MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-04 08:56

Signatures

ACProtect 1.3x - 1.4x DLL software

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2200 wrote to memory of 2068	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2068 wrote to memory of 3048	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2068 wrote to memory of 3048	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2068 wrote to memory of 3048	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2068 wrote to memory of 3048	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 224

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

117s

Max time network

118s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

Signatures

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS\ = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\Programmable	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID\ = "SmartTool.SmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\ = "SmartTool 1.0 Type Library"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1640 wrote to memory of 1240	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

135s

Max time network

141s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4848 wrote to memory of 3800	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4848 wrote to memory of 3800	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4848 wrote to memory of 3800	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 612

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	21.53.126.40.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	123.10.44.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240419-en

Max time kernel

118s

Max time network

118s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2424 wrote to memory of 3032	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3032 wrote to memory of 3040	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3032 wrote to memory of 3040	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3032 wrote to memory of 3040	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3032 wrote to memory of 3040	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 224

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

134s

Max time network

141s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 664 wrote to memory of 1340	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 664 wrote to memory of 1340	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 664 wrote to memory of 1340	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	25.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240221-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"

Signatures

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SmartTool = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.exe"	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID\ = "SmartTool.SmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS\ = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\Programmable	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\ = "SmartTool 1.0 Type Library"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 2212 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SmartTool.exe

"C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\SmartTool.dll"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	sm.plustab.co.kr	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 820 wrote to memory of 416	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 820 wrote to memory of 416	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 820 wrote to memory of 416	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 416 -ip 416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 624

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	28.73.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

136s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5056 wrote to memory of 4552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 5056 wrote to memory of 4552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 5056 wrote to memory of 4552	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 4552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
NL	23.62.61.99:443	www.bing.com	tcp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	99.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2232 wrote to memory of 1900	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\adc.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20231129-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 1296	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1296 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1296 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1296 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1296 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 224

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

94s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

Signatures

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\Programmable	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID\ = "SmartTool.SmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\ = "SmartTool 1.0 Type Library"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS\ = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1660 wrote to memory of 1800	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1660 wrote to memory of 1800	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1660 wrote to memory of 1800	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\SmartTool.dll

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240221-en

Max time kernel

119s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2984 wrote to memory of 2012	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2012 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2012 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240221-en

Max time kernel

140s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 776	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 776 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 776 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 776 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 776 wrote to memory of 2076	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 220

Network

N/A

Files

memory/776-2-0x00000000747D0000-0x00000000747D9000-memory.dmp

memory/776-3-0x00000000747B0000-0x00000000747B9000-memory.dmp

memory/776-1-0x00000000747C0000-0x00000000747C9000-memory.dmp

memory/776-0-0x00000000747D0000-0x00000000747D9000-memory.dmp

memory/776-4-0x00000000747B0000-0x00000000747B9000-memory.dmp

memory/776-6-0x00000000747D0000-0x00000000747D9000-memory.dmp

memory/776-8-0x00000000747D0000-0x00000000747D9000-memory.dmp

memory/776-7-0x00000000747C0000-0x00000000747C9000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 228 wrote to memory of 4020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 228 wrote to memory of 4020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 228 wrote to memory of 4020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 624

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
NL	23.62.61.137:443	www.bing.com	tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	137.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20231129-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2368 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2368 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2368 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2368 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 192

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

103s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1684 wrote to memory of 2952	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1684 wrote to memory of 2952	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1684 wrote to memory of 2952	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2952 -ip 2952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 624

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5112 wrote to memory of 2932	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 5112 wrote to memory of 2932	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 5112 wrote to memory of 2932	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2932 -ip 2932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	25.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 328 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 328 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 328 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 328 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 224

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1588 wrote to memory of 3264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1588 wrote to memory of 3264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1588 wrote to memory of 3264	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3264 -ip 3264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
NL	23.62.61.121:443	www.bing.com	tcp
US	8.8.8.8:53	121.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	147.142.123.92.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	175.117.168.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 768 wrote to memory of 4472	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 768 wrote to memory of 4472	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 768 wrote to memory of 4472	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4472 -ip 4472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 612

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2172 wrote to memory of 2104	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2104 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2104 wrote to memory of 2372	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fct.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 224

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

95s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2664 wrote to memory of 1764	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2664 wrote to memory of 1764	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2664 wrote to memory of 1764	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1764 -ip 1764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2960 -ip 2960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	67.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	49.192.11.51.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240215-en

Max time kernel

122s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2460 wrote to memory of 2720	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2720 wrote to memory of 2900	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2720 wrote to memory of 2900	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2720 wrote to memory of 2900	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2720 wrote to memory of 2900	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 224

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

102s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

Signatures

ACProtect 1.3x - 1.4x DLL software

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3456 wrote to memory of 2884	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3456 wrote to memory of 2884	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3456 wrote to memory of 2884	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SelfDel.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2884 -ip 2884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 612

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
NL	23.62.61.72:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	71.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp

Files

memory/2884-0-0x0000000075550000-0x0000000075559000-memory.dmp

memory/2884-1-0x0000000075550000-0x0000000075559000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

122s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2408 wrote to memory of 2468	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2468 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2468 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2468 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2468 wrote to memory of 2476	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 224

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"

Signatures

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SmartTool = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.exe"	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A

Installs/modifies Browser Helper Object

stealer adware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS\ = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID\ = "{2D891923-34B7-4186-9B47-752624535DC1}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SmartTool.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\Programmable	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\InprocServer32\ThreadingModel = "Apartment"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\ = "SmartTool 1.0 Type Library"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl.1\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID\ = "SmartTool.SmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\FLAGS	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\0\win32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CurVer\ = "SmartTool.SmartToolCtl.1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartTool.SmartToolCtl\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\TypeLib\ = "{E97662C9-6D8A-47A6-BBF6-17730FEE28F0}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\TypeLib\Version = "1.0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D891923-34B7-4186-9B47-752624535DC1}\ = "SmartToolCtl Class"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ = "ISmartToolCtl"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F67A437-3336-4B2E-B211-D5BD3C6F5461}\ProxyStubClsid32	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1712 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1712 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1712 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\SmartTool.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SmartTool.exe

"C:\Users\Admin\AppData\Local\Temp\SmartTool.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\SmartTool.dll"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	sm.plustab.co.kr	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
NL	23.62.61.99:443	www.bing.com	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	99.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240508-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1488 wrote to memory of 1252	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1252 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1252 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1252 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1252 wrote to memory of 1680	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IpConfig.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 224

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 08:56

Reported

2024-06-04 08:59

Platform

win7-20240221-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\943d8344e46950cf0d339a2556555ead_JaffaCakes118.exe"

Network

N/A

Files

N/A

Sample ID	240604-kv9kzsca38
Target	943d8344e46950cf0d339a2556555ead_JaffaCakes118
SHA256	9e1ca5e7238caa866540cc89146988d4c15d4b31d7e41e3d602571d7e8e6c502
Tags	adware stealer upx persistence

Malware Analysis Report

2024-07-28 05:14

Table of Contents