE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0\HELPDIR\ = "c:\\ZCB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID\ = "REGCOM.Register.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\TypeLib\ = "{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{29921148-DB03-4235-A1EE-307D1056AF5F}\ = "IZCBPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\ = "ZCBPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register\CurVer\ = "REGCOM.Register.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDADFBD5-B162-42D3-AC79-21C88F8888BE}\VersionIndependentProgID\ = "REGCOM.Register"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{683F46C1-F0E9-4F67-BBEA-DFC687E5E3EB}\1.0	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4764	乐刷助手_原版.exe
4764	乐刷助手_原版.exe
4764	乐刷助手_原版.exe
4764	乐刷助手_原版.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4880	4764	乐刷助手_原版.exe	95
PID 4764 wrote to memory of 4880	4764	乐刷助手_原版.exe	95
PID 4764 wrote to memory of 4880	4764	乐刷助手_原版.exe	95
PID 4880 wrote to memory of 3580	4880	cmd.exe	97
PID 4880 wrote to memory of 3580	4880	cmd.exe	97
PID 4880 wrote to memory of 3580	4880	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手_原版.exe
"C:\Users\Admin\AppData\Local\Temp\乐刷助手(淘宝小号管理，拍单助手) 2.1.9\乐刷助手_原版.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Registration.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 c:\ZCB\ZCB.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Registration.bat

Filesize
82B

MD5
d68915023640e63dac11b6c7a1dfa07b

SHA1
afac4d14e71d4474739455d71b197034edeef58a

SHA256
cb9f09b410fc1af8441fa70d4360f723afc3fbf3e2e23c413c43e5e25ef82937

SHA512
59a4a21c5c2a34c32267cb9bdb8536dd4122953727f85fe76bad7964f07108ee6d41e19523b310f190ddf2854324d48a3b57ad3b08ec4fd4926a0290370d8a01

Download Submit
\??\c:\ZCB\ZCB.dll

Filesize
3.6MB

MD5
679820559727944c864d3bdd4768a43f

SHA1
1fdbf2bc3e3b3134a7c6ffe4274651a872a829e5

SHA256
920c57348a1a1925c7ade23f27eba93eb84827c39381306423a02cbb79a4dfa6

SHA512
40db0fe36df37859d1a78da477ba9967cae93dccaf2caa07bd895c4a73bab019b71038569e3b17cb9b09350b79fe2199fc6bbba23a79ff4017072965b94b3e38

Download Submit
memory/3580-56-0x0000000074450000-0x0000000074CA3000-memory.dmp

Filesize
8.3MB

Download
memory/3580-55-0x0000000074450000-0x0000000074CA3000-memory.dmp

Filesize
8.3MB

Download
memory/4764-22-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-14-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-42-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-40-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-39-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-34-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-33-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-28-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-26-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-25-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-16-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-46-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-8-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-10-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-3-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-2-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-44-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-47-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-36-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4764-30-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download